UK charities face rising ransomware and phishing threats

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

NCSC reports charities targeted by ransomware, phishing, and business email compromise; offers free defensive guidance and tools.

The UK's National Cyber Security Centre has published a threat report focused on the charity sector, identifying key attack vectors exploited against non-profit organisations. Charities are increasingly targeted because they operate online services and fundraising platforms, making them attractive to financially-motivated attackers. The report documents concrete impacts: a ransomware attack on Edinburgh Festival Fringe Society caused £95,000 in losses, while a business email compromise incident at a West Midlands hospice cost £17,000. Attackers also conduct phishing and impersonation campaigns, masquerading as legitimate charities to solicit donations, particularly during humanitarian crises such as the invasion of Ukraine.

The NCSC identifies phishing, ransomware, business email compromise (BEC), and fake websites as the primary threats. Charities are vulnerable to the same attacks as commercial organisations but may be seen as softer targets with weaker defences. The report provides case studies and recommends baseline protections including user security awareness, email authentication, access controls, and backup strategies. The NCSC offers free resources: the Small Charities Guide, free training, and Active Cyber Defence tools (Web Check, Mail Check, Exercise in a Box). Smaller charities can access subsidised Cyber Essentials certification under a new Funded Cyber Essentials Programme.

title: Shadow Copy Deletion or Recovery Disabling Typical of Ransomware
description: Detects deletion of volume shadow copies via vssadmin or wmic, or disabling
  of Windows recovery via bcdedit. These are common pre-encryption steps in ransomware
  operations. Matches on the tool and argument pattern, not on any specific malware
  family.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or disk maintenance software that purges shadow copies to reclaim space
- Administrators manually resizing or clearing shadow storage
level: high
id: 6516e902-3200-58b0-988d-0aa6e7f8824b
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers

title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Word, Excel, PowerPoint or Outlook spawning command shells, script
  hosts or proxy-execution binaries. This is the typical execution pattern after a
  user opens a malicious phishing attachment.
tags:
- attack.initial-access
- attack.execution
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
  condition: selection
falsepositives:
- Excel or Word macros in finance workflows that legitimately call cmd or PowerShell
- Outlook add-ins that launch helper scripts
level: high
id: 20a962ec-86ed-5d4e-ac20-45f99cb1c983
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers

title: Net Use Mapping to Administrative Shares
description: Detects net.exe or net1.exe mapping a remote administrative share (C$
  or ADMIN$). Attackers use this for lateral movement and to stage ransomware over
  SMB. Needs context because administrators do the same.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_use:
    CommandLine|contains: ' use '
  selection_share:
    CommandLine|contains:
    - \C$
    - \ADMIN$
  condition: selection_img and selection_use and selection_share
falsepositives:
- Administrators mapping admin shares for legitimate remote management
- Software deployment scripts that copy files via ADMIN$
level: medium
id: 1cb2cec2-7491-53b3-b35b-af45ea5ea318
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers

Source reporting: https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers