Cyfirma's December 16, 2024 report reveals intensifying cyber threats to the UK from state-backed Russian hackers amid geopolitical tensions, highlighting activities from groups like Sandworm, APT29, and Unit 29155 targeting critical UK infrastructure and institutions.

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

Aggressor

Summary

The Cyfirma report dated December 16, 2024, outlines a growing and sophisticated cyber threat landscape in the UK led by state-backed Russian hacking groups and privateers acting with Kremlin leniency. Major groups identified include Sandworm, known for destructive attacks such as NotPetya; APT29, linked with the Russian SVR conducting espionage and supply chain attacks like SolarWinds; and Unit 29155 of the Russian GRU conducting intelligence gathering, sabotage, and destructive malware campaigns including Whispergate in Ukraine. The UK National Cyber Security Centre (NCSC) has responded by collaborating internationally, mitigating over 430 incidents in 2024, up from 371 in 2023, yet warns of underestimation of threat severity. Russia's hybrid war tactics involve spear-phishing, watering hole attacks, zero-day exploits, DDoS attacks by hacktivist groups such as Noname057(16), and joint pro-Palestinian/Russian hacktivist operations under the banner #OpUK. The report notes Russian outsourcing of cyber operations to private and non-state actors, increasing unpredictability and aiming to destabilize UK and allied cyber environments. The report references multiple linked incidents, emphasizes increasing attack sophistication, targets ranging from critical infrastructure, government, defense, academia, to supply chains, and calls for enhanced resilience and coordinated defense efforts.

Classification

Confidence: High

The report documents confirmed hostile state-backed Russian cyber activities including espionage, destructive malware, DDoS attacks, and supply chain compromises directly targeting UK critical infrastructure, governmental, and defense sectors amid ongoing geopolitical conflicts.

Source URL

https://industrialcyber.co/ransomware/cyfirma-report-uk-faces-intensifying-cyber-threats-from-state-backed-russian-hackers-amid-geopolitical-tensions

Open source

Provenance

Publisher: extension
Submitted: Jun 9, 2026, 15:45 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Dec 16, 2024, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "21f3a5e8-65fc-4929-a1b3-6cb8528ce073",
  "url": "https://industrialcyber.co/ransomware/cyfirma-report-uk-faces-intensifying-cyber-threats-from-state-backed-russian-hackers-amid-geopolitical-tensions",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "United Kingdom",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Cyfirma",
    "UK",
    "Russian hackers",
    "Sandworm",
    "APT29",
    "Unit 29155",
    "GRU",
    "SVR",
    "Whispergate",
    "SolarWinds",
    "Spear-phishing",
    "DDoS",
    "Hacktivists",
    "offensive cyber operations",
    "NCSC",
    "Critical infrastructure",
    "Geopolitical tensions",
    "Cyberattacks",
    "Supply chain compromise"
  ],
  "nodes": [],
  "countries": [
    "United Kingdom"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "The Cyfirma report dated December 16, 2024, outlines a growing and sophisticated cyber threat landscape in the UK led by state-backed Russian hacking groups and privateers acting with Kremlin leniency. Major groups identified include Sandworm, known for destructive attacks such as NotPetya; APT29, linked with the Russian SVR conducting espionage and supply chain attacks like SolarWinds; and Unit 29155 of the Russian GRU conducting intelligence gathering, sabotage, and destructive malware campaigns including Whispergate in Ukraine. The UK National Cyber Security Centre (NCSC) has responded by collaborating internationally, mitigating over 430 incidents in 2024, up from 371 in 2023, yet warns of underestimation of threat severity. Russia's hybrid war tactics involve spear-phishing, watering hole attacks, zero-day exploits, DDoS attacks by hacktivist groups such as Noname057(16), and joint pro-Palestinian/Russian hacktivist operations under the banner #OpUK. The report notes Russian outsourcing of cyber operations to private and non-state actors, increasing unpredictability and aiming to destabilize UK and allied cyber environments. The report references multiple linked incidents, emphasizes increasing attack sophistication, targets ranging from critical infrastructure, government, defense, academia, to supply chains, and calls for enhanced resilience and coordinated defense efforts.",
  "summary_short": "Cyfirma's December 16, 2024 report reveals intensifying cyber threats to the UK from state-backed Russian hackers amid geopolitical tensions, highlighting activities from groups like Sandworm, APT29, and Unit 29155 targeting critical UK infrastructure and institutions.",
  "summary_extended": null,
  "actor_primary": "Sandworm",
  "target_primary": null,
  "location_text": "United Kingdom",
  "location_region": null,
  "location_coordinates_lat": 55.3781,
  "location_coordinates_lon": -3.436,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The report documents confirmed hostile state-backed Russian cyber activities including espionage, destructive malware, DDoS attacks, and supply chain compromises directly targeting UK critical infrastructure, governmental, and defense sectors amid ongoing geopolitical conflicts.",
  "event_time_utc": "2024-12-16T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-06-09T15:45:00.068Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: UnknownLocation: Approximate

