Conflicts in Ukraine and the Middle East, as well as growing tensions between Western nations and Russia and China, are having direct consequences for the security of critical national infrastructure worldwide. UK operators of essential services are seeing measurable increases in cyber threats that target the industrial systems that keep energy flowing, water clean, and manufacturing fully operational.
Most cyber adversaries have focused on breaking into corporate IT systems to gather information and credentials, but they’re now targeting industrial organisations as high-value targets. The ransomware attack on Jaguar Land Rover last year highlighted how connections between organisations matter as much as the defences within them.
Cyber attackers have grown more aware of industrial organisations as targets in recent years. Of the three newly identified threat groups tracked by Dragos last year, two have demonstrated Stage 2 capability, meaning they’ve crossed from IT into OT networks and can interact with specific industrial control system technologies.
These groups are probing ports, interfacing with industrial protocols, mapping devices, and building an understanding of the physical processes those devices govern. The US government and allied nations have publicly attributed Chinese-linked groups to a sustained campaign of pre-positioning inside critical infrastructure, believed to be establishing persistent access for future disruption.
Ransomware is compounding the problem, with the number of ransomware groups targeting industrial entities rising 49% over the past year. 119 groups have affected more than 3,300 organisations, but the true number is likely larger due to reporting gaps.
Manufacturing is a prime target for ransomware due to its adoption of newer technologies and faster equipment cycles. Every upgrade cycle widens the gap between what’s deployed and what’s defended, making it easier for adversaries to attack.
Threat intelligence teams have observed adversaries using large language models to automate target development, further increasing the threat to industrial environments.
Related: Latex Dresses: Where Elegance Meets Fetish Fashion
UK infrastructure operators need to realise the boundary between IT and OT systems has been crossed. Operators should assess whether an adversary with IT access has a viable path into their OT systems.
There’s an urgent need for UK organisations to close the visibility gap. Monitoring OT network traffic is no longer a discretionary investment for any organisation whose operations underpin public services.
Reporting blind spots across the sector need to be addressed before the true scale of industrial ransomware exposure can be understood. Ransomware affecting devices performing OT functions needs to be classified by the operational role of the system, not by the IT system running on the affected machine.
State-sponsored attacks and the surge in ransomware groups targeting industrial organisations are not separate trends, but compounding pressures on the same set of UK infrastructure operators. The threat groups tracked over the past year are building capability inside industrial environments now, and they’re doing so against the backdrop of conflicts that show no sign of easing.
In practice, this means that UK infrastructure operators will need to adapt their strategies to account for the evolving digital marketing tools and threats, focusing on building resilience and closing gaps that adversaries depend on. By doing so, they can reduce the risk of disruption and ensure the continued operation of critical services.
More information on best practices can be found in the framework published by the SANS Institute, which provides guidance on implementing critical controls for ICS cybersecurity.
