NCSC UK advisory: increased targeting of internet-exposed OT and edge devices globally, including the UK, by state and non-state actors, with 'some limited real-world disruption'

NCSC UK published an advisory on 2026-08-27 stating it has observed increased targeting of operational technology (OT) systems across multiple sectors globally, including in the UK, carried out by "a range of threat actors" and resulting in "some limited real-world disruption": "the NCSC has seen increased targeting of operational technology (OT) systems across multiple sectors globally, including in the UK. This has been carried out by a range of threat actors and resulted in some limited real-world disruption" (NCSC UK, 2026-08-27). The advisory names no specific actor, CVE or victim, and is framed as a national-resilience notice rather than an incident disclosure: it instructs organisations with internet-exposed OT not to assume their systems are inaccessible from the internet without verifying it, citing misconfiguration, legacy connections and unmanaged assets as the typical exposure paths; "organisations should not assume that their OT is inaccessible from the internet without verifying it, as unintended exposure can arise through misconfigurations, legacy connections, or unmanaged assets" (NCSC UK, 2026-08-27).

NCSC UK assesses that "the threat from state use of offensive cyber, including outside of conflict, has almost certainly increased" (NCSC UK, 2026-08-27) against a backdrop of technology-enabled capability uplift and geopolitical instability, and explicitly links this to its July 2026 joint advisory (with partners) on Russian state actors exploiting poorly configured routers, a continuation of an already-flagged threat pattern rather than a new, isolated incident. It also connects topically to the prior coverage here of the Minnesota/US water-utility PLC campaign and the associated European exposure count (86% of 4,117 internet-facing Siemens SIMATIC S7-1200 units concentrated in four EU countries, reached through mobile-carrier connectivity).

The advisory's guidance is standard OT hardening: definitive asset/connectivity inventory, no direct internet exposure for PLCs/HMIs, no default or shared credentials (MFA or key-based authentication on management interfaces), segregated management, migration to secured protocol variants (DNP3-SAv5, CIP Security, Modbus Security, OPC UA) with telnet/SNMPv1/v2 disabled, and tested ransomware-resistant backups; its one distinctive instruction is to verify actual internet reachability against the documented architecture rather than trusting the documentation.

The only attacker behaviour the advisory itself describes is exploitation of internet-exposed PLC/HMI management interfaces; default/shared-credential access appears only in its mitigation guidance, not as observed adversary behaviour. Triage: this is a resilience notice naming an exposure class rather than a specific observed intrusion chain, so no benign-lookalike discriminator applies; the actionable step is verifying actual internet reachability against documented network architecture; the advisory's own framing is that the gap between the two is where exposure lives.