Source reliability

Info credibility

Event time

Dec 16, 2024, 00:00 UTC

Event time confidence

unknown

Location

United Kingdom

Primary actor

Sandworm

Country

United Kingdom

Countries

United Kingdom

Tags

Cyfirma, UK, Russian hackers, Sandworm, APT29, Unit 29155, GRU, SVR, Whispergate, SolarWinds, Spear-phishing, DDoS, Hacktivists, offensive cyber operations, NCSC, Critical infrastructure, Geopolitical tensions, Cyberattacks, Supply chain compromise

Loading signal...

{ "id": "21f3a5e8-65fc-4929-a1b3-6cb8528ce073", "url": "https://industrialcyber.co/ransomware/cyfirma-report-uk-faces-intensifying-cyber-threats-from-state-backed-russian-hackers-amid-geopolitical-tensions", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "United Kingdom", "source_reliability": "C", "info_credibility": "3", "tags": [ "Cyfirma", "UK", "Russian hackers", "Sandworm", "APT29", "Unit 29155", "GRU", "SVR", "Whispergate", "SolarWinds", "Spear-phishing", "DDoS", "Hacktivists", "offensive cyber operations", "NCSC", "Critical infrastructure", "Geopolitical tensions", "Cyberattacks", "Supply chain compromise" ], "nodes": [], "countries": [ "United Kingdom" ], "where_text": "Cyberspace", "headline": null, "description": "The Cyfirma report dated December 16, 2024, outlines a growing and sophisticated cyber threat landscape in the UK led by state-backed Russian hacking groups and privateers acting with Kremlin leniency. Major groups identified include Sandworm, known for destructive attacks such as NotPetya; APT29, linked with the Russian SVR conducting espionage and supply chain attacks like SolarWinds; and Unit 29155 of the Russian GRU conducting intelligence gathering, sabotage, and destructive malware campaigns including Whispergate in Ukraine. The UK National Cyber Security Centre (NCSC) has responded by collaborating internationally, mitigating over 430 incidents in 2024, up from 371 in 2023, yet warns of underestimation of threat severity. Russia's hybrid war tactics involve spear-phishing, watering hole attacks, zero-day exploits, DDoS attacks by hacktivist groups such as Noname057(16), and joint pro-Palestinian/Russian hacktivist operations under the banner #OpUK. The report notes Russian outsourcing of cyber operations to private and non-state actors, increasing unpredictability and aiming to destabilize UK and allied cyber environments. The report references multiple linked incidents, emphasizes increasing attack sophistication, targets ranging from critical infrastructure, government, defense, academia, to supply chains, and calls for enhanced resilience and coordinated defense efforts.", "summary_short": "Cyfirma's December 16, 2024 report reveals intensifying cyber threats to the UK from state-backed Russian hackers amid geopolitical tensions, highlighting activities from groups like Sandworm, APT29, and Unit 29155 targeting critical UK infrastructure and institutions.", "summary_extended": null, "actor_primary": "Sandworm", "target_primary": null, "location_text": "United Kingdom", "location_region": null, "location_coordinates_lat": 55.3781, "location_coordinates_lon": -3.436, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The report documents confirmed hostile state-backed Russian cyber activities including espionage, destructive malware, DDoS attacks, and supply chain compromises directly targeting UK critical infrastructure, governmental, and defense sectors amid ongoing geopolitical conflicts.", "event_time_utc": "2024-12-16T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-06-09T15:45:00.068Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }