2026 Cyber Threat Landscape in the UK: Risks, Threats, and Guidance

Introduction

The United Kingdom is the world’s fifth largest economy and a global hub for financial services  and technology. As organisations in the country accelerate digital transformation, connect operational technology (OT) environments, and deploy AI-enabled technologies, their cyber exposure grows alongside new opportunities for innovation and economic growth.

Amid this transformation, the UK faces an increasingly complex threat landscape. Cybercriminals continue to target organisations with ransomware and extortion campaigns, state-sponsored actors seek access to sensitive networks, and hacktivists target critical infrastructure and internet-exposed systems. In 2025, the financial impact from major ransomware attacks against manufacturing and retail alone was estimated to surpass two billion pounds.

These challenges reflect broader global trends. In the first half of 2026, published vulnerabilities increased 51% year-over-year, ransomware attacks rose 25%, and Forescout Research – Vedere Labs tracked more than 5,700 hacktivist attack claims worldwide.

In response to global and domestic threats, government agencies and industry groups have introduced new regulations and guidance designed to strengthen resilience across critical sectors. Examples include the Cyber Assessment Framework (CAF) for operators of essential services, the Cyber Governance Code of Practice aimed at strengthening board-level accountability for cyber risk, and the Product Security and Telecommunications Infrastructure  Act, which introduced security requirements for connected devices. The government has also proposed the Cyber Security and Resilience Bill, which aims to strengthen cyber resilience requirements across critical national infrastructure.

In this time of rapid change, understanding where cyber risk exists and how threat actors are evolving is critical. In this report, Forescout Research – Vedere Labs analyses threat actor targeting, ransomware activity, hacktivist campaigns and internet-exposed assets in the United Kingdom and provides practical recommendations to help organisations reduce risk.

Threat Actors

Forescout Research – Vedere Labs’ Threat Actor Knowledgebase currently tracks 108 threat actors that have targeted organisations in the. Most of these actors have targeted government agencies (82%), financial services (76%), or technology companies (70%), but other industries have also been attacked.

Fifty-five percent are cybercriminals with a main goal of financial gain. Another 33% are state-sponsored actors focused on intelligence gathering, espionage, and intellectual property theft. Finally, 12% are hacktivists executing denial of service attacks, defacements, sabotage or destruction operations. While larger organisations are more likely to attract state-sponsored actors and ransomware groups due to the value of their data and operations, smaller organisations are often targeted opportunistically by hacktivists and cybercriminals seeking victims with a weaker security posture.

Twenty-nine percent of the threat actors tracked are from Russia, 20% are based in China, 6% are Iranian, 5% are North Korean and the remaining 40% come from other countries. Threat actor origin and targeting information is drawn from the Forescout Research – Vedere Labs Threat Actor Knowledgebase, which combines our own tracking with publicly reported threat intelligence and attribution from industry and government sources.

Our 2026H1 report shows that the UK was the second most targeted country in the first half of 2026. The country had a higher concentration of state-sponsored actors (33% versus the global 20% average) and actors based in Russia (29% versus the global 13%), surpassing China. The top three most targeted industries were the same globally, but the remaining industries in the top 10 changed slightly: energy was fourth in the UK and ninth globally, while telecom was sixth in the

Ransomware

According to public ransomware breach claims, the UK was the fourth most attacked country by ransomware groups between Jan.1 and Sept. 30, 2026. The UK came behind the US, Canada, and Germany, making it the second-most attacked country in Europe.

In this period, there were 269 ransomware attacks claimed by 64 different groups. That is a 21% increase over the 223 incidents in the same period of 2025, which in turn was an 8% increase over the 207 incidents in the same period of 2024, showing that growth is accelerating.

The most active groups in this period were Qilin, Dragonforce, The Gentlemen, Clop, and Akira, while the most targeted industries were business/professional services, manufacturing, and technology. The figures are very similar to the global 2026H1 data.

Overall, the same database of ransomware attacks records 1,152 attacks on British organisations between January 1, 2022 and September 30, 2026. These attacks have already demonstrated their ability to cause major disruptions in the UK. The financial impact of ransomware attacks against manufacturing and retail organizations alone exceeded 2 billion pounds in 2025, and more recent ransomware attacks have impacted healthcare delivery and patient privacy, bankrupted smaller organizations, and emptied supermarket shelves.

Hacktivism

Last year, we discussed the rise of ‘state-sponsored hacktivism’ and how 82% of attacks we monitored targeted critical infrastructure in European countries. We continue to observe hacktivist groups targeting British government institutions, public services, and organisations perceived as strategically important due to the UK’s geopolitical role and support for international allies.

We monitored 227 hacktivist attack claims against the UK between Jan. 1 and Sept. 30, 2026. That is a massive 337% increase over the 52 claims observed in all of 2025. These attacks were carried out by dozens of groups but 60% were claimed by two very active pro-Russian groups:

• NoName057(16), which has been active since 2022 and developed the DDoSia to conduct distributed denial of service (DDoS) attacks. They were the most active hacktivist group we reported in early 2025 and even after a law enforcement operation by Europol in July that year, the group remains the most active.
• Z-Pentest Alliance, which was formed in September 2024 and includes members from other groups, such as Cyber Army of Russian Reborn (CARR), NoName057(16) and Sector16. The group specializes in hacking IoT/OT systems, leaking data and defacing targets. They have carried infamous attacks such as seizing control of a dam in Norway in 2025.

Other relevant groups that carried out attacks include:

• Garuda, a decentralised ecosystem of mainly pro-Palestinian hacktivist groups, believed to be based in Indonesia.
• 313 team, a pro-Iranian group, that claims to be based in Iraq.
• Dark Storm Team, a pro-Palestinian group, that emerged after the October 7 attacks in 2023.
• Keymous Plus, a group that self identifies as “North African hackers”, has carried out DDoS attacks against several countries.

