Britain is being hit by dozens of cyber-attacks a month, including attempts by Russian state-sponsored hackers to steal defence and foreign policy secrets, GCHQ's new cybersecurity chief has said. Ciaran Martin, head of the new National Cyber Security Centre (NCSC), told the Sunday Times there had been a "step change" in Russia's online aggression against the west. His comments came as the chancellor, Philip Hammond, told the Sunday Telegraph the centre had blocked 34,550 "potential attacks" on government departments and members of the public in the past six months – about 200 cases a day. Allegations of Russia-sponsored cyber-attacks became a focal point during the US election, raising fears that the tactic was on the rise. Martin said Britain had been hit by 188 high-level attacks, "many of which threatened national security" in the last three months.
On Tuesday, Facebook announced that it had removed 652 fake pages and accounts that were using Facebook and Instagram to stir unrest and stoke divides on contentious political and social issues. Some of the accounts were associated with Iranian state media or otherwise originated in Iran--showing that other countries, not just Russia, have been active on Facebook for years in attempts to steer and manipulate political conversations in the United States and elsewhere. Many of these accounts were engaged in coordinated activity and were attempting to advance narratives in support of Iranian policy interests, like the Iranian nuclear deal, for example. In total, Facebook revealed four different investigations on Tuesday related to the removal of accounts and pages associated with state actors running inauthentic accounts, including more accounts associated with Russia. In the case of the Iranian accounts, Facebook began its investigation after a receiving a tip from the cybersecurity research firm Fire Eye, which led Facebook to start investigating a group called "Liberty Front Press" and its affiliated network of accounts.
On Tuesday, Facebook acknowledged what many already feared: there appears to be evidence of a political influence campaign on the platform ahead of the 2018 midterm elections. The company did not specify who is behind the "coordinated inauthentic behavior" that led Facebook to remove 32 pages and accounts. But company officials did mention the Russia-based Internet Research Agency in a post about the takedown, saying that the culprits are using more sophisticated tactics than the IRA has in the past. The Atlantic Council's Digital Forensic Research Lab, an organization that has partnered with Facebook to analyze abuse on the platform, was given a selection of the pages 24 hours before the takedown. Their disinformation experts were a bit more pointed in their initial analysis, saying an "initial scan shows behavioral patterns and use of language reminiscent of the troll operations run from Russia in 2014 through 2017."
Russia has denied planning a major cyberattack that would disrupt soccer's Champions League final this weekend. Ukraine's SBU security service said on Wednesday that malware infecting hundreds of thousands of routers was the work of Russian hackers preparing for an assault on the country. The attackers were accused of targeting Saturday's match in Kiev. According to Reuters, the Kremlin has strongly denied these accusations. The malware reportedly bears similarities to code used in previous cyberattacks that the US government linked to Russia.