UK spies see ‘direct connection’ between Russian cyberattacks and sabotage plots

MANCHESTER, England — Britain’s intelligence services are seeing a “direct connection between Russian cyber attacks and physical threats to our security,” the country’s cyber chief announced on Wednesday.

Malign actors in Moscow are “waging acts of sabotage, often using criminal proxies in their plots,” warned Richard Horne, the head of the National Cyber Security Centre (NCSC) at the CYBERUK conference in Manchester.

Horne said both NCSC and the domestic security service MI5 were seeing the hacking threat from Russia manifesting “on the streets of the U.K. against our industries and our businesses, putting lives, critical services and national security at risk.”

He told the CYBERUK audience that the role of the information security community was “therefore not just about protecting systems, it’s about protecting our people, our economy, our society, from harm.”

Horne said NCSC wouldn’t be able to reveal operational details, but explained that “cyber means” were offering a range of threat actors the capacity for reconnaissance and the “ability to target a physical threat.”

The warning follows a series of suspected Russian-directed sabotage incidents across Europe. Security agencies and governments across the continent warned last year about these threats, while NATO and the European Union both condemned “intensifying” Russian sabotage and hybrid operations.

Last month, British police announced the arrest of a Romanian man suspected of assisting Russia’s military intelligence agency in a plot that involved an incendiary device detonating at a DHL logistics warehouse in Birmingham.

Russia is believed to have been behind a July 2024 blaze that also affected the DHL logistics chain in Leipzig, Germany. If that parcel bomb bound for the U.K. had detonated aboard a flight it could have caused a plane crash, German security services said. 

A third incident took place in July near Warsaw, the capital of Poland. As reported by Reuters, the attempts are believed to be a “dry run” for a future plot in which Russia detonates incendiary devices in midair on transatlantic cargo flights to the United States and Canada.

The devices were reportedly disguised as massage machines from Lithuania and contained a magnesium-based substance which could have burned so destructively that an aircraft would have crashed.

In November, Kęstutis Budrys, the chief national security adviser to Lithuania’s President Gitanas Nausėda, blamed Russia’s military intelligence agency, known as the GRU, for the plots. Other Western security officials have agreed with this assessment, as reported by The Wall Street Journal.

That allegation came as the Polish National Prosecutor’s Office confirmed the arrests in July of four people over parcels containing concealed explosives which it said were believed to be test runs before an attack on flights bound for the U.S. and Canada. Another man, who is suspected of posting the parcels in Lithuania, was arrested in September.