News: 1758622046

  ARM Give a man a fire and he's warm for a day, but set fire to him and he's warm for the rest of his life (Terry Pratchett, Jingo)

UK chancellor Putin the blame on Russia for cyber chaos, but evidence says otherwise

(2025/09/23)


UK chancellor Rachel Reeves is blaming Moscow for Britain's latest cyber woes, an attribution that seems about as solid as wet cardboard given the trail of evidence pointing to attackers much closer to home.

In [1]an interview with ITV on Monday, Reeves suggested Moscow's fingerprints were on recent cyber incidents affecting major UK firms. The comments appeared to allude to the recent hacks on Marks & Spencer, Co-op, Harrods, and Jaguar Land Rover, though the chancellor stopped short of naming any specific cases.

Regardless, she insisted the threat facing UK businesses was "coming from hostile states, states like Russia," and claimed "a number of these attacks originate in Russia by Russian-backed entities", without providing evidence to support the allegation.

[2]

Days prior to the interview, the UK's National Crime Agency announced that [3]it had cuffed four suspects over the Marks & Spencer breach : three Brits and a Latvian. Investigators allege the quartet belong to Scattered Spider, an English-speaking social engineering crew that has plagued companies on both sides of the Atlantic. The NCA claimed it had also linked the four suspects to the recent attacks on Co-op and Harrods.

[4]

[5]

Meanwhile, researchers believe that the group, rather than being run by Kremlin-sponsored operators, consists mainly of young miscreants from the UK and US, adept at SIM-swapping, phishing, and sweet-talking call center staff.

The same group has also been [6]linked to the recent Jaguar Land Rover cyberattack that shuttered factories across the UK and overseas for weeks, costing millions in lost production.

[7]Cops cuff another teen over alleged Scattered Spider attack that broke Vegas casinos

[8]Alleged Scattered Spider teen cuffed after extortion Bitcoin used to buy games, meals

[9]Two Scattered Spider teens charged over attack on London's transport network

[10]Scattered Spider gang feigns retirement, breaks into bank instead

Authorities, meanwhile, have characterized Scattered Spider as a criminal gang, not a state-sponsored unit – unless the Kremlin has suddenly started hiring Mancunians and Californians to do its dirty work. Reeves' claim sits awkwardly alongside both the NCA's own arrests and years of analysis. To date, no credible researcher has described them as a Russian front.

ITV even followed up Reeves' interview with a piece headlined "Was the chancellor right to accuse Russia of being behind recent UK cyber attacks?" – a question it seemed to have already answered.

[11]

While not linked to the recent cyberattacks on UK businesses, it's unlikely Russia has been twiddling its thumbs. Moscow has a history of conducting disruptive cyber operations in the UK, from the 2018 GRU hack-and-leak incident to its ongoing [12]attempts at espionage and influence operations.

Whitehall no doubt sees classified intelligence suggesting Russia's fingerprints on some recent incidents, but lumping in the recent retailer hacks with state-backed campaigns risks muddying the waters and undermining confidence in government messaging.

Reeves' comments may prove to be little more than a political flourish and a reminder to voters that Russia remains a hostile state. But unless the government produces evidence tying Moscow to the recent retail and automotive meltdowns, the record shows a different culprit: a ragtag bunch of English-speaking miscreants who think nothing of locking down a multinational while sitting in their bedrooms.

[13]

For businesses trying to understand the threats they face, that distinction matters. ®

Get our [14]Tech Resources



[1] https://www.itv.com/news/2025-09-22/rachel-reeves-russia-behind-some-of-recent-uk-cyberattacks

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aNLEF0KZSqlqcxxs6x-VpwAAAkA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://www.theregister.com/2025/07/10/nca_arrests_four_in_connection/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNLEF0KZSqlqcxxs6x-VpwAAAkA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aNLEF0KZSqlqcxxs6x-VpwAAAkA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[6] https://www.theregister.com/2025/09/10/jaguar_key_lessons/

[7] https://www.theregister.com/2025/09/22/teen_cuffed_scattered_spider_casino/

[8] https://www.theregister.com/2025/09/19/scattered_spider_teen_cuffed/

[9] https://www.theregister.com/2025/09/18/two_teens_charged_in_tfl_case/

[10] https://www.theregister.com/2025/09/17/scattered_spider_bank_attack/

[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aNLEF0KZSqlqcxxs6x-VpwAAAkA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[12] https://www.theregister.com/2025/07/20/uk_microsoft_snooping_russia/

[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cybercrime&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aNLEF0KZSqlqcxxs6x-VpwAAAkA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[14] https://whitepapers.theregister.com/



Keep digging

VoiceOfTruth

>> undermining confidence in government

That made me laugh. How do so many incompetent people get to be in power?

