Cyber Warfare Guide: What State Conflict Means for You

When states use cyber operations against each other, private organisations are hit as targets, as infrastructure in the path, or as collateral damage. NotPetya in 2017 was aimed at Ukraine and disrupted businesses across Europe; the attack on Viasat's KA-SAT network in 2022 cut off satellite broadband customers well beyond Ukraine; and Western governments have warned that state actors are pre-positioning inside critical infrastructure for use in a future crisis. This guide sets out what cyber warfare means in practice for an organisation that is not a military target: how state operations reach you, where the legal and insurance lines sit, how to detect pre-positioning, and what to do when the threat level rises. It is written for CISOs, security architects, risk and insurance owners and incident responders, and it contains no offensive guidance.

Key takeaways

Collateral damage is the most likely route. Disruptive state malware has spread far beyond its intended targets, and shared suppliers, software and satellite or telecoms services carry the effects across borders.
Pre-positioning looks like quiet administration. Groups such as Volt Typhoon rely on valid accounts, built-in tools and compromised edge devices, so the signal is identity and network behaviour, not malware.
The law is unsettled and does not protect you operationally. International norms, NATO policy and the Tallinn Manual shape state behaviour, but none of them changes what your controls must withstand.
Insurance may not respond. State-backed cyber attack exclusions are now standard in many cyber policies, so the wording and the attribution clause matter before an incident, not after.
Have a heightened-threat playbook ready. The NCSC and CISA publish concrete actions for periods of elevated threat; pre-agree who triggers them and what they cost.

How the attack works

"Cyber warfare" is used loosely. For an organisation it is more useful to separate the kinds of state activity that can reach it, because each needs different defences.

Activity	Aim	How organisations are affected	Typical ATT&CK techniques
Destructive operations	Disrupt an adversary's economy, government or military	Wipers and fake ransomware spread to suppliers, subsidiaries and partners	T1485 Data Destruction; T1561 Disk Wipe; T1495 Firmware Corruption
Attacks on shared infrastructure	Degrade communications or services in a conflict zone	Loss of satellite, telecoms, cloud or managed services used far from the conflict	T1133 External Remote Services; T1078 Valid Accounts
Pre-positioning	Hold access to critical infrastructure for use in a future crisis	Long, quiet intrusions in utilities, telecoms, transport and their suppliers	T1190 Exploit Public-Facing Application; T1584.008 Network Devices; T1078
Supply chain operations	Reach many targets through one trusted provider	Trusted updates or service providers become the delivery route	T1195 Supply Chain Compromise; T1199 Trusted Relationship
Disruption and influence	Signal, intimidate or distract	Denial of service against public services, banks and media; defacement	T1498 Network Denial of Service

Disruptive operations are often disguised as criminal activity. The UK government's February 2018 attribution of NotPetya to the Russian military described it as disguised as a criminal enterprise while its main purpose was disruption. Hacktivist personas can play the same role; see the Hacktivism Guide.

Where it shows up

NotPetya, June 2017: the UK government said its primary targets were Ukrainian financial, energy and government sectors, that its indiscriminate design caused it to spread to other European and Russian businesses, and that it was costing hundreds of millions of pounds. The NCSC assessed the Russian military was almost certainly responsible. See the Sandworm Threat Actor Profile and the Wiper Malware Guide.
Viasat KA-SAT, 24 February 2022: Viasat reported that an attacker exploited a misconfigured VPN appliance, moved into the trusted management network and used legitimate management commands to overwrite modem flash memory. Tens of thousands of modems dropped off the network across Europe, and Viasat had shipped nearly 30,000 replacement modems by the time of its report. The EU attributed the attack to Russia, noting that it took place one hour before the invasion of Ukraine and affected several EU member states.
Volt Typhoon pre-positioning: Microsoft reported in May 2023 that this China-based state-sponsored actor had targeted US critical infrastructure, including Guam, across communications, manufacturing, utilities, transportation, maritime, government, IT and education, and assessed with moderate confidence that it may be building capability to disrupt communications between the US and Asia during future crises. See the Volt Typhoon Threat Actor Profile.
Telecoms espionage: state intrusions into telecoms carriers expose the communications of every customer. See the Salt Typhoon telecom intrusions breach analysis.

