# NCSC CEO Richard Horne: Hostile States Linked to Three-Quarters of Cyber Attacks on UK Critical National Infrastructure

> At the RUSI Annual Security Lecture on 17 June 2026, NCSC CEO Dr Richard Horne stated that 75% of the 200+ cyber incidents the NCSC managed against UK critical national infrastructure in the year to May 2026 were linked to hostile state actors (Russia, China, Iran), and warned that by 2028 AI-enabled capabilities will likely be used to exploit known vulnerabilities in legacy CNI technology at scale.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2239
- **ID:** TL-2026-2239
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-22681

## Description

On 17 June 2026, NCSC CEO Dr Richard Horne delivered the RUSI Annual Security Lecture in London, marking the ten-year anniversary of the UK's National Cyber Security Centre. He disclosed that the NCSC managed over 200 cyber incidents affecting UK critical national infrastructure (CNI) and its supporting ecosystem in the year to May 2026, with roughly 75% linked back to hostile state actors. He explicitly named Russia, China, and Iran, framing cyber security not as a manageable risk but as "an ongoing contest with capable adversaries" in which "there are no spectators, we are all on the pitch." Manufacturing, water and wastewater, and power generation together accounted for over 40% of attacks recorded across the 20 UK CNI sectors.

The NCSC statement itself names no specific incident, CVE, or indicator, but each of the three named states has an independently attributed, technically documented campaign pattern against exactly this target set. China's Volt Typhoon has infiltrated US communications, energy, transportation, and water/wastewater networks using living-off-the-land techniques (LOLBins, valid-account abuse, minimal malware) to pre-position for disruptive access, per the CISA/NSA/FBI joint advisory AA24-038A. Iran's CyberAv3ngers (IRGC Cyber-Electronic Command, aka Storm-0784/Bauxite/UNC5691) has repeatedly compromised internet-exposed Unitronics Vision Series PLCs at water utilities across the US, UK, and Ireland via factory-default credentials since at least 2020, and is separately exploiting an unpatched authentication-bypass in Rockwell Automation Logix controllers (CVE-2021-22681, CVSS 9.8). In a near-contemporaneous, independently reported incident, a small UK power generator (a sub-50MW peaker plant) was suspected to have been taken offline for four days in July 2026 by an IRGC-linked actor after an internet-exposed PLC was reprogrammed and its credentials and IP address changed; the NCSC and the Department for Energy Security and Net Zero briefed UK energy CEOs in response. Russia's Sandworm (GRU Unit 74455 / APT44 / Seashell Blizzard), previously exposed by the NCSC and allies for the Cyclops Blink botnet malware and the attempted 2018 attack on the OPCW, has run the near-global "BadPilot" initial-access subgroup campaign since at least 2021, which by 2024 had honed its focus on US, UK, Canada, and Australian victims per Microsoft reporting.

Horne's AI warning ties directly to this pattern: the NCSC assesses it "highly likely" that by 2028, AI-enabled cyber capabilities will be used by attackers against known vulnerabilities in legacy CNI technology at scale, noting frontier AI models are already effective at discovering long-standing code vulnerabilities. Reporting on the suspected July 2026 UK power-generator intrusion described the attacker using AI-generated scripts to scan the internet for exposed PLCs before exploiting default credentials — an early real-world instance of the exact pattern Horne described five weeks earlier.

The speech landed alongside two UK policy developments: the Cyber Security and Resilience (Network and Information Systems) Bill, which reached report stage in the House of Commons by May 2026 and would update the NIS Regulations 2018 covering CNI operators, and the Government's National Cyber Action Plan, published 6 January 2026. It also follows the NCSC's own Annual Review 2025 baseline, which recorded 204 "nationally significant" incidents (up from 89 the prior year) — an average of four per week — out of 429 total incidents requiring NCSC support, with 18 categorised as "highly significant." Horne called on organisational leaders to build three capabilities: understand their threat exposure across new and legacy technology and supply chains, defend using security fundamentals (Cyber Essentials and beyond), and ensure operational continuity and rapid, at-scale recovery after an attack, warning that "many vulnerabilities that organizations tolerate today will be exploited in conflict tomorrow."

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1543.002 Systemd Service
- T1027 Obfuscated Files or Information
- T1110 Brute Force
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1485 Data Destruction
- T1561 Disk Wipe
- T0819 Exploit Public-Facing Application

## Sources

- [NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems](https://www.ncsc.gov.uk/news/ncsc-ceo-hostile-states-linked-to-three-quarters-of-cyber-attacks)
- [Richard Horne speaking at the RUSI Annual Security Lecture](https://www.ncsc.gov.uk/speech/richard-horne-speaking-at-the-rusi-annual-security-lecture)
- [Annual Security Lecture 2026 by Richard Horne, CEO, NCSC](https://my.rusi.org/events/annual-security-lecture-2026-by-richard-horne-ceo-ncsc.html)
- [Hostile States Behind 75% of Cyber-Attacks on UK CNI, NCSC Warns](https://www.infosecurity-magazine.com/news/hostile-states-cni-75-percent-ncsc/)
- [Hostile states behind three-quarters of attacks on Britain's critical infrastructure, cyber chief warns](https://therecord.media/britain-nation-state-cyberattacks-richard-horne-rusi)
- [RUSI Annual Security Lecture 2026, comment](https://professionalsecurity.co.uk/news/interviews/rusi-annual-security-lecture-2026-comment/)
- [UK energy alert issued after Iranian cyber attack on power plant](https://www.thenationalnews.com/news/uk/2026/08/24/uk-energy-alert-issued-after-iranian-cyber-attack-on-power-plant/)
- [Iranian Cyberattack Shuts Down UK Power Generator](https://www.securitymagazine.com/articles/102512-iranian-cyberattack-shuts-down-uk-power-generator)
- [PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- [IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities (AA23-335A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a)
- [Iran-Linked CyberAv3ngers Sets Sights on Water Utilities and Industrial Controllers](https://cybersecuritynews.com/iran-linked-cyberav3ngers-sets-sights/)
- [Volt Typhoon Explained: Living Off the Land Tactics for Cyber Espionage](https://www.picussecurity.com/resource/blog/volt-typhoon-living-off-the-land-cyber-espionage)
- [Sandworm Team, ELECTRUM, Telebots, IRON VIKING, BlackEnergy, Voodoo Bear, Seashell Blizzard, APT44 (G0034)](https://attack.mitre.org/groups/G0034/)
- [UK and allies uncover Russian military unit carrying out cyber attacks and digital sabotage for the first time](https://www.ncsc.gov.uk/news/uk-allies-uncover-russian-military-carrying-out-cyber-attacks-digital-sabotage)
- [UK experiencing four 'nationally significant' cyber attacks every week](https://www.ncsc.gov.uk/news/uk-experiencing-four-nationally-significant-cyber-attacks-weekly)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2239