- Published
- Source
- CyberScotland
- Filed under
- UK attacks, UK industry
- Technique
- T1566 Phishing (opens in a new tab)
Almost half of UK businesses reported cyber security breaches or attacks in the past 12 months, as identified in last year’s UK Government Cyber Security Breaches Survey. Cyber criminals are becoming more sophisticated, relentless and opportunistic. From phishing emails and…
Practical steps for any organisation
- Patch quickly, starting with anything facing the internet.
- Use multi-factor authentication everywhere it is offered.
- Keep tested, offline backups – and a plan for the day you need them.
More helpNCSC: 10 Steps to Cyber Security (opens in a new tab)NCSC: incident management (opens in a new tab)
Defender’s notebook
The attacker technique behind this story, in MITRE’s terms – and what to check in your own estate.
Phishing
Initial AccessWhat a defender checks
- Search mail flow for the sender, subject and links, and pull every copy from mailboxes.
- Check who clicked or replied, and what signed in afterwards.
- Block the sender and URLs, and tell staff what to look for.
Build the skillBlue Team Analyst, Email & Phishing Investigation
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
MyCyberWay training
Blue Team Specialist
Breaches like this get investigated, not just reported.
Blue Team Specialist takes the Analyst curriculum and adds the investigator's work: one incident owned end to end, hypothesis-led threat hunting with MITRE ATT&CK and KQL, breach analysis, and a root cause report people can act on.
- Scope, attacker path and dwell time
- Threat hunting with ATT&CK and KQL
- Root cause analysis and reporting
Headlines and short summaries only, except where a public body publishes under an open licence. Every story links to its publisher, who owns it. MyCyberWay does not edit or endorse third-party reporting.