Cyberwarfare & potential cyber-collateral damage: what you need to know
Cyberwarfare no longer sits in the background of geopolitical conflict but rather runs alongside it. As tensions escalate in the Middle East and the Russia–Ukraine war continues to evolve, organisations far removed from the front line are still feeling the impact through supply chains, shared infrastructure, phishing campaigns and disruptive DDoS activity.
This blog breaks down what “cyber collateral damage” really means in 2026, what recent conflicts have taught us about today’s threat actors, and, most importantly, the practical steps UK organisations should take now to reduce exposure.
Cyber collateral damage risk in 2026: why it’s rising again
Right now, the NCSC is explicitly advising UK organisations to review their cyber posture in response to the evolving Middle East situation, noting that while there’s likely no significant change in the direct cyber threat from Iran to the UK, indirect risk is heightened, especially for organisations with regional presence or supply chain links.
With the US–Iran conflict intensifying in late February 2026, it’s sensible to plan for a messy cyber environment where hacktivists and Iran-linked actors may look for high-visibility disruption and soft targets, while defensive resources are stretched. US agencies have also warned that Iranian cyber actors may target vulnerable networks and conduct activity, including ransomware and intrusion against entities of interest.
What is cyber-warfare?
Cyberwarfare or cyber terrorism refers to a form of security incident in which a nation-state actor or group attempts to damage another nation’s information technology infrastructure. They typically achieve this by disrupting the technology of public service organisations such as the government, healthcare, education, transport and military. These attacks can take many forms, including ransomware, espionage and denial-of-service attacks.
In recent years, we have seen how large an impact nation-state-sponsored attacks can have on public and private infrastructure. The WannaCry ransomware of 2017, for example, was attributed by the NCSC as the work of state actors, impacting thousands of organisations across multiple countries. The UK’s National Health Service (“NHS”) was severely affected, with 80 NHS organisations affected by the ransomware, along with household brand names like Telefónica, Boeing and Honda.
While WannaCry was not intended to be a direct attack on these companies, it highlighted the propensity of organisations to become collateral damage in broader nation-state attacks. This risk seems particularly pronounced at the moment, given the Russian invasion of Ukraine and evidence that offensive cyber activity had begun before the invasion.
Middle East escalation and Iran-linked activity: what UK organisations should do now
The NCSC’s current guidance is pragmatic. Even where the direct UK threat hasn’t materially shifted, you should review your cyber posture because indirect disruption risk rises fast during conflict, especially if you’ve got regional operations or supply chain exposure.
“As a result of the ongoing conflict in the Middle East, there is likely no current significant change in the direct cyber threat from Iran to the UK, however due to the fast-evolving nature of the conflict, this assessment may be subject to change. There is almost certainly a heightened risk of indirect cyber threat for those organisations and entities who have a presence, or supply chains, in the Middle East.”
Action checklist (guidance from the NCSC)
Prepare for DDoS and phishing spikes and copycat activity; make sure comms and service owners know what “degraded but safe” looks like.
If you’re at higher risk, take the “heightened threat” steps, plus:
Increase monitoring
Review external attack surface (what’s internet-facing, misconfigured, forgotten).
Sign up for NCSC Early Warning so you’re not the last to know.
Make it easy to escalate: remind teams how to report incidents and what “suspicious” looks like during geopolitical spikes.
US agencies have separately warned that Iranian cyber actors may target vulnerable networks and may conduct ransomware/intrusions against entities of interest, which is another reason to prioritise hygiene over hot takes.
Russia–Ukraine cyberwar: what’s happened (and what it means for UK organisations)
Key cyber incidents and tactics seen in the war
Since 2022, the war has been a live test of cyber operations alongside physical conflict, and the recurring theme is disruption and destruction, with spillover risk for everyone else.
Satellite comms disruption with European impact (Feb 2022): the KA-SAT incident disrupted connectivity beyond Ukraine, showing how a wartime cyber operation can ripple into wider regions.
Attempted attacks on energy/ICS: the Industroyer2 case is a clear example of malware built for industrial control environments, paired with destructive tooling, i.e., the kind of activity that defenders in energy and CNI should treat as a blueprint for future attempts elsewhere.
Destructive malware (wipers) didn’t stop after the “opening phase”: reporting across 2024–2025 continues to highlight destructive campaigns, including activity linked to well-known Russian threat actors.