Impact

Operational loss without being targeted: destructive malware does not check whether a host belongs to the intended victim. A subsidiary, an accounting package or a shared network link is enough exposure.
Dependency failure: the KA-SAT attack showed that a provider's outage removes a service you may not know you depend on. Map which critical functions rely on satellite, telecoms, cloud regions and managed service providers.
Recovery measured in hardware, not hours: Viasat had to ship replacement modems. Wipers and firmware attacks can force rebuilds and replacements, which stretches any recovery time objective based on restoring data.
Insurance and contract disputes: war and state-backed attack exclusions can leave losses uninsured, and force majeure clauses may be invoked by suppliers.
Regulatory duties continue: operators under regimes such as NIS2 still have incident reporting and resilience obligations during a conflict. See the NIS2 Directive Guide.

Legal and policy context, briefly

Instrument	What it says	What it means for an organisation
NATO cyber defence policy	Cyber defence is part of collective defence (Wales, 2014); cyberspace is a domain of operations (Warsaw, 2016); the 2021 policy states that significant malicious cumulative cyber activities might in certain circumstances be considered an armed attack, decided case by case by the North Atlantic Council	A state response may follow a major attack on your sector, but it will not restore your systems
Tallinn Manual (2013) and 2.0 (2017)	Non-binding scholarly restatements of how international law applies: 2013 to use of force and armed conflict, 2.0 to operations below those thresholds; a 3.0 revision project began in 2021	Useful for understanding how governments reason about attribution and response
UN GGE and OEWG processes	Groups of Governmental Experts since 2004 and Open-Ended Working Groups (2019 to 2021, and 2021 to 2025) have developed voluntary, non-binding norms of responsible state behaviour, including restraint against critical infrastructure	Norms are not enforceable; plan as if critical infrastructure will be targeted

Insurance: war and state-backed attack exclusions

The Lloyd's Market Association published four model clauses, LMA 5564 to LMA 5567, for cyber war and cyber operation exclusions, and Lloyd's required its managing agents to include a state-backed cyber attack exclusion in standalone cyber policies from 31 March 2023. The clauses differ in how much cover they leave for cyber operations outside war, and they include provisions on how attribution to a state is decided. Practical steps:

Read the actual wording: identify the exclusion clause used, whether it excludes all state cyber operations or only those with major detrimental impact on a state, and how "bystanding" or collateral damage is treated.
Check the attribution mechanism: whether attribution rests on a government statement, and what happens while attribution is pending.
Model the uninsured case: run a scenario where a wiper spreads from a supplier and the claim is declined, and test whether reserves and recovery plans still hold.

See the Cyber Insurance Guide. Insurance terms change by market and renewal, so confirm with your broker; the position above is as of October 2026.

Detection

Destructive attacks are loud; the opportunity to stop them is in the quiet access phase that precedes them. Microsoft described Volt Typhoon as relying almost exclusively on built-in tools and hands-on-keyboard activity, collecting credentials and reusing valid accounts, and routing traffic through compromised small office and home office routers and VPN devices.

Signal	Where to look	Why it matters
Administrative logins from edge devices or unusual source networks	VPN, firewall and identity provider logs	Pre-positioning reuses valid accounts through compromised edge equipment
Credential dumping indicators	EDR alerts for LSASS access; domain controller logs for installation media creation	Microsoft named both as hunting leads for Volt Typhoon activity
Living-off-the-land command lines	Process creation with command line logging	Built-in tools used for discovery and archiving; see the Living off the Land Guide
Exposed management interfaces	External attack surface scans	HTTP or SSH management on the internet is a common entry point
Mass changes from management systems	Device management, RMM, hypervisor and network management logs	The KA-SAT attack used legitimate management commands to cause damage
Sector warnings	National CERT, ISAC and threat intelligence feeds	Early warning of campaigns against your sector (CSF ID.RA-02)

Metrics

Edge device exposure: count of internet-exposed management interfaces, target zero.
Edge patch latency: days from a known exploited vulnerability on a VPN, firewall or router to remediation.
Privileged account hygiene: unused or unrecognised privileged accounts open longer than 30 days.
Restore proof: date of the last successful full restore of a critical service from an offline copy.
Playbook readiness: time from a heightened-threat decision to completion of the core actions, measured in exercises.

