ZeroFox Intelligence Assessment - UK Public Sector Threat Landscape Report

Product Serial: A-2023-05-04a

TLP:CLEAR

In this assessment, ZeroFox Intelligence provides analysis around the UK Public Sector, which almost certainly remains an attractive target for threat actors seeking a competitive or political advantage, or a financial return, given the breadth of sensitive data held, large budgets, and strategic importance to national and international operations. Although attacks impacting the sector almost certainly remained underreported, threat actors successfully targeted both public sector targets and their third-party providers, highlighting the fragility of public sector entities’ cybersecurity practices and the potential impact that successful targeting can have.

Standing Intelligence Requirements

Deep Dark Web and Criminal Underground DDW

For the most up-to-date list of ZeroFox’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 5:00 PM (EDT) on March 30, 2023; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Key Findings

The ransomware and digital extortion threat to the United Kingdom (UK) Public Sector is likely on an upward trajectory, underpinned by increased attacks against the UK education sector. Threat actors are likely disproportionately targeting the education sector, which finished 2022 as the most frequently targeted industry in the UK.
Advertisements in open forums for illicit access into UK Public Sector entities remained low. Brokers moved towards private communication methods with sellers.
The UK Public Sector likely faced an increased threat of spear phishing, smishing, callback phishing (vishing), and phishing techniques that bypass multi-factor authentication (MFA).
Exposure of private information on the surface and dark web very likely increased the risk to UK Public Sector VIPs of being victims of malicious exploitation.
The growth in impersonating phishing domains very likely drove an increased threat to UK Public Sector entities in 2022 and Q1 2023. ZeroFox Intelligence observed a 40 percent increase in malicious or fraudulent domains in 2022.