Major conflicts create two kinds of pressure. First, state-linked or retaliatory activity can increase DDoS, phishing, ransomware, and destructive malware attempts. Second, threat actors exploit fear and uncertainty to improve social engineering success. Even organisations with no direct connection to the conflict can face higher exposure because attackers use current events to widen their target set and mask malicious campaigns.
Why conflicts raise exposure far beyond the battlefield
Geopolitical shocks change the threat environment even for organisations with no operational footprint in the conflict zone. Adversaries gain a timely pretext for campaigns, defenders are distracted by fast-moving news, and the volume of hostile traffic often rises across opportunistic and targeted activity at the same time. The result is not just more noise, but a wider set of attack paths that can slip through ordinary monitoring thresholds.
One useful way to think about this is that current events alter both attacker economics and defender attention. Fear, urgency and uncertainty make users more likely to trust messages that would otherwise look suspicious, while threat actors can blend malicious content into legitimate-looking references to the event. That is why conflict periods often produce a mix of phishing, credential theft, ransomware and destructive attempts rather than one single campaign type.
The practical problem is that organisations usually do not need a political connection to become relevant. A broad base of victims is enough for criminals, and state-linked or proxy activity can also spill into neighbouring sectors, suppliers, and service providers. Public advisories from CISA cyber threat advisories are useful here because they regularly show how major world events correlate with elevated ransomware, nation-state, and infrastructure-focused activity. For defenders, the key point is to expect overlap between ideological messaging, opportunistic crime and targeted intrusion.
What changes in attacker behaviour during major geopolitical events
During a conflict, threat actors tend to exploit the same broad conditions in different ways. Some campaigns are highly visible, such as DDoS or destructive malware intended to create disruption or symbolic impact. Others are quieter, relying on social engineering, impersonation or malicious attachments that borrow the conflict as a theme. Both approaches benefit from the same environmental pressure: people are reading news rapidly, response teams are watching for direct impact, and normal trust signals become easier to spoof.
There is also a scale effect. Actors who would normally struggle to stand out can hide inside a larger stream of event-related communications. That makes detection harder because defenders must distinguish real external updates, media references, humanitarian coordination, and legitimate supplier notifications from malicious lookalikes. In practice, the security issue is not only the content of the campaign, but the fact that the campaign rides on an already credible narrative.
- Event-themed phishing often succeeds because urgency reduces verification.
- Ransomware actors may use current events to increase emotional pressure on victims.
- Destructive or disruptive activity can be masked as retaliation, activism, or opportunistic cover traffic.
For deeper incident patterns, the The 52 NHI breaches Report and 52 NHI Breaches Analysis are useful reference points for understanding how stolen access material and third-party trust can amplify a campaign once initial access is obtained. Even when the original lure is geopolitical, the downstream compromise pattern often looks ordinary: stolen access, abuse of trust, and lateral movement.
How organisations should think about preparedness during conflict-driven threat spikes
The right response is not to treat every headline as a crisis, but to assume that adversaries will actively use current events as a delivery mechanism. That means tightening verification around any message that references the conflict, increasing scrutiny on urgent requests, and watching for changes in phishing volume, login failures, and unusual authentication prompts. It also means ensuring incident response teams can separate real-world business continuity issues from adversary-generated confusion.
For the most exposed organisations, the most important control question is whether staff can verify urgency without relying on the message itself. If a request asks for credential changes, payment changes, or access exceptions because of a geopolitical event, the safest assumption is that the event is being used as camouflage until independently confirmed. Security teams should also review supplier and partner communications, since third-party compromise and impersonation often become more attractive when everyone is focused on the conflict narrative.
Practitioner takeaway: Treat geopolitical events as a change in attacker framing, not just in attacker volume; the organisations that stay safest are the ones that preserve verification discipline when urgency is highest.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AC-4 — Access Permissions and Authorizations | Conflict-driven phishing seeks unauthorized access to accounts and systems. |
| DE.CM-1 — Monitoring and Detection Processes | Geopolitical events often spike hostile traffic and social engineering attempts. | |
| Recommendation — Harden authorization checks and enforce least privilege for externally initiated access changes. Increase monitoring for event-themed phishing, DDoS, and abnormal authentication activity. | ||
| CIS Controls v8 | 6 — Access Control Management | Reduced trust and urgent requests make account abuse more likely during conflict spikes. |
| Recommendation — Tighten account access review and restrict high-risk request paths during threat surges. | ||
| MITRE ATT&CK | T1566 — Phishing | Event-based lures are a common way to exploit fear and urgency in conflict periods. |
| T1499 — Endpoint Denial of Service | Major events can coincide with disruptive DDoS activity aimed at availability impact. | |
| Recommendation — Hunt for themed lures and train users to verify urgent messages out of band. Prepare availability defenses and alerting for denial-of-service spikes tied to current events. | ||
Related resources from NHI Mgmt Group
- Why does the Cyber Resilience Act increase risk when organisations rely on AI-generated code?
- Why do large language models increase the risk of false narratives spreading during elections and major global events?
- Why does poor coordination between states and organisations increase cyber risk?
- Why does leaving Linux outside the passwordless baseline increase identity risk?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
