UK warns of rising proxy attacks by hostile foreign states

Hostile foreign states are increasingly using proxies to carry out attacks in Britain, a pattern officials say has sharpened since Russia’s full-scale war in Ukraine. The concern has pushed ministers to tighten the law, closing gaps that have allowed some state-directed activity to fall between espionage, sabotage and terrorism offences.

The warning lands against a security backdrop that counter-terrorism police say has worsened sharply. They have said hostile-state activity in the UK has risen fivefold since the 2018 Salisbury Novichok attack, and in July 2025 they warned that Russia, Iran and China were intensifying “life-threatening operations” on UK soil by using criminals, vulnerable people and even teenagers as proxies. Police said some of those drawn in were in their mid-teens.

The government introduced the National Security (State Threats) Bill in the House of Commons on 9 June 2026. The bill would give the Home Secretary a new power to designate bodies engaged in state threat activity, using a mechanism equivalent to proscription under the Terrorism Act 2000. Ministers said they were bringing in new powers to crack down on organisations carrying out hostile activity on behalf of foreign states, including proxy groups that do their bidding.

Sir Richard Moore has previously said Russia was conducting a “staggeringly reckless campaign” of sabotage in Europe and trying to sow fear about continued support for Ukraine. That assessment aligns with the broader line from British intelligence that Moscow’s campaign is designed not only to cause damage but also to intimidate the UK and its allies into reducing support for Kyiv.

MI5 director general Ken McCallum said in October 2025 that the UK faced fast-rising state threats in a more hostile world, describing the change as one of the biggest shifts in MI5’s mission since 9/11. The picture he sketched was echoed by counter-terrorism police, who have focused increasingly on the use of third parties, recruited online or in criminal networks, to carry out low-level but high-impact acts of intimidation, sabotage and surveillance.

For the UK, the new bill is meant to bring those activities into clearer legal reach. For Moscow and other hostile states, the model appears to be simple: stay below the threshold of open conflict, use deniable proxies, and force the target to spend more time, money and attention on defending itself.