BELFAST – The UK government’s cyber defence agency warned on Wednesday of an emerging threat to Western critical national infrastructure posed by hackers sympathetic to Russia and its war on Ukraine.

Russia-aligned “hacktivists” have carried out largely harmless online campaigns that have defaced prominent public websites or knocked them offline. However, some of those groups have been actively plotting ways to do more real-world damage, Britain’s National Cyber Security Centre (NCSC), part of the GCHQ eavesdropping intelligence agency, said in an alert.

“Some have stated a desire to achieve a more disruptive and destructive impact against western critical national infrastructure, including in the UK,” the NCSC said.

“We expect these groups to look for opportunities to create such an impact, particularly if systems are poorly protected,” said the alert, which was released to press at a two-day conference hosted by the NCSC and GCHQ in Belfast.

Although such groups are ideologically-motivated and align themselves with Russian state interests, they are “not subject to formal state control,” the alert said.

“This makes them less predictable”, it said.

A successful cyberattack on critical national infrastructure such as an energy grid or water supply could be highly destructive, and do serious real-world damage.

The NCSC alert said such attacks, which typically require very high levels of technical skill and resources to carry out, would be “unlikely” to be achieved by hacktivist groups “without external assistance”, but warned that they “may become more effective over time”.

That assistance may already be in place, however.

Among the dozens of highly classified U.S. intelligence documents which were posted online in recent weeks was one marked “Top Secret” that warned a pro-Russia hacking group named “Zarya” had infiltrated networks within Canada’s gas infrastructure.

According to that “Top Secret” document, a copy of which was reviewed by Reuters, the group offered screenshots to officers of Russia’s FSB as proof that they were able to “increase valve pressure, disable alarms, and initiate an emergency shutdown of an unspecified gas distribution station”.

Reuters has not independently verified the documents’ authenticity. A number of countries have questioned the veracity of some of the documents, including Britain, which said there was “a serious level of inaccuracy” in the information.

(Reporting by James Pearson; editing by Grant McCool)