Public bodies face three kinds of attacker with completely different goals: foreign intelligence services that want to read officials' email for years, hacktivists who want a website down for an afternoon, and criminals who want a council to pay to get its systems back. Treating them as one undifferentiated "nation state threat" leads to spending in the wrong places. This guide maps the actor types that MITRE ATT&CK and government attributions document against ministries, parliaments, election bodies, councils and arm's length bodies, what each wants, how each gets in, and which controls break its path. It is written for security leads, threat intelligence analysts and risk owners in central, devolved and local government. Group profiles and programme guides are linked rather than repeated.
Key takeaways
- Espionage dominates the high end: Russian, Chinese, Iranian and North Korean services all have a long public record against governments, diplomats and parliamentarians, and they favour credential theft and quiet cloud access over destructive malware.
- Identity is the common door: a joint advisory led by the UK NCSC describes SVR actors password spraying service accounts, reusing dormant accounts, stealing tokens and pushing MFA prompts until a user approves.
- Democratic institutions are targets in their own right: the UK government attributed the 2021 to 2022 Electoral Commission compromise to a Chinese state-affiliated actor and spear-phishing of parliamentarians from 2015 to 2023 to Star Blizzard.
- Hacktivists are noisy but usually shallow: Hacktivist DDoS campaigns against public bodies are common; Europol's Operation Eastwood in July 2025 disrupted NoName057(16) infrastructure.
- Ransomware hurts services most: the ICO found the 2020 Hackney Council attack began with a dormant account with an insecure password, and some services did not return to normal until 2022.
Why attackers pick government
- Policy and negotiating positions: foreign ministries, trade and defence departments hold exactly what intelligence services are tasked to collect.
- Influence over democratic processes: election bodies, parliaments and political parties offer material for leaks and for undermining trust. The UK government says Star Blizzard leaked and amplified information for that purpose.
- Bulk personal data: electoral registers, tax, benefits and personnel records support both espionage targeting and fraud.
- Visibility for protest: government websites are symbolic, so taking one offline makes a hacktivist point quickly.
- Services that cannot stop: councils run social care, housing and benefits, which creates pressure that ransomware crews exploit.
- Federated, uneven estates: departments, agencies, councils and suppliers share networks, single sign-on and portals, so the weakest body can be a route to the strongest. The Taiwan AI agent attack of 2026 illustrates this: an unattributed operator sprayed predictable passwords against a government office automation portal and reached internal systems through an SSO bridge without further authentication.
The actor map
Group IDs and aliases are from MITRE ATT&CK v20. Attribution is as stated by MITRE or the named government source.
| Actor (ATT&CK ID) | Attribution | Government activity on record | Primary aim |
|---|---|---|---|
| APT29 (G0016), also Midnight Blizzard | Russia, SVR (UK and US governments) | Government networks in Europe and NATO states; NCSC-led advisory notes expansion to local and state councils, government financial departments and law enforcement | Espionage |
| APT28 (G0007), also Forest Blizzard | Russia, GRU unit 26165 (MITRE citing NSA and FBI) | Compromise of US political party and campaign networks in 2016; operations against international organisations such as WADA and the OPCW (2018 US indictment, per MITRE) | Espionage and influence |
| Turla (G0010) | Russia, FSB (MITRE) | Government, embassies and military victims in over 50 countries since at least 2004 | Espionage |
| Star Blizzard (G1033) | Russia, almost certainly subordinate to FSB Centre 18 (UK NCSC) | Spear-phishing of UK parliamentarians, civil servants and think tanks; leaks of documents | Espionage and influence |
| APT31 (G0128, also ZIRCONIUM, Violet Typhoon) | China, linked to the Ministry of State Security (UK government) | Reconnaissance against UK parliamentarians in 2021; election-related targeting recorded by MITRE | Espionage |
| Mustang Panda (G0129) and APT40 (G0065, ATT&CK name Leviathan) | China (MITRE; APT40 attributed to MSS Hainan State Security Department) | Government and diplomatic targets with tailored phishing lures (Mustang Panda); multiple sectors including government (APT40) | Espionage |
| Magic Hound (G0059), also Charming Kitten | Iran, likely on behalf of the IRGC (MITRE) | Social engineering of government and military personnel in Europe, the US and the Middle East | Espionage |
| Kimsuky (G0094) | North Korea (MITRE) | South Korean government agencies, later the United Nations and other governments | Espionage |
| Pro-Russian hacktivists, for example NoName057(16) | Ideological, Russia-aligned | DDoS against public bodies in Ukraine and supporting states; infrastructure disrupted by Operation Eastwood | Disruption and messaging |
| Ransomware and extortion crews | Criminal | Councils and public services, often entering through old accounts and unpatched systems | Extortion |
See the APT29 (Midnight Blizzard) Threat Actor Profile, APT28 (Fancy Bear) Threat Actor Profile, Turla Threat Actor Profile, Star Blizzard Threat Actor Profile, APT31 Threat Actor Profile Guide and NoName057 DDoS Hacktivist Group Profile Guide for group detail.
