SOC status:Duty analyst on shift
Sectors · Defence, research and government contractors
Research institutions, engineering firms and suppliers to the Ministry of Defence, central government and their primes. The threat is long-dwell espionage and supply-chain compromise, and the assurance regime is explicit. We defend against the first and evidence the second.
DEF STAN 05-138Cyber Essentials PlusCMMC Level 3 assessedNCSC CAFUK-based analysts
China-nexus intrusion sets continue to run long-dwell espionage against UK and European defence and research organisations, usually through edge devices and identity systems rather than malware on a desktop. Russia's FSB and GRU units have been the subject of joint advisories in 2026 for systematic compromise of router perimeters across critical infrastructure and defence networks, and for credential-harvesting against federated Microsoft 365 tenants. North Korean operators approach the sector through fraudulent IT-worker recruitment and developer-toolchain compromise. The commercial threat has not gone away either: data-extortion crews target MoD contractors precisely because the data is sensitive. Our weekly report for the sector follows the state actors, the zero-days in the equipment they favour and the assurance implications.
What we watch for
Firewalls, VPNs and routers exploited by state actors before disclosure, then used for quiet persistence.
AD FS and Entra ID weaknesses that turn one server into tenant-wide access.
Managed service providers and sub-tier suppliers as the route into the contractor estate.
Valid-account intrusions using credentials harvested from staff and supplier devices.
Fraudulent remote-worker placements and engineered approaches to technical staff.
Criminal crews stealing engineering and contract data for leverage rather than encryption.
How we help
Weekly report
State-linked reconnaissance leads the defence and R&D picture — Volt Typhoon probing contractor login portals and APT41 active across 15+ industries — alongside KEV additions for JFrog Artifactory and BerriAI LiteLLM that bear directly on build chains and AI workflows.
The R&D and defence-contractor vertical continues to be shaped by the sustained China-nexus dominance of intrusions against the defence industrial base identified by Google Cloud / Mandiant in the 2026 update, and by continued Russian and North Korean activity in the same space.
The R&D and DIB vertical continues to sit at the highest strategic threat level of any of the covered verticals, with the dominant threat being long-dwell espionage from China-nexus and DPRK-nexus actors.
Coverage this period is dominated by the CISA KEV addition of CVE-2026-45659 - a significant risk given the prevalence of SharePoint in classified-adjacent document management - and by continuing PRC state-sponsored activity attributable to Salt Typhoon and Volt Typhoon.
The collection picture this period is dominated by sustained state-aligned espionage activity (Salt Typhoon, Mustang Panda, APT28 and Screening Serpens all remain active), continued infostealer activity affecting contractor supply chains…
During the reporting period the principal observations were the continued sustained cyber pressure on the Western defence industrial base from Russia- and China-linked actors as documented by Mandiant / Google Threat Intelligence (April 2026 report describing China-nexus groups as the most active…
Questions
Yes. SOC365 is run from Duxford by UK Cyber Defence's own staff under ISO 27001 and ISO 9001 processes; where a contract requires particular personnel assurance we will tell you plainly what we can and cannot evidence.
Yes. We map the control set to what you already have, close the gaps with engineering rather than paperwork, and supply the evidence the prime or the MoD assessor expects.
We hold a CMMC Level 3 assessment ourselves and help UK suppliers to US primes meet the requirements that flow down to them.
Start a conversation
Thirty minutes on your estate, your suppliers and the assurance regime you are working to.