NCSC: Strategic Prepositioning and Kinetic Readiness in UK Critical National Infrastructure CNI
The National Cyber Security Centre (NCSC) has identified a strategic shift by state-sponsored actors targeting UK Critical National Infrastructure (CNI), transitioning from opportunistic espionage to "prepositioning" for future kinetic sabotage. Adversaries are utilizing Living-off-the-Land (LotL) techniques and targeting OT/ICS environments to maintain stealthy, long-term persistence. The attack surface has expanded to include the Defense Industrial Base (DIB) via compromised third-party Managed Service Providers (MSPs) and software update mechanisms. With 75% of CNI attacks attributed to nation-states, these operations aim to establish dormant access for physical disruption during geopolitical conflict, with AI-driven automated exploitation expected to scale these capabilities by 2028.