www.ncsc.gov.uk Open in urlscan Pro
3.160.150.126  Public Scan

Form analysis
0 forms found in the DOM

Text Content

You need to enable JavaScript to run this app.


COOKIES ON THIS SITE

We use some essential cookies to make this website work.

We’d like to set additional cookies to understand how you use our website so we
can improve our services.

Accept optional cookies

Reject optional cookies

Manage Cookies (opens in a new tab)


WRITTEN FOR

This section shows the list of targeted audiences that the article is written
for

Close


Skip to main content
 * ABOUT NCSC
 * CISP
 * REPORT AN INCIDENT
 * CONTACT US

Search
Menu
HomeInformation for...Advice & guidanceEducation & skillsProducts &
servicesNews, blogs, events...
news
Download / Print article PDF

SHARE

Copied to clipboard

SHARE

FACEBOOK

LINKEDIN

TWITTER

COPY LINK

Copied to clipboard

SHARE

FACEBOOK

LINKEDIN

TWITTER

COPY LINK




UK CALLS OUT CHINA STATE-AFFILIATED ACTORS FOR MALICIOUS CYBER TARGETING OF UK
DEMOCRATIC INSTITUTIONS AND PARLIAMENTARIANS

APT31, a China state-affiliated actor, was almost certainly responsible for
targeting UK parliamentarians’ emails in 2021.
Invalid DateTime
 * GCHQ’s National Cyber Security Centre assesses China state-affiliated actor
   APT31 was almost certainly responsible for targeting UK parliamentarians’
   emails in 2021.
 * The compromise of the UK Electoral Commission’s systems has also been
   attributed to a China state-affiliated actor in a separate instance of
   malicious activity.
 * Organisations and individuals involved in democratic processes urged to
   follow NCSC advice to bolster their security in face of cyber threats.

The UK government has called out China state-affiliated actors today (Monday)
for carrying out malicious cyber activity targeting UK institutions and
individuals important to our democracy.

The National Cyber Security Centre – a part of GCHQ – assesses that the China
state-affiliated cyber actor APT31 was almost certainly responsible for
conducting online reconnaissance activity in 2021 against the email accounts of
UK parliamentarians, most of whom have been prominent in calling out the malign
activity of China.

Separately, the compromise of computer systems at the UK Electoral Commission
between 2021 and 2022 has also been attributed to a China state-affiliated
actor. The NCSC assesses it is highly likely the threat actors accessed and
exfiltrated email data, and data from the Electoral Register during this time.

The data, in combination with other data sources, would highly likely be used by
the Chinese intelligence services for a range of purposes, including large-scale
espionage and transnational repression of perceived dissidents and critics in
the UK.

To help bolster the UK’s cyber resilience, the NCSC has today published updated
guidance in its Defending Democracy collection for political organisations –
such as parties and thinktanks – and organisations coordinating the delivery of
elections, with advice on how to reduce the likelihood of cyber attacks.

Paul Chichester, NCSC Director of Operations, said: 

“The malicious activities we have exposed today are indicative of a wider
pattern of unacceptable behaviour we are seeing from China state-affiliated
actors against the UK and around the world.

“The targeting of our democratic system is unacceptable and the NCSC will
continue to call out cyber actors who pose a threat to the institutions and
values that underpin our society.

“It is vital that organisations and individuals involved in our democratic
processes defend themselves in cyberspace and I urge them to follow and
implement the NCSC’s advice to stay safe online.”

The cyber campaign against the parliamentary email accounts of members across
both Houses of Parliament was identified and successfully mitigated by
Parliament’s Security Department before any accounts could be compromised.

The compromise of systems at the UK Electoral Commission was made public last
year after steps had been taken to remediate and recover, with support from the
NCSC.

The publication of new Defending Democracy guidance follows the release of fresh
advice for high-risk individuals published in December.

The newly issued guidance for political organisations offers advice to help IT
practitioners implement security measures that will help prevent common cyber
attacks. These include: putting controls in place to defend against
spear-phishing and DDoS attacks and setting up multi-factor authentication on
cloud- and internet-connected services.