Re: Keep digging

Anonymous Coward

What makes you think that competence is an attribute that the process of gaining power even observes?

Re: Keep digging

elsergiovolador

It is competence, but not in the subject matter. They know how to gaslight, manipulate, coerce and that's how they climb the ladder. Once they are at the top, they look for advisers who will make them look competent in the subject matter. Problem is that they have ego so big, they are unable to stand criticism and can't hear "no".

Evidence

Fara82Light

The UK Government is unlikely to put such information in the public domain. Further, the presence of the suspects in the EU and UK does not necessarily indicate that the group does not have links to the Putin Regime. Nor would it be the first time that the Kremlin or any other agency of the regime would have hired individuals and/or groups within the UK.

Re: Evidence

VoiceOfTruth

I call bullshit on that. By your 'reasoning' every hacker is linked to Russia. Bull effing shit.

Re: Evidence

Fara82Light

That is either naive or an attempt to distract attention from the truth.

Re: Evidence

Anonymous Coward

But why would RR allude to such evidence if she knew it was supposed to be kept secret? Never suspect malice where incompetence provides an explanation.

Re: Evidence

cyberdemon

The labour government has form on this. E.g. Palestine Action are terrorists. Trust us, we have secret evidence that proves it. But we aren't going to publish it cos it's er, secret

Re: Evidence

Peter2

The labour government has form on this. E.g. Palestine Action are terrorists. Trust us, we have secret evidence that proves it. But we aren't going to publish it cos it's er, secret

We don't really need much evidence to prove that Palestine Action were sabotaging British military equipment since they released a press release bragging about it, and then said to a Telegraph reporter (!) that their next targets were the aircraft used by the air cadets (aka RAF sponsored version of Scouts) and for the basic flight training of the Ukrainian pilots in the UK which have zero relation to Palestine. Not that damaging refuelling tankers did, mind you given that they couldn't be used to refuel Israeli aircraft given that they use a different refuelling system to us.

Their actions meet the requirements of the terrorism act to be described as terrorism, as well as banning the group. They are rather lucky that merely the group is being banned; the lot of them could have been tossed in jail as members of a proscribed terrorist organisation, or for High Treason as they have "adhered to the king's enemies in his realm, giving them aid and comfort in his realm or elsewhere" or "levied war against the king in his realm".

The fact that far left protest groups actions are indistinguishable from terrorism or high treason is perhaps something that the far left might wish to consider soberly. The far left is just as much of a fucking menace as the far right.

Re: [Palestine Action] Their actions meet the requirements of the terrorism act

Anonymous Coward

Their actions might indeed meet the requirements of the terrorism act [for] to be described as terrorism; it wouldn't surprise me at all.

However, of their actions, the most reported seems to be the vandalism of military equipment, and I, for one wouldn't call that "terrorism", even though I disagree with it, think it utterly misdirected, and believe they should be prosecuted for it.

Still, perhaps they have committed other acts that are more like the expected (i.e. not legal) definition of terrorism - bombing (or threatening to bomb) civilians, kidnapping, acts of extreme violence ... that sort of thing. I'd be grateful if you could point me at some news sources reporting on these.

Re: Evidence

Roland6

And all their nefarious crimes fell under existing legislation, so no need to actually ban the organisation.

Re: Evidence

Fara82Light

All governments restrict access to details to protect investigations, criminal prosecutions, and sources. This is nothing new and it is to be expected.

Re: Evidence

Jellied Eel

But why would RR allude to such evidence if she knew it was supposed to be kept secret? Never suspect malice where incompetence provides an explanation.

Well, it's Rachel from accounts, so an incompetent providing the explanation. Especially when she's currently on a bit of an impossible mission-

https://www.bbc.co.uk/news/articles/cx2n4877j7lo

The report comes as Chancellor Rachel Reeves is preparing November's Budget in which she is expected to put up taxes or cut spending in order to stick to her own rules on government borrowing.

Next month is likely to be painful, and being able to blame Putin instead of Ed Millibrain is a convenient deflection.

