How AI Is Changing State-Sponsored Cyber Threats for UK SMBs
Why This Matters to a Business That Does Not Feel Like a Target
The shape of state-sponsored cyber activity, when it actually reaches a small business, is rarely what the headlines describe. It is a supplier’s payment details changing inside an email thread that looks completely normal. It is fraud, account takeover, and payment diversion woven quietly into a normal working day.
Most small businesses caught up in this kind of activity never saw themselves as relevant. They were not the intended headline. They were the exposed router, the unpatched VPN, or the supplier connection sitting inside a larger target’s supply chain. The attackers did not need to care who they were. They only needed to care what they connected to.
AI has not invented a new category of threat. It is making familiar attacker methods faster and easier to run at scale, and the small businesses most exposed to that shift are the ones already running a little behind on patching, monitoring, and edge-device hygiene. To understand where the exposure actually sits, it helps to look at how these attacks usually unfold.
How These Attacks Usually Unfold
Strip the jargon and most of these campaigns follow the same five moves, each with a familiar face in a small business.
Research. Scraped supplier lists, LinkedIn trawls, and public domain records build a picture of who matters in your organisation.
Access. A phished mailbox, a credential reused from a breach dump, or an exposed VPN or router gets them in.
Quiet foothold. A mailbox forwarding rule, a lingering session token, or a retained remote-access path keeps them there.
Expansion. Attackers impersonate staff, approve payments, or start sending invoices from inside your business using accounts that were already trusted.
Impact. Fraud, supplier exposure, or disruption, and it is usually the first thing the victim notices.
The NCSC’s 2025 Annual Review is explicit that state actors remain a significant threat to the UK and that hostile cyber activity continues to rise. The front end of these campaigns is typically invisible for weeks or months. By the time damage is visible, the attacker has already made most of the important decisions, and the window for a clean response is narrower than it feels.
Where AI Is Changing That Pattern
The NCSC’s assessment on AI and the cyber threat to 2027 is direct: the time between a vulnerability being disclosed and exploited has already shrunk to days, and AI is expected to shrink it further. For a small team without dedicated security staff, that means fewer days between public advisory and real incident than most patching rhythms can absorb.
In practice, AI speeds up the parts of the attack that used to be slow: target research, phishing copy, lure variations in multiple languages, and vulnerability turnaround once an advisory goes public. The effect is speed and scale, not novelty, but it tilts the advantage further toward whoever moves first.
A Current Example: APT28 and the Ordinary Router
The NCSC’s 7 April 2026 advisory on APT28 is a clean example of how this lands in a real business. Russian state actors exploited vulnerable small-office and home-office routers, rewrote their DNS settings, and redirected traffic through servers they controlled, where they intercepted passwords and authentication tokens for services including Outlook. The activity was opportunistic: attackers cast a wide net across exposed routers and picked out the users who looked interesting.
The attackers did not need to know who you were. They needed a router running software with a known vulnerability. If your broadband kit is old, if firmware updates have no owner, if the router came from your ISP years ago and nobody has touched it since, you were in the same pool as everyone else.
In a real incident, that single device would have handed the attacker the credentials to impersonate staff, reroute supplier payments, or live inside the business undetected for months. The first real weakness was not a careless click. It was a forgotten network device that nobody thought of as part of identity security.
The Four Risks to Map Against Your Own Business
Four buckets cover most of the exposure an SMB needs to worry about. Every UK SMB should be able to describe where they stand on each.
Identity compromise. Email accounts, cloud logins, admin sessions, and stolen tokens. These are the systems attackers want to live inside because they unlock everything else.
Edge-device compromise. Routers, VPNs, firewalls, and internet-facing appliances. Attackers reach these first because they are exposed and under-maintained.
Internal trust abuse. Mailbox forwarding rules, impersonation, altered payment instructions, and misuse of delegated access. This is where a quiet foothold turns into fraud.
Supplier and downstream exposure. Being compromised because of who you connect to rather than who you are. For an SMB that acts as a supplier to a larger organisation, this is both a risk you carry and one you create for someone else.
If you rely heavily on Microsoft 365 or Google Workspace, start with identity. If you have multiple sites or remote workers, start with routers and VPNs. If your business moves money regularly, start with internal trust abuse. If you supply larger clients, start with downstream exposure. Fix the one that fits your business first.
