NCSC

The UK National Cyber Security Centre (NCSC) issued three Major advisories in the March–April 2026 window: an attribution-backed advisory on 7 April identifying APT28 as "almost certainly" GRU Unit 26165 behind the SOHO router DNS hijacking campaign ; a CitrixBleed 3 advisory on 25 March warning of active reconnaissance against CVE-2026-3055 ; and a joint advisory with AIVD on 31 March on state-linked QR-code attacks against Signal, WhatsApp and Messenger accounts.

NCSC is the UK's national cybersecurity authority, operating as part of GCHQ. It provides threat advisories, Incident Response support, and guidance to UK industry and government on cybersecurity standards. NCSC's advisory outputs are informed by GCHQ's signals intelligence collection, giving them a higher attribution-confidence basis than purely commercial threat intelligence.

For UK organisations, NCSC advisories carry regulatory weight under the Cyber Security and Resilience Bill framework: NCSC guidance is explicitly treated by the ICO as the Article 32 GDPR technical standard in its Capita and Advanced Computer Software enforcement precedents. Following NCSC guidance is not merely best practice; under the current enforcement template, failing to follow it in a category where it is clear and published constitutes a demonstrable GDPR breach risk.