Re: Evidence

Roland6

> Next month is likely to be painful

Next month and the coming years are going to be painful, regardless of who holds power at Westminster, successive governments have been living off the fat and kicking balls down the road, at some point reality impinges…

Re: Evidence

Fara82Light

No Minister has yet mentioned any of the evidence.

Re: Evidence

cyberdemon

Yes exactly. I would think it pretty unlikely that a bunch of teenagers in complete isolation would develop both the means and the will to carry out these attacks.. I would be surprised if they weren't talking to some 'knowledgeable friend' on Discord or similar, who groomed them into this. The same sort of grey-zone handler who likely directed attacks such as the sabotage of TGV lines, and the Just Stop Oil protest that somehow managed to pick a motorway junction right from the top of the national risk register..

Hopefully, it will all come out in the wash

Re: Evidence

Jellied Eel

The UK Government is unlikely to put such information in the public domain. Further, the presence of the suspects in the EU and UK does not necessarily indicate that the group does not have links to the Putin Regime.

Perhaps it should. Mrs Balls was at the UN yesterday blaming Russia for everything, the UK, EU and NATO are essentially in an undeclared war with Russia. So it wouldn't and shouldn't be at all suprising if Russia is retaliating. We hack, or support hacking Russia's systems, they respond in kind and our 'leaders' keep our intelligence & security services busy. Especially with news like this-

https://www.bbc.co.uk/news/articles/c4g5jv4md0do

Drones which will be used by the Ukrainian military are due to be built as part of a £200m investment in the UK, creating 500 jobs.

Ukrspecsystems, described as the biggest drone manufacturing company in Ukraine, will use an existing building in Mildenhall, Suffolk, to produce the unmanned aircraft.

Which is probably a bit weasel-worded and should read "£200m investment by the UK". But a UK business Russia would probably want to disrupt. But like the article says, a lot of the recent attacks seem to be basic extortion attempts by criminals looking to make bitcoin to buy fast food & game cards. No state involvement, although it wouldn't suprise me that state actors are hanging out on the dark web offering help.

Re: Evidence

elsergiovolador

Nice, subtle, attempt at DARVO, comrade.

Your handler must be proud.

Re: Evidence

Alan Brown

"the UK, EU and NATO are essentially in an undeclared war with Russia"

More accurately, Russia has been in an undeclared and escalating war with them since ~2004 which the western powers don't want going "hot"

Attacks on Ukraine and Europe have been going on far longer than the "little green men" (remember when Russia cut gas supplies to Ukraine in 2004 in order to bring them to heel?) and the invasion of Georgia made it extremely clear what Vlad's intentions are (Chechnya was somewhat murkier)

One of the reasons that Europe responded so comprehensively and quickly to Russia cutting gas supplies was that this mode of attack had been semaphoredfor nearly 20 years and EU governments had quietly been making sure that sufficient gas storage existed to provide buffering, modifying major pipelines to be bidirectional and negotiating access to backup LNG sources ever since Russia used it against Ukraine.

Encouraging local criminals(*) is a standard part of covert operations by foreign countries and it's more than likely that western powers are doing the same in Russia as Russia is doing in the west. Encouraging the massive corruptiom there is a crucial part of disabling the military system. Unfortunately if USA norms are followed, those groups will be cut loose as soon as the Russian government collapses, subsequently running amok to maintain their income. That's how at least half of the large modern terrorist organisations existing today got started (particularly in the Middle East).

WRT the "by the UK" vs "in the UK" - the distinction is that the work is happening in the UK, not Ukraine

Russia is bleeding out economically and meterially at the moment. It's already doomed at a population demographics level. The biggest risk is that it moves into desperation mode and starts attacking everything in sight - if anyone retaliates by invading Russia, the Russian population will feel their "everyone hates and envies us" propaganda is true. We must tread carefully

(*) "Trump is the 3rd generation of a four-generation white collar criminal family enterprise" - make of that what you will

Uncle Vladimir?

Anonymous Coward

Way too busy puppy walking the Orange Eejit.

Re: Uncle Vladimir?

elsergiovolador

I heard that Orange Eejit uses Vladimir's suitcase poop as fake tan. Hence the reports of interesting smell.

In the eye of the beholder?

Long John Silver

"Whitehall no doubt sees classified intelligence suggesting Russia's fingerprints on some recent incidents …"

That's a most likely correct assertion. However, so what? "Classified" encompasses 'information' of doubtful provenance (certainly undisclosed), "informed opinion", unquestioned gross errors, subjection to 'ascertain bias', deception of their 'political masters' by security agencies, deception of the public by political 'leaders', 'cover up' (of incompetence, malfeasance, ignorance, and catastrophe, at very levels of administration), and wishful thinking.