As the group descriptions indicate, the observed attacks are a combination of DDoS, system disruption, data breaches, and defacement. The figure below shows that DDoS represented over half of the attacks, but system takeover and disruption is a relevant category with more than one quarter of claims. The figure also shows that government, technology, and manufacturing were the most targeted industries by hacktivists.

The distribution of attack types and targeted industries follows the global trend, with the most noticeable difference being that utilities was the fourth most targeted industry in the UK, while it was the seventh globally.

Below are some examples of typical hacktivist claims we see shared on Telegram targeting British organisations.

The first example highlights the political nature of these attacks. The anti-Israeli group Arabian Ghosts claimed to take control of the web application controlling an energy monitoring device and use it to tamper with power settings. The message explicitly mentions targeting countries that support Israel. Their claim that ‘an explosion will occur because of this’ is clearly exaggerated, but also demonstrates how these groups mix political propaganda, cyber activity, and psychological operations.

The second example shows a human machine interface (HMI) for a building automation system at a manufacturing facility that was taken over by Z-Pentest Alliance. The HMI provided control over certain physical access control and air conditioning functions and the video attached to the message by the group showed them tampering with air conditioning parameters via the HMI.

The third example is the HMI for an industrial autoclave in another manufacturing facility that was also taken over by Z-Pentest Alliance. Again, the group posted a video showing how they tampered with several parameters in the HMI which could lead to quality or safety issues in a manufacturing process.

Risks: Exposed Devices

The Shodan search engine reports around 50 million internet-exposed devices in the UK. The figure below shows a breakdown of these devices per exposed port/service and device type (excluding traditional IT servers).

The predominance of HTTP/HTTPS is similar to the worldwide top 10, but the popularity of other ports and services are particular to the UK:

• Port 7547, used by the CWMP protocol for internet service providers to remotely configure home networking equipment, is the top 2 in the UK but top 4 globally.
• Port 22 used by the SSH protocol for remote management is the top 4 in the UK but top 6 globally.
• Ports 179/BGP and 5060/SIP are top 8 and 10 in the UK, respectively, but don’t figure among the top 10 globally.

The distribution of exposed assets – containing only those that are not traditional IT such as servers and whose specific type could be identified – shows the popularity of three categories of devices that are known to be risky:

• Edge devices such as routers and security appliances. These are the riskiest devices in 2026 and the most commonly seen exposed online since they enable connectivity. They are also often vulnerable and targeted by threat actors.
• Commonly misconfigured IoT devices, such as IP cameras, DVRs, VoIP, and printers. These are often inadvertently directly connected to the internet and are misconfigured with default or weak credentials.
• Operational Technology. These are possibly the most impactful devices when compromised, as shown in the hacktivist examples above. The figure below details the distribution of specific OT ports/protocols known to be exposed in the UK. The Modbus protocol used for industrial automation is the most popular, and also the most attacked globally. That is followed by building automation protocols, such as Niagara Fox, BAcnet, and KNX, which represent 49% of exposure combined. Finally, known ports used by serial-to-IP converters from Moxa and Lantronix represent 20% of exposed OT.

Other OT systems are also exposed via HMIs, as shown in the hacktivist examples. Those are usually accessible over ports 3389/RDP or 5900/VNC. Although these ports are not in the top 10 shown above, our recent research showed that the UK is the sixth country in the world with most exposed RDP and VNC servers.

Mitigation Guidance

Organisations operating in the UK are likely to be targeted by cybercriminals seeking money, hacktivists trying to spread a political message, and state actors serving foreign interests.

To manage the risk, organizations should proactively identify and reduce their cyber exposure, starting with internet-exposed assets but including every connected IT, IoT, OT, or medical device in their internal networks. Due to the increased scope of attacks on unmanaged devices, we recommend organizations in the UK focus on the following three strategic areas of cybersecurity:

1. Risk & Exposure Management. Begin by conducting a thorough assessment of every asset connected to your network, especially OT and IoT assets that are often vulnerable. Scrutinise its security posture, known vulnerabilities, credentials, and open ports. Replace default and easily guessable credentials with strong, unique passwords for each device. Disable unused services, patch vulnerabilities promptly, and adopt a risk-based approach for mitigation. Leverage automated controls within the entire enterprise rather than in isolated silos.
2. Network Security. Avoid exposing unmanaged devices directly to the internet. Implement network segmentation to isolate IT, IoT and OT devices, restricting network connections to specifically designated management and engineering workstations. Segmentation should extend not only between IT and OT but also within these networks to thwart lateral movement and data exfiltration. Implement restrictions on external communication paths and employ isolation or containment measures for vulnerable devices as a mitigating control, especially when immediate patching is challenging.
3. Threat Detection & Response. Utilise an IoT/OT-capable monitoring solution to detect and alert malicious indicators and behaviours. Monitor internal systems and communications for known hostile actions, such as vulnerability exploitation, password guessing and unauthorised use of OT protocols. Alert network operators to anomalous and malformed traffic. Consider solutions that collect telemetry and logs from diverse sources that correlate attack signals for analyst investigation. These solutions offer the capability to automate response actions across the enterprise.

We emphasise that traditional cyber hygiene practices must be applied comprehensively across all network assets. Prioritise the most critical attack surfaces based on up-to-date threat and business intelligence for a robust cybersecurity posture.

Additionally, mitigating the risks of exposed OT systems will in most cases require the use of a secure remote access solution to mediate each interaction between a remote user and an OT asset, such as a PLC, HMI, or engineering workstation.