Civilian infrastructure as a target: Ukraine’s largest telecoms provider Kyivstar was hit in December 2023 with major nationwide disruption; Ukrainian security officials attributed responsibility to Russian military intelligence-linked actors.
Hacktivist and “patriotic” disruption: pro-Russian aligned hacktivism and DDoS have persisted, with the UK’s NCSC warning that Russian-aligned hacktivists continue to target UK organisations to disrupt services.
What defenders should learn
Collateral damage is predictable: shared services (satellite, cloud, MSPs, identity providers) create a blast radius.
Identity and external exposure decide outcomes: most organisations don’t fall victim because the malware is too sophisticated; they fall because MFA isn’t enforced, patching lags, and monitoring is thin.
DDoS and phishing still matter: “simple” attacks can cause real disruption when your online services are critical to customers, which is exactly what the NCSC keeps reinforcing.
Why organisations become collateral damage (identity, exposure, supply chain)
In today’s hyper-connected world, a large-scale cyber-attack has the potential to impact any company’s devices, networks and solutions that are hosted on the internet.
The public sector, in particular, is vulnerable to these attacks. While the public sector in the UK is slowly improving its digital capabilities, although it is often restrained by a lack of resources, annual budget cycle constraints and legacy technology. Some private-sector organisations are not far in front, with little investment in IT administration or security.
Indeed, where it is challenging to justify new investments as preventative measures, organisations are more likely to be impacted by security incidents outside of their control. A UK Government report on the full costs of a cyber security attack highlights that many organisations underestimate the real cost of a cyber incident.
Traditionally, public sector organisations are more reactive to cybersecurity implementation than proactive. For example, in the wake of the WannaCry ransomware attack, the government agreed to a £150 million contract with Microsoft to improve the cybersecurity of the NHS – but it took a devastating ransomware attack to trigger this.
Moreover, the government’s own 2021 report on Cybersecurity skills in the UK labour market highlights the public sector’s dependence on third parties for cyber security – indicative again of a lack of resources. For example, 95% of public sector organisations outsource their firewall configurations, while 80% depend on outsourced companies for incident response.
The outlook is not much better for general businesses. The research found 50% of businesses have a basic technical cybersecurity skills gap, while 8 in 10 businesses outsource the responsibility of setting up firewalls, incident response and detecting malware.
While outsourcing is a promising way to reduce the skills crisis, reliance on third-party suppliers can also increase cyber risk if these partners are not adequately vetted. As we’ve written about in our supply chain security guidance, security incidents in which a threat actor enters one company’s network and then moves laterally into customer and partner systems are increasingly common.
Moreover, this research highlights that in the face of potential acts of cyber warfare, many UK-based organisations may not necessarily have the capabilities or skills to detect and defend against a widespread, destructive form of malware.
How to reduce your risk: a practical resilience checklist
Organisations should assess and bolster their defences.
Improving cyber resilience will not only reduce the likelihood of organisations becoming cyber collateral damage in acts of nation-state cyberwarfare but also improve their overall security posture, so they can better defend themselves against other security threats.
To assist with this, the NCSC has released guidance on steps to take when the cyber threat is heightened. The steps cover the fundamentals of security hygiene. While these are always critical, they are especially important given the current heightened risk of cyber-attacks.
In the medium-term, we also advise organisations to consider completing Cyber Essentials, the NCSC’s flagship cybersecurity standard. This standard helps companies guard against the most common cyber threats. We’ve written a guide about Cyber Essentials, which explains the standard in more detail.
A step beyond this would be to implement the NCSC’s 10 Steps to Cyber Security framework, which is designed to help companies build a holistic approach to cybersecurity.
The NCSC also has a page on its website dedicated to the public sector, with links to relevant guidance on cloud security, risk management and protecting employee devices.
We offer dedicated cybersecurity consulting services for organisations seeking further guidance and support in improving their cybersecurity posture.
Need support with your security posture?
Cyber conflict is noisy, unpredictable, and rarely contained. The organisations that ride it out best aren’t the ones chasing every headline, they’re the ones that have tight identity controls, minimal external exposure, tested recovery, and a response plan that works.
If you want a practical view of where your risk sits right now, Evalian can help with:
External attack surface review and hardening (what attackers can see first)
Incident response planning and tabletop exercises
Security posture assessment aligned to real-world threat paths
24/7 monitoring and response support
If you’d like us to pressure-test your current readiness and give you a prioritised fix list, get in touch.