Meanwhile the guidance for organisations involved in coordinating elections,
such as local authorities, advises on steps to take to protect electoral
management systems.

The NCSC has previously warned about the threat from China state-linked cyber
capabilities, including from APT31 which was previously linked to the Chinese
Ministry of State Security in 2021 following compromise of Microsoft Exchange
Server.

More recently, the NCSC has warned about China state-sponsored actors using
living off the land techniques to evade detection on compromised critical
infrastructure networks.

The UK government attribution statement can be read on GOV.UK. 



FURTHER GUIDANCE ON DEFENDING DEMOCRACY

The NCSC's Defending Democracy collection brings together expanded guidance to
raise awareness of the cyber threats to democratic processes, institutions, and
the people involved in them. The aim is to prevent or reduce related attacks
against both organisations and individuals.

View NCSC's guidance on Defending Democracy


TOPICS

Cyber threat

Back to top
Download / Print article PDF

SHARE

Copied to clipboard

SHARE

FACEBOOK

LINKEDIN

TWITTER

COPY LINK

Copied to clipboard

SHARE

FACEBOOK

LINKEDIN

TWITTER

COPY LINK



 * PUBLISHED
   
    * 25 March 2024

 * WRITTEN FOR
   
    * Large organisations
    * Public sector
    * Cyber security professionals

 * NEWS TYPE
   
    * General news

 * PUBLISHED
   
    * 25 March 2024

 * WRITTEN FOR
   
    * Large organisations
    * Public sector
    * Cyber security professionals

 * NEWS TYPE
   
    * General news


Back to top


ALSO SEE

NEWS
 * 26 February 2024

SVR CYBER ACTORS ADAPT TACTICS FOR INITIAL CLOUD ACCESS

How SVR-attributed actors are adapting to the move of government and
corporations to cloud infrastructure.
NEWS
 * 26 February 2024

UK AND ALLIES EXPOSE EVOLVING TACTICS OF RUSSIAN CYBER ACTORS

New advisory reveals evolving tactics used by Russian state-linked cyber actors
as more organisations move to cloud-based infrastructure.
BLOG POST
 * 15 February 2024

FROM THE CYBER PROLIFERATION THREAT ALL THE WAY TO PALL MALL

The first dedicated conference on this topic – and an insight into the NCSC
assessment work behind it.


FOLLOW US

 * 
 * 
 * 
 * 
 * 




ABOUT NCSC

 * What we do
 * What is cyber security?
 * Equality, diversity and inclusion
 * Incident management
 * Leadership team
 * Careers


INFORMATION FOR...

 * Individuals & families
 * Self employed & sole traders
 * Small & medium sized organisations
 * Large organisations
 * Public sector
 * Cyber security professionals


ADVICE & GUIDANCE

 * All topics
 * All articles
 * Cyber Aware


EDUCATION & SKILLS

 * Schools
 * Higher education
 * Professional skills & training
 * Working with the NCSC
 * CyBOK
 * Research & Academia
 * CyberFirst


PRODUCTS & SERVICES

 * Overview
 * Browse products & services
 * Verify a supplier
 * NCSC certification
 * Evaluation partners
 * Cyber Essentials
 * Active Cyber Defence (ACD)


KEEP UP TO DATE

 * CYBERUK
 * NCSC blog
 * NCSC news
 * Reports & advisories
 * Speeches
 * Subscribe


ABOUT THIS WEBSITE

 * Privacy notice
 * Cookies
 * Accessibility
 * Terms & conditions
 * Social media policy


USEFUL LINKS

 * GCHQ
 * MI5
 * SIS
 * NPSA
 * GOV.UK


CONTACT THE NCSC

 * General enquiries
 * Media Centre
 * Report an incident
 * Report a vulnerability
 * Report phishing scam
 * Verify an NCSC contact




SEARCH

Search


POPULAR SEARCHES

Cyber Aware

Cyber Essentials

CYBERUK

Passwords

Phishing

Ransomware