UK Faces a Cyber ‘Perfect Storm’ as Geopolitical Tensions and AI Reshape Threats

The United Kingdom is navigating what experts call a cyber perfect storm, driven by a convergence of geopolitical strife and rapid technological change. At the CYBERUK 2026 conference in Glasgow, Richard Horne, CEO of the National Cyber Security Centre (NCSC), described the current era as one of “tumultuous uncertainty.” He warned that the combination of artificial intelligence advances and international tensions is creating an unprecedented threat landscape for businesses and individuals alike.

According to the NCSC, the number of nationally significant cyber incidents has remained relatively steady, but the nature of these attacks is evolving. While ransomware remains the most common threat to most organizations, the most dangerous attacks come from nation-state actors. This cyber perfect storm demands a new approach to security—one that prioritizes resilience over simple prevention.

Nation-State Threats: Russia, China, and Iran

Richard Horne outlined how three major adversaries—Russia, China, and Iran—are targeting the UK with distinct tactics and objectives. Each poses a unique challenge, making it difficult to compare them directly.

China’s Sophisticated Espionage

China’s intelligence and military agencies now display an “eye-watering level of sophistication” in their cyber operations, Horne noted. In August 2025, the NCSC and twelve allied agencies publicly linked three Chinese companies to a global campaign targeting critical networks. This activity overlaps with what the industry tracks as Salt Typhoon.

Unlike Russian threat actors, Chinese operations are quieter and more persistent. They have shifted focus from traditional targets to edge infrastructure like routers and VPNs, according to Jamie Collier, lead threat intelligence advisor at Google Threat Intelligence Group (GTIG). This stealthy approach makes detection harder for UK organizations.

Iran’s Growing Boldness

Iran is “almost certainly” using cyber activities to suppress British individuals perceived as threats to the regime, Horne stated. The NCSC has previously warned about targeted attacks via social media messaging apps. In March, the Handala wiper campaign compromised Microsoft Intune environments and wiped devices at a key NHS supplier, showing a dangerous new direction.

Martin Riley, CTO at Bridewell, called Iran “the shifting piece.” He added that UK organizations should expect more direct Iranian or Iran-aligned targeting in the months ahead, not less.

Russia’s War-Forged Tactics

Russia continues to learn cyber lessons from its war in Ukraine. Horne explained that tactics honed in conflict are now being directed at states Russia considers hostile. The NCSC and the National Protective Security Authority observe sustained Russian hybrid activity targeting UK and European assets.

Collier noted that Russia remains the most visible and disruptive threat, mixing sophisticated espionage with a surge in pro-Russia hacktivist activity. However, Bridewell’s data suggests the current Russian effort remains concentrated on Ukraine and espionage against government targets. Direct attacks on UK operational technology are not yet common, but the risk is growing.

UK Preparedness Under the Spotlight

The readiness of UK organizations against sustained nation-state attacks is uncertain. Anthony Young, CEO of Bridewell, cautioned that most businesses are “not well prepared.” Many still struggle with basic security controls and lack full visibility across their estates. At a time when budgets are squeezed, CISOs are forced to do more with less.

Horne urged a “cultural shift” within organizations, calling on everyone—from board members to IT help desk staff—to join the cybersecurity mission. Young agreed, stating that executives need to stop paying lip service to cybersecurity and invest for the long term.

Rob Demain, CEO of e2e-assure, warned that if organizations don’t evolve their detection and response capabilities over the next 12 months, they will become “significantly under prepared.” Collier emphasized moving from a prevention-only mindset to a resilience mindset. Organizations must assume adversaries can gain initial access and focus on making their environments difficult to navigate.

For more insights on building a resilient security posture, read our guide on cyber resilience strategies for UK businesses.

AI: A Cause for Concern

Artificial intelligence is amplifying the cyber perfect storm. Following the release of Anthropic’s Claude Mythos model—which can identify and fix software vulnerabilities at speed—the UK government sent an open letter to business leaders urging them to prepare for rapid AI integration in cybersecurity.

Horne stated at CYBERUK, “Frontier AI is rapidly enabling discovery and exploitation of existing vulnerabilities at scale, illustrating how quickly it will expose where fundamentals of cyber security are still to be addressed.” Demain highlighted that zero-day attacks are becoming more common across all business sizes due to AI advancements.