How each actor type gets in
| Actor type | Typical entry (ATT&CK) | What it does next | First control to check |
|---|---|---|---|
| Intelligence services, cloud-focused | Password spraying service accounts (T1110.003); dormant cloud accounts (T1078.004); stolen tokens (T1528); MFA prompt bombing (T1621) | Registers its own device, reads mailboxes (T1114.002) and document stores (T1213) | Phishing-resistant MFA, dormant account removal, short session lifetimes, device enrolment restrictions |
| Intelligence services, phishing-focused | Spearphishing links to credential harvesting pages (T1566.002), often to personal accounts of officials | Collects email, leaks selected documents | Security keys for officials and staff, advice and support for personal accounts |
| Intelligence services, edge-focused | Exploiting public-facing appliances (T1190); trusted supplier links (T1199) | Long-term persistence with valid accounts | Edge device patching against the KEV catalogue, supplier access controls |
| Hacktivists | Volumetric and application-layer DDoS (T1498, T1499); defacement of weak web servers (T1491.002) | Publicises outages on social channels | DDoS protection on public sites, content delivery and upstream mitigation agreed in advance |
| Ransomware crews | Valid accounts (T1078), remote services (T1133), unpatched systems | Steals data, encrypts systems (T1486), deletes backups | MFA on remote access, account hygiene, offline and immutable backups |
Exposed secrets are a frequent shortcut for every actor type. In the Indian government breach of 2021, researchers found 35 credential pairs in publicly served .git and .env files on government web servers.
Democratic institutions and officials
Parliaments, election bodies, political parties and individual officials need a slightly different model, because the attacker often targets the person rather than the network.
- Personal accounts are in scope: the UK government said Star Blizzard spear-phished parliamentarians from multiple parties and compromised the account of a think tank founder, leading to leaks.
- Reconnaissance precedes compromise: the UK government assessed that APT31 carried out reconnaissance against parliamentarians in 2021, most of whom had criticised China, though no parliamentary accounts were compromised.
- Election infrastructure holds data, not just results: the UK Electoral Commission compromise ran from late 2021 to October 2022 according to the UK government's attribution statement of March 2024.
- Controls that work: security keys for elected members and senior staff, a route for officials to report suspicious approaches, monitoring of mailbox rules and forwarding, and briefings ahead of elections and summits.
Where identity fits
The SVR techniques described in the NCSC-led advisory are almost entirely identity techniques, which makes identity the highest-return control area for government.
- Service accounts: the advisory notes they often lack MFA and can be highly privileged. Inventory them, remove unused ones and place canary service accounts, since any use is a high-confidence signal. See the Public Sector Identity Security Guide.
- Dormant and leaver accounts: actors regained access after password resets by logging into inactive accounts. Disable on departure and review dormant accounts monthly (our recommended cadence).
- Tokens and sessions: keep session lifetimes as short as practical and revoke tokens during incident response, not just passwords.
- Device enrolment: restrict enrolment to authorised devices and block re-enrolment of retired devices.
- MFA strength: move administrators and officials to phishing-resistant methods. See the Phishing-Resistant MFA Guide.
Implementing the defences: a phased plan
- Month 1, build the threat picture: list which actor types in the table above have a documented interest in your body's functions, and record it in the risk register with an owner. Agree intelligence feeds with the national cyber agency.
- Months 1 to 2, fix the identity basics: remove dormant accounts, inventory service accounts, turn on phishing-resistant MFA for administrators and senior officials, and shorten session lifetimes. Pilot with one directorate and keep break-glass accounts tested.
- Months 2 to 3, close the edge: patch or isolate internet-facing appliances listed in the KEV catalogue and remove unused remote access routes. See the Edge Device Security Guide.
- Months 2 to 4, prepare for DDoS: put public websites behind DDoS mitigation, agree escalation with your provider and practise the switch. See the DDoS Protection Guide.
- Months 3 to 6, assure recovery: test restores of the services that cannot stop, with offline copies the attacker cannot delete.
- Ongoing: run hunts against each new joint advisory, brief officials before high-profile events and extend the same baseline to arm's length bodies and suppliers that share your network or single sign-on.
Decision guidance
- National department or parliament: plan for persistent espionage. Fund cloud audit logging, identity threat detection and hunting, and protection of officials' personal accounts.
- Council or small agency: ransomware and hacktivist DDoS are the likeliest harms. Account hygiene, patching, backups and a DDoS arrangement come before advanced threat hunting. See the Cybersecurity for Local Government Guide.
- Election body: treat the period before each election as heightened risk, with extra monitoring, pre-agreed communications for website outages and a tested process for reporting to the national agency.
- Shared service provider: you carry the risk of every customer body. Separate administration per tenant and give customers their own logs.
Detection and measurement
- Password spray and MFA bombing alerts: number per week, and median time to triage.
- Dormant accounts: enabled accounts with no sign-in for 45 days or more (our suggested threshold), trending to zero.
- Service account coverage: percentage of service accounts with a named owner and either MFA, workload identity or network restriction.
- Phishing-resistant MFA: share of administrators and senior officials enrolled.
- Edge exposure: internet-facing appliances with an unpatched KEV-listed vulnerability.
- Recovery readiness: share of critical services with a successful restore test in the last six months.
Framework mapping
| Area | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Threat intelligence and actor profiling | ID.RA-02, ID.RA-03 | PM-16 Threat Awareness Program, RA-3 |
| Account and service account hygiene | PR.AA-05 | AC-2 Account Management, AC-6, IA-2 |
| Monitoring for identity attacks | DE.CM-01, DE.AE-02 | SI-4 System Monitoring, AU-6 |
| DDoS resilience | PR.PS-01 | SC-5 Denial-of-service Protection, SC-7 |
| Ransomware recovery and reporting | RS.CO-02 | CP-9 System Backup, IR-4, IR-6 |
Common failure patterns
- One threat label for everything: calling every incident "state-sponsored" hides the fact that most council harm comes from criminals using old accounts.
- Dormant accounts left enabled: the ICO's Hackney findings and the SVR advisory both show attackers using accounts that should not have existed.
- Resetting passwords without revoking sessions: actors with stolen tokens or registered devices stay in after a reset.
- Officials' personal accounts out of scope: spear-phishing of parliamentarians and staff often lands on personal mail that the organisation never protected.
- Unchecked single sign-on trust between bodies: one weak portal gives access to many connected systems.
- Treating DDoS as a crisis rather than a routine: without pre-agreed mitigation, a short outage becomes a headline.
Practitioner checklist
- Record which actor types target your functions, with an owner in the risk register.
- Remove dormant accounts and inventory every service account with a named owner.
- Require phishing-resistant MFA for administrators, elected members and senior officials.
- Shorten session lifetimes and revoke tokens, not just passwords, during incident response.
- Restrict device enrolment and block re-enrolment of retired devices.
- Patch or isolate internet-facing appliances listed in the CISA KEV catalogue.
- Agree DDoS mitigation for public websites and test it before high-profile events.
- Test restores of services that cannot stop, using offline or immutable copies.
- Hunt against each new joint advisory that names government as a target.
Standards and references
- UK NCSC, CISA and partners: SVR Cyber Actors Adapt Tactics for Initial Cloud Access (AA24-057A)
- UK Government: UK holds China state-affiliated organisations and individuals responsible for malicious cyber activity
- UK Government: UK exposes attempted Russian cyber interference in politics and democratic processes
- Europol: Global operation targets NoName057(16) pro-Russian cybercrime network
- ENISA: Threat Landscape 2025
- ICO: ICO reprimands London Borough of Hackney following cyber attack
- MITRE ATT&CK: APT29 (G0016)
- MITRE ATT&CK: Turla (G0010)
Related NHI Mgmt Group resources: Central Government Cybersecurity Programme Guide · Public Sector Identity Security Guide · Hacktivism Guide · AI Security in Government and Public Sector