The information was revealed to mark the 20th anniversary of the response to the cyber-attack made against the UK Government in June 2003.

After an employee had noticed “suspicious activity” on one of their workstations, cyber experts were asked to investigate — though, there was no dedicated government agency or organisation set up to deal with cyber-attacks at the time.

The experts had found the suspicious activity was related to a phishing email. They then sought help from the information assurance arm of GCHQ, the Communications-Electronics Security Group (CESG).

The CESG’s analysis uncovered that malware designed to steal sensitive data had been installed. This raised “suspicions about the attacker’s intent,” and helped to set “in motion a series of actions that was transformative to cyber incident investigations.”

As part of this series of actions, GCHQ brought together its signals intelligence capabilities with its cyber security function, helping to investigate and identify the perpetrator, the NCSC said.

After analysis and international engagement, the CESG concluded that the intent of the attack had been cyber espionage by a nation state, although the nation state in question wasn’t named by the NCSC.

When the NCSC was founded in 2016, the CESG was incorporated into the organisation alongside the Centre for Cyber Assessment, CERT-UK, and the Centre for Protection of National Infrastructure (now known as the National Protective Security Authority).

Recommended

• Diverse AI Inspires at its Scottish Launch Event
• Report: Cybersecurity Top Concern For Rising Financial Crimes
• Scots Gov Establishes New Fund For Startups

Speaking on the 20th anniversary of the GCHQ’s first response to a state-sponsored cyber-attack, Paul Chichester, the director of operations at the NCSC, said: “Twenty years ago, we were just crossing the threshold of the cyber attack arena, and this incident marked the first time that GCHQ was involved in a response to an incident affecting the UK Government.

“It was also the first time that the UK and Europe started to understand the potential online risks we faced and our response transformed how we investigate and defend against such attacks.

“The NCSC and our allies have come such a long way since this incident, and it is reassuring to be at the forefront of efforts to develop tools and techniques to defend against cyber threats and keep our respective nations safe online.”

In the NCSC’s Annual Review 2022, which was published last November, a specific section was dedicated to state threats. It suggested that the organisation has “continued to see state actors present a significant threat towards the UK and global cyber security.”

The report noted that “the regimes that continued to present the most acute cyber threat to the UK and its interests were Russia, China, Iran and North Korea.”