Despite these threats, experts agree that basics still matter. Full visibility across all environments, 24/7 monitoring, and correct technological configuration remain some of the easiest ways to stay a hard target. Learn more about AI-driven cybersecurity threats and how to counter them.

In conclusion, the UK faces a cyber perfect storm that requires immediate action. Geopolitical tensions, nation-state attacks, and AI-driven vulnerabilities are converging. Organizations must invest in resilience, improve basic hygiene, and prepare for a future where threats are more sophisticated than ever.

ProxySmart Software: The Belarusian Platform Powering 90+ SIM Farms for Cybercrime

Cybersecurity researchers have uncovered a sophisticated software platform called ProxySmart, which is enabling SIM farm operators to conduct cybercrime on an industrial scale. This Belarus-based tool has been linked to at least 87 control panels across 17 countries, according to a new report from Infrawatch.

But what exactly is ProxySmart, and how does it facilitate such widespread criminal activity? Let’s break down the findings.

What Is ProxySmart SIM Farm Software?

ProxySmart is a turnkey software platform designed to manage and monetize physical SIM farms—collections of smartphones or modems used to generate large volumes of mobile IP addresses. The platform offers an end-to-end solution, including device management, automated IP rotation, customer provisioning, and anti-bot countermeasures.

According to Infrawatch, ProxySmart is publicly associated with a Belarus-based vendor and markets itself as a commercial product rather than a niche tool for technical experts. This means that even operators with limited technical skills can set up and run a SIM farm, dramatically lowering the barrier to entry for cybercrime.

How ProxySmart Powers Cybercrime at Scale

SIM farms are a critical enabler for various types of cybercrime, including smishing (SMS phishing), premium-rate number fraud, bot sign-ups, and one-time password interception. They can also be used by nation states; for example, Russian authorities have employed SIM farms to spread disinformation in Ukraine.

ProxySmart effectively offers “SIM Farm as a Service” (SFaaS), providing a complete ecosystem for operators. The platform supports physical smartphones and USB 4G/5G modems. Smartphones are enrolled via an unsigned Android APK, while modems are managed using the open-source ModemManager tool.

Interestingly, IP rotation for phones works by automatically toggling airplane mode on and off for three seconds, forcing a reconnection to the cellular network and assigning a new egress IP. This rapid rotation makes it extremely difficult for authorities to track or block malicious traffic.

Key Features of the ProxySmart Platform

The platform supports several tunneling and proxy protocols, including OpenVPN, SOCKS5, VLESS, and HTTP proxies. It also includes an OS spoofing feature that allows operators to simulate TCP fingerprints of macOS, iOS, Windows, or Android—further complicating detection efforts.

Infrawatch noted that the backend service is written in Python and heavily obfuscated using PyArmor, making it harder for researchers to analyze. The control panel is typically self-hosted by the farm operator, with a reverse proxy deployed in front to disguise its location.

Global Reach: 90+ SIM Farms Across 17 Countries

Infrawatch identified 87 instances of ProxySmart control panels in 17 countries, along with 94 phone farm locations. These farms are distributed across 19 U.S. states, as well as multiple countries in Europe and South America.

The report concluded that “this ecosystem materially lowers the barrier to operating and reselling mobile proxy infrastructure, with limited evidence of meaningful eligibility checks across many downstream providers.” This means that the combination of carrier-grade NAT, rapid IP rotation, and multi-carrier availability reduces the effectiveness of IP-centric controls and complicates attribution at scale.

For more on SIM farms and their impact, check out this analysis of SIM farm cybercrime risks. Additionally, learn about how mobile proxy threats are evolving.

What This Means for Cybersecurity

The discovery of ProxySmart highlights a growing trend: the commoditization of cybercrime infrastructure. By offering a user-friendly, productized platform, ProxySmart enables a wider range of actors to engage in sophisticated attacks without needing deep technical expertise.

As a result, organizations must adapt their defenses. Traditional IP-based blocking is no longer sufficient when attackers can rotate IPs rapidly and spoof device fingerprints. Instead, security teams should focus on behavioral analysis, multi-factor authentication, and threat intelligence sharing.

