# UK charities face rising ransomware and phishing threats

Published: 2023-01-20 · Severity: routine · Sectors: non-profit
Canonical: https://vorant.io/reports/7acbfd48-fb77-5efd-9086-a5c652969b7d/uk-charities-face-rising-ransomware-and-phishing-threats

> NCSC reports charities targeted by ransomware, phishing, and business email compromise; offers free defensive guidance and tools.

The UK's National Cyber Security Centre has published a threat report focused on the charity sector, identifying key attack vectors exploited against non-profit organisations. Charities are increasingly targeted because they operate online services and fundraising platforms, making them attractive to financially-motivated attackers. The report documents concrete impacts: a ransomware attack on Edinburgh Festival Fringe Society caused £95,000 in losses, while a business email compromise incident at a West Midlands hospice cost £17,000. Attackers also conduct phishing and impersonation campaigns, masquerading as legitimate charities to solicit donations, particularly during humanitarian crises such as the invasion of Ukraine.

The NCSC identifies phishing, ransomware, business email compromise (BEC), and fake websites as the primary threats. Charities are vulnerable to the same attacks as commercial organisations but may be seen as softer targets with weaker defences. The report provides case studies and recommends baseline protections including user security awareness, email authentication, access controls, and backup strategies. The NCSC offers free resources: the Small Charities Guide, free training, and Active Cyber Defence tools (Web Check, Mail Check, Exercise in a Box). Smaller charities can access subsidised Cyber Essentials certification under a new Funded Cyber Essentials Programme.

## Detection guidance (public sample)

### Shadow Copy Deletion or Recovery Disabling Typical of Ransomware

ATT&CK: T1486

Detects vssadmin/wmic shadow copy deletion or bcdedit recovery disabling, a common precursor to ransomware encryption of the kind the NCSC report describes against charities. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Shadow Copy Deletion or Recovery Disabling Typical of Ransomware
description: Detects deletion of volume shadow copies via vssadmin or wmic, or disabling
  of Windows recovery via bcdedit. These are common pre-encryption steps in ransomware
  operations. Matches on the tool and argument pattern, not on any specific malware
  family.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith: \vssadmin.exe
    CommandLine|contains|all:
    - delete
    - shadows
  selection_wmic:
    Image|endswith: \wmic.exe
    CommandLine|contains|all:
    - shadowcopy
    - delete
  selection_bcdedit:
    Image|endswith: \bcdedit.exe
    CommandLine|contains|all:
    - recoveryenabled
    - 'no'
  condition: 1 of selection_*
falsepositives:
- Backup or disk maintenance software that purges shadow copies to reclaim space
- Administrators manually resizing or clearing shadow storage
level: high
id: 6516e902-3200-58b0-988d-0aa6e7f8824b
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers
```

### Office Application Spawning Script Interpreter or LOLBin

ATT&CK: T1566.001

Office applications spawning shells, script hosts or common LOLBins, which is typical of phishing attachment execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or LOLBin
description: Detects Word, Excel, PowerPoint or Outlook spawning command shells, script
  hosts or proxy-execution binaries. This is the typical execution pattern after a
  user opens a malicious phishing attachment.
tags:
- attack.initial-access
- attack.execution
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
  condition: selection
falsepositives:
- Excel or Word macros in finance workflows that legitimately call cmd or PowerShell
- Outlook add-ins that launch helper scripts
level: high
id: 20a962ec-86ed-5d4e-ac20-45f99cb1c983
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers
```

### Net Use Mapping to Administrative Shares

ATT&CK: T1021.002

net.exe mapping a remote C$ or ADMIN$ share, used for SMB lateral movement and ransomware staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Net Use Mapping to Administrative Shares
description: Detects net.exe or net1.exe mapping a remote administrative share (C$
  or ADMIN$). Attackers use this for lateral movement and to stage ransomware over
  SMB. Needs context because administrators do the same.
tags:
- attack.lateral-movement
- attack.t1021.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
    - \net.exe
    - \net1.exe
  selection_use:
    CommandLine|contains: ' use '
  selection_share:
    CommandLine|contains:
    - \C$
    - \ADMIN$
  condition: selection_img and selection_use and selection_share
falsepositives:
- Administrators mapping admin shares for legitimate remote management
- Software deployment scripts that copy files via ADMIN$
level: medium
id: 1cb2cec2-7491-53b3-b35b-af45ea5ea318
status: experimental
author: Vorant
references:
- https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/charities-offered-latest-insight-into-key-cyber-threats-to-help-keep-out-attackers

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7acbfd48-fb77-5efd-9086-a5c652969b7d/uk-charities-face-rising-ransomware-and-phishing-threats.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup