The threat from commercial cyber proliferation

NCSC Assessment (NCSC-A) is the authoritative voice on cyber threat to the UK. We fuse all-source information – classified intelligence, industry knowledge, academic material and open source – to provide independent key judgements that inform policy decision making and improve UK cyber security. We work closely with government, industry and international partners for expert input into our assessments.

NCSC-A is part of the Professional Heads of Intelligence Assessment (PHIA). PHIA leads the development of the profession through analytical tradecraft, professional standards, and building and sustaining a cross-government community.

This report was produced for CYBERUK 2023 and uses formal probabilistic language (see yardstick) from NCSC-A product to inform readers about the threat to UK industry and society from commercial cyber tools and services.

Professional Head of Intelligence Assessment (PHIA) Probability Yardstick 

NCSC Assessment uses the PHIA probability yardstick every time we make an assessment, judgement, or prediction. The terms used correspond to the likelihood ranges below.

The commercial proliferation of cyber tools and services lowers the barrier to entry to state and non-state actors in obtaining capability and intelligence that they would not otherwise be able to develop or acquire.

The sophistication of some commercial intrusion cyber products and services can almost certainly rival the equivalent capabilities of some state-linked Advanced Persistent Threat (APT) groups. The bulk of the commercial cyber sector is highly likely focused on satisfying domestic state demand from law enforcement and government agencies. However, over the last decade, a growing number of enterprises have emerged offering a range of products and services to global customers. They include off-the-shelf capability (Hacking-as-a-Service), bespoke hacking services (hackers-for-hire), and the sale of enabling capabilities such as zero-day exploits and tool frameworks.

Over the last ten years, at least 80 countries have purchased commercial cyber intrusion software, or spyware. For dozens of states without a skills base, the commercial sector is almost certainly transformational, allowing cost-effective access to capability that would otherwise take decades to develop.

While products vary in capability and application, commercially available spyware for mobile devices can offer the ability to read messages, listen to audio calls, obtain photos, locate the device and remotely operate the camera and microphone. Some states are likely to procure multiple commercial cyber tools to meet their requirements. Devices can be compromised in a number of ways, including phishing, but also ‘zero-click’ attacks which do not require user interaction, making it more difficult for victims to mitigate.

While these tools have been used by states against law enforcement targets, spyware has almost certainly been used by some states in the targeting of journalists, human rights activists, political dissidents and opponents and foreign government officials. This is almost certainly happening at scale, with thousands of individuals targeted each year. While current products focus on mobile devices and intelligence gathering, as the sector grows and demand increases, products and services will likely diversify to meet demand.

Hacker-for-hire groups carry out cyber activity for paying clients. As well as providing information of traditional espionage value to states, hackers-for-hire are also reportedly used for legal disputes, intellectual property theft, insider trading, and the theft of other private data. Hackers-for-hire differ in skill and capability, ranging from low-level cyber crime activity to technically complex and effective network compromises that may go undetected. Some groups operate in criminal circles, some portray themselves as commercial companies, and others operate anonymously. Hacker-for-hire groups that focus on stealing information use phishing and other social engineering attacks, exploits against publicly reported vulnerabilities in computer networks, and sometimes zero-day attacks to compromise victims. The greatest threat comes from higher-end, hacker-for-hire groups, whose abilities and impact are similar to those of capable state actors. Hackers-for-hire pose a potential corporate espionage threat against organisations and individuals with privileged or valuable confidential information in multiple sectors.

While less-skilled and cyber criminal hackers-for-hire almost certainly carry out Denial of Service (DoS) attacks for a fee to temporarily disrupt a target website or server on a customer’s behalf, additional law enforcement attention probably deters higher skilled hackers-for-hire from conducting destructive or disruptive operations. However, a growing market and the extra financial incentive raise the likelihood of hackers-for-hire accepting this type of tasking over the next five years. Hackers-for-hire also raise the likelihood of unpredictable targeting or unintentional escalation through attempts to compromise a wider range of targets, particularly those seeking valuable information to sell on, as opposed to ‘working to order’. It is likely that potentially significant financial rewards incentivise state employees or contractors with cyber skills to become hackers-for-hire, risking the proliferation of cyber techniques from state to non-state actors.

Historically, underground criminal markets have facilitated the exploit trade. Since the early 2000s, a lucrative market for zero-day exploits has emerged in the commercial space. The large sums of money involved for critical zero-day exploits for commonly used systems and processes mean opportunities for profit are significant and have driven commercialisation.

Critical zero-day exploits and vulnerabilities are almost certainly transformational to actors with the skills to make use of them. States, or commercial cyber intrusion companies providing products to states, are the dominant customers of the commercial zero-day market and are highly likely to remain so for the next five years. The growth of the commercial sector facilitating this trade has likely increased the number of states able to access critical zero-day capability, directly or indirectly.

Some well-funded cyber crime groups have highly likely purchased lower priced zero-day exploits for less well-used systems from underground exploit marketplaces. However, purchasing high-cost, critical zero-day capability from the commercial marketplace is unlikely to appeal to most cyber crime groups. Financial motivation makes it more likely that they prioritise lower-cost exploits developed from disclosed zero-day vulnerabilities, albeit as early as possible after disclosure to maximise the number of unpatched systems they can target.

Customisable tool frameworks are developed by cyber security software developers to emulate threat activity to enable penetration testing of networks. They are usually sold under licence, but some are also publicly available or available in versions where the licence has been removed. These frameworks are being used or repurposed by state and non-state actors; highly likely enabling a cost-effective uplift in cyber capability. It is highly likely that their constant evolution and the ability of actors to customise and repurpose these frameworks means widespread misuse of these frameworks will almost certainly continue over the next five years.

State and non-state actors also have access to capability developed and sold for cyber crime. In recent years, cyber crime marketplaces have grown and become increasingly professionalised, in part driven by demand from ransomware actors. One example is Malware-as-a-Service (MaaS), which is a service that provides use of malware, eliminating the need to create and develop the software as well as reducing the knowledge threshold required to operate the malware. Offering these services as a package is attractive to less skilled cyber criminals and as such has almost certainly expanded the number of victims.

Over the next five years:

• Increased demand, coupled with a permissive operating environment, will almost certainly result in an expansion of the global commercial cyber intrusion sector, driving an increased threat to a wide range of sectors.
• It is almost certain there will be further high-profile exposures of victims against whom commercial cyber tools or hack er-for-hire operations have been deployed.
• Oversight of the commercial intrusion cyber sector will almost certainly lack international consensus, be difficult to enforce and subject to political and commercial influence.
• However, it is likely that many commercial cyber companies will be incentivised to vet and limit their customer bases, should effective oversight and international norms on development and sale of commercial cyber capability emerge.