What Quiet Compromise Actually Looks Like
Most damaging incidents in small businesses do not begin with ransomware. They begin with account access and trust abuse. The warning signs below are the ones people dismiss most often.
Router or DNS settings you do not recognise. Altered DNS values, remote administration re-enabled, firmware older than anyone remembers. This maps directly onto the APT28 advisory.
Authentication behaving oddly. Staff getting bounced between login pages they do not normally see. Outlook or Microsoft 365 redirecting somewhere that does not quite look right before loading. Known-good laptops asking for credentials again for no clear reason. Collaboration tools demanding re-authentication when nothing has changed on the network.
Mailbox changes with no explanation. Unexpected forwarding or delegation appearing without a corresponding ticket. Messages disappearing from inboxes that should not be empty. Permissions that do not match what anyone remembers setting.
Real business emails that feel slightly off. Supplier or finance messages arriving in legitimate threads, with familiar signatures, but with a changed bank account, a sudden urgent tone, or a request that does not quite match how that person usually writes.
These signs are only obvious in hindsight.
The Mitigations That Actually Move the Needle
Most UK SMBs have outsourced IT, a part-time office manager handling updates, mixed office and home setups, and finance workflows that run on email and habit. The six controls below are ordered with that reality in mind.
Harden the accounts attackers target first. Give the strongest authentication to admin, finance, and identity-controlling users. Not all MFA is equal. The NCSC recommends phishing-resistant methods such as FIDO2 security keys over weaker forms where the risk justifies it. Separate admin accounts from daily-use accounts so that a phished mailbox does not automatically unlock full administrative control.
Treat routers and DNS as part of identity security. Put firmware age, remote-admin settings, DNS values, and supportability on a recurring review schedule. Short, scheduled, and owned by someone beats occasional and heroic.
Patch by exposure, not by convenience. Prioritise internet-facing kit first: anything with a public IP, plus the remote access and email paths that reach the outside world. Keep a short edge-asset list, because these systems are typically less tracked than laptops or phones.
Add friction to the business processes attackers abuse. Require a second channel for supplier banking changes, urgent payment requests, and sensitive account resets. Review mailbox forwarding and delegated access as routine governance, not only after fraud has occurred. No high-risk action should depend on email alone.
Constrain what an attacker can do after first access. Assume one account will eventually get compromised and make sure that does not immediately mean full control of everything else. Restrict macro-heavy document flows, reduce unrestricted scripting on user endpoints, and review who can install remote access or remote support tools.
Name the person who reviews the quiet signals. Sign-in oddities, mailbox changes, and router drift need a recurring slot in someone’s calendar, not a volunteer moment when something goes wrong. One person, one schedule, written down.
Most of these cost no meaningful money. What they cost is time, ownership, and a willingness to treat boring systems with the same seriousness as the obviously important ones.
If Something Already Feels Off
The response below follows a sequence that is easier to hold onto under pressure: contain, preserve, check, escalate, assess.
Contain. Revoke active sessions, protect key admin accounts, and isolate affected devices or users where practical.
Preserve. Capture evidence before cleaning anything. Do not wipe systems or mass-delete messages in a hurry. That data is what tells you the scope of what happened, which is the next question to answer.
Check. With evidence held, look at the systems most likely to matter: email, finance, remote access, admin accounts, routers, and other edge devices.
Escalate. Bring in your MSP, MDR provider, or incident response support early. Call your insurer, solicitor, privacy support, or breach advisor as soon as customer data might be involved. Early notification is often a condition of cyber insurance cover.
Assess. Work through downstream impact honestly, covering shared credentials, supplier relationships, customer communications, delegated access, and exposed service connections.
The NCSC’s guidance for small organisations, aimed at UK organisations of up to 250 employees, stresses structured response and recovery over improvisation. That is the right framing for a small team under pressure.
The Practical Takeaway
A small business does not need to think like an intelligence agency. It needs one uncomfortable assumption and one person. The assumption is that subtle operational drift is not harmless by default. The person is whoever owns the first look when something feels off.
If nobody owns your router, if mailbox forwarding has never been reviewed, if a phished admin account could compromise your finance system tomorrow because nothing stands between them, this article is not about state-sponsored attacks in the abstract. It is about your business, right now, and the shape of a problem that has not made itself visible yet.