Acceptance of supposed 'evidence' hidden under classification requires an act of faith in the motivation, competence, and integrity of all in a chain of people. When the end of the chain is a political 'leader', sup with a very long spoon. Perhaps more than ever before, people holding ministerial and Secretary of State positions lack the nous and requisite analytical skills to pose challenging questions to 'experts'.

"Reeves' comments may prove to be little more than a political flourish and a reminder to voters that Russia remains a hostile state."

Yes, but whose word must we take that Russia is a hostile state? Sadly, we live under rulers who set 'narratives'. These confections become repositories of TRUTH, a conception the naif are discouraged from questioning: truth requires intermediaries akin to priesthoods set to interpreting religious mysteries.

'UK chancellor Putin'

Blazde

For the briefest moment I thought we'd been conquered overnight while I slept.

(I suppose it might be 'Lord High Chancellor Putin' or perhaps 'Lord Protector Putin' depending whether the Monarch was brought on-side or not, and assuming he actually wanted to dabble in the pomp rather than just annex 'Britaniya Oblast' into Greater Russia)

Re: 'UK chancellor Putin'

elsergiovolador

If we got conquered, the country would turn to absolute shite. You wouldn't see a difference.

james bond and co work from home,your home lol

Anonymous Coward

What would you do as a spy in 2025? Crawl through a ventilation pipe at big tech hq and get access to hush huss stuff?. Walk one inch behind someone in the turnstile at every security gate?

Na, thats for idiots ,you have to do is befriend some tech nerd out walking the dog. Or room in a house with someone with a super important job.

All made super easy by everyone blathering their skills and connections on something like linkedin.

So if you are a dull speccy computer nerd with unusually super model like girlfriend it should raise alarms with yourself lol.

But apparently its always someone on the other side of the world with bushy eyebrows, as this makes the average idiot (most people now) feel safe.

And nobody wants to go back to the office.

Re: james bond and co work from home,your home lol

Blazde

Bond also had a lot of unusually super model like girlfriends who turned out to be baddies, to be fair

Reeves' may prove to be little more than a political flourish

Irongut

Especially after she delivers whatever she considers a budget.

Incompetence

elsergiovolador

Reeves blaming Moscow isn’t just wrong, it’s convenient. These aren’t Russian cyber units - they’re the bill for Britain’s own policy vandalism. IR35 gutted the small business IT sector, visas turned the market into a low-cost body shop, and big consultancies cleaned up with paper-thin delivery. Now when those brittle systems fall over under the weight of some SIM-swappers, ministers point at Putin to dodge the truth: Whitehall created this mess. Britain didn’t get hacked by Russia - it hacked itself by destroying its own IT talent base.

Re: Incompetence

Alan Brown

"they’re the bill for Britain’s own policy vandalism"

It's quite clear that a big chunk of that vandalism was foreign-backed

EG: when the rest of the EU was enlarging strategic gas storage setups following Russia's use of gas supplies as a weapon against Ukraine in the early 2000s, the UK was actively dismantling its own one - and that didn't happen under a Labour government.

"Conservative friends of Russia" has a lot to answer for and whilst MP corruption happens across the political spectrum it's clear that the more "conservative" you are, the more likely it is that corruption is tolerated/encouraged

blame whoever

Catch-the-Pigeon

part of the blame lies with the companies themselves, some not even bothering with security and some others do but are pretty lame defence. Find all your endpoints and tie them down with WAF rules, audit and alerting on, Also whatever happened to the UK Gov' Cyber Defence Force ? Is it still on, or has the money for it been divi'ed out ?

Re: blame whoever

Alan Brown

"some not even bothering with security and some others do but are pretty lame defence."

Security costs money and is problematic for C-level staff who need spoonfeeding (and would forget to breathe if it wasn't an automatic reflex)

The result is that it's nearly impossible to get funding for doing it right and the biggest risk is usually a result of having disabled security so the CFO and Marketing execs can login

Dave Finton gazes into his crystal ball...

May 2049: Transmeta Updates Webpage

In a bold move that shocked observers everywhere, Transmeta Corp., a
secretive Silicon Valley company, updated their webpage.

According to our sources, Transmeta fixed a bug in their existing web page
located in the comment "This page contains no tyops". The message has been
fixed to read "This page contains no typso".