Furthermore, law enforcement agencies need to collaborate internationally to dismantle these networks. Given that ProxySmart is linked to Belarus, international cooperation will be crucial for any takedown efforts.

In conclusion, ProxySmart represents a significant evolution in SIM farm operations, making cybercrime more accessible and harder to stop. Staying informed about such threats is the first step toward building stronger defenses. For more insights, see our guide to emerging cybercrime trends in 2025.

When Cybercriminals Get Hacked: Inside the PCPJack Campaign That Targets TeamPCP

In the world of cybersecurity, the hunter sometimes becomes the hunted. A recent campaign, dubbed PCPJack, reveals a fascinating twist: hackers hack victims hacked by other hackers. Instead of targeting ordinary users or corporations, an unknown group is breaking into systems already compromised by the prolific cybercrime group SentinelOne calls TeamPCP. This approach is not just unusual—it signals a new layer of complexity in digital threats.

According to a detailed report from SentinelOne, the attackers behind PCPJack actively scan the internet for services that TeamPCP has infiltrated. Once inside, they waste no time. They kick out the original intruders, remove their tools, and deploy a self-spreading worm that replicates across cloud infrastructure. The stolen credentials—ranging from database logs to cloud platform keys—are then funneled back to the hackers’ own servers.

What Is the PCPJack Campaign?

The PCPJack campaign, identified by SentinelOne senior researcher Alex Delamotte, is a targeted operation that exploits the aftermath of earlier breaches. Delamotte told TechCrunch that the group’s motives appear purely financial. They steal credentials to resell them, act as initial access brokers—selling entry to compromised systems—or extort victims directly. Interestingly, they avoid cryptocurrency mining, likely because it requires sustained access and offers slower returns.

This campaign focuses heavily on TeamPCP, a group that has made headlines recently for breaching the European Commission’s cloud infrastructure and attacking the widely used vulnerability scanner tool Trivvy. Those attacks affected companies like LiteLLM and AI recruiting startup Mercor. Now, the tables have turned.

How Do Hackers Hack Victims Hacked by Other Hackers?

The process is methodical. The PCPJack operators scan the internet for exposed services, such as the Docker platform or MongoDB databases, that TeamPCP has already compromised. Once they gain access, they immediately evict the original hackers. SentinelOne’s report notes that the attackers keep a tally of successful evictions, sending this data back to their command infrastructure.

Delamotte outlined three theories about the perpetrators. They could be disgruntled ex-members of TeamPCP, a rival cybercrime group, or a third party who modeled their tools on TeamPCP’s earlier campaigns. “The services targeted by PCPJack strongly resemble the December-January TeamPCP campaigns, before the alleged change in group membership that happened in February-March,” she explained.

Why This Matters for Cloud Security

This campaign underscores a growing trend: cybercriminals are not just competing for victims—they are actively sabotaging each other. For businesses relying on cloud infrastructure, this means the threat landscape is more volatile than ever. Even if your systems are not directly targeted by TeamPCP, they could become collateral damage in a turf war between hacking groups.

SentinelOne’s findings also reveal that PCPJack uses domains designed to phish for password manager credentials and fake help desk websites. This dual approach—technical exploitation and social engineering—makes the campaign particularly dangerous. Companies should review their incident response plans regularly and ensure that exposed services are locked down.

What Can Organizations Do to Protect Themselves?

First, prioritize patching and configuration management. Many of the vulnerabilities exploited by TeamPCP and PCPJack stem from misconfigured cloud services. Second, monitor for unusual activity, such as sudden changes in access logs or unexpected credential exfiltration. Third, educate employees about phishing attempts, especially those mimicking help desks or password managers.

As Delamotte noted, the PCPJack hackers are not trying to mine crypto—they want quick cash through credential theft. This makes them unpredictable but also creates opportunities for defenders. By understanding their tactics, organizations can stay one step ahead.

In the end, the story of PCPJack is a stark reminder: in the digital underworld, no one is safe—not even the hackers themselves. As this campaign evolves, cybersecurity teams must remain vigilant, adapting to a landscape where victims and attackers constantly swap roles.