Prevention and hardening

The heightened-threat playbook

The NCSC's guidance on actions to take when the cyber threat is heightened is the most concrete public baseline. Its core actions are listed below with an owner and evidence to record; CISA's Shields Up campaign makes the same points for US organisations, adding fast incident reporting and information sharing.

Patch: internet-facing services first, then browsers, office software and firmware; record business cases that have left known vulnerabilities unpatched and revisit them.
Access: remove old, unused or unrecognised user and privileged accounts, change weak or shared passwords, confirm MFA applies as policy requires, especially for privileged accounts. Include service accounts and API keys in that review; see the Critical Infrastructure Identity Security Guide.
Defences: confirm antivirus or EDR is active everywhere and remove temporary firewall rules that outlived their purpose.
Logging: know which logs exist and where, monitor key ones, and retain at least a month.
Backups: test restores and keep a recent offline copy; the NCSC also advises backing up critical external credentials such as private keys and access tokens. See the Backup Security and Immutable Backup Guide.
Incident plan: update contacts, confirm who decides out of hours, and make sure the plan and its communication channels work if business systems are down.
Internet footprint: verify IP ranges and domains, secure domain registrar accounts and run an external vulnerability scan.
Third parties: review what access suppliers hold and remove what is no longer needed.

For larger organisations the NCSC adds accelerating planned improvements, revisiting accepted risks, temporarily reducing higher-risk functionality, more aggressive patching, delaying non-security changes and extending SOC hours.

Structural defences

Segment and contain: limit how far destructive malware can travel between subsidiaries, regions and OT networks. See the Network Segmentation Guide and the OT Security Guide.
Harden edge devices: no management interfaces exposed to the internet, phishing-resistant MFA on remote access, and replacement of end-of-life VPN and router hardware.
Protect credentials: Microsoft's Volt Typhoon mitigations include LSASS protection, Credential Guard, attack surface reduction rules and EDR in block mode.
Plan for dependency loss: identify alternative communications and suppliers for services concentrated in one provider.

Decision guidance by organisation type

Organisation	Primary exposure	Priority
Critical infrastructure operator	Pre-positioning and destructive attack	Hunt for valid-account misuse, OT segmentation, manual operation fallback, government liaison
Multinational with operations in or near a conflict zone	Collateral spread through local subsidiaries and software	Network separation of local entities, local software inventory, decision rights to disconnect
Managed service or technology provider	Used as a route into customers	Privileged access controls on management planes, customer isolation, change monitoring
Small or mid-sized business	Collateral damage and supplier outage	NCSC core actions, offline backups, insurance wording review

Lessons from incidents

Management planes are weapons: at Viasat the damage was done with legitimate management commands. The same pattern appears in the Stryker device management wiper attack, where one hijacked administrator account used device management to wipe devices. Protect management consoles as tier-zero systems.
Disguise delays response: NotPetya looked like ransomware. Treat any destructive outbreak during a period of state tension as possibly state-linked for escalation, insurance notification and evidence preservation.
Edge devices are the front line: both KA-SAT (a VPN misconfiguration) and Volt Typhoon (internet-facing appliances) started at the edge.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.OC-04; ID.RA-02; ID.IM-04; RS.CO-02; RC.RP-01	Critical services, threat intelligence, plans, notification, recovery
NIST SP 800-53 Rev. 5	CP-2, CP-9, CP-10, IR-4, PM-16, RA-3, SR-3	Contingency, backup, reconstitution, incident handling, threat awareness, risk, supply chain
MITRE ATT&CK	T1485, T1561, T1495, T1498, T1190, T1133, T1078, T1195, T1199	Destructive impact and common access routes

Practitioner checklist

Write a heightened-threat playbook from the NCSC core actions with named owners and a trigger authority.
Map critical services to external dependencies, including satellite, telecoms, cloud and managed providers.
Remove internet-exposed management interfaces and patch edge devices against known exploited vulnerabilities first.
Hunt for valid-account misuse, LSASS access and living-off-the-land activity on infrastructure hosts.
Segment subsidiaries and OT so a wiper cannot cross freely, and agree who may disconnect a region.
Keep tested offline backups, including keys and tokens needed to rebuild.
Review your cyber policy's war and state-backed attack exclusion with your broker before renewal.
Run a tabletop on collateral damage from a regional conflict; see the Tabletop Exercise Guide.

Cyber Warfare Guide: State Conflict in Cyberspace and What It Means for Organisations