Lyce · Hybrid Watch

hw_caa90c3e7c66bde7

Russian hackers have breached cyber security at some of the UK’s most sensitive bases

The Russian hacking group known as Lynx targeted multiple RAF and Royal Navy bases using a “gateway attack” tactic. Some of the affected bases are RAF Lakenheath, where US B61-12 thermonuclear gravity bombs are allegedly stored, RAF Portreath that is a top-secret radar station that forms part of NATO’s air defense network, and RAF Predannack which is a home to the UK’s National Drone Hub. After Lynx infiltrated the bases, they released a cache of sensitive defense documents on the dark web. The attackers state that they extracted roughly 4 terabytes of data.

Occurrence
2025-10-22
Publication
2025-10-22T09:09:06Z
First observed
2026-09-24T06:09:10.079Z
Review status
Not assessed
Countries
GB
Updated
2026-09-27T23:56:59.668Z

E/M/R/S scores

  • EExistence0/4 · Not assessed
  • MIntent0/4 · Not assessed
  • RRussian actor link0/4 · Not assessed
  • SRussian state responsibility0/4 · Not assessed

Facts

No facts

Sources

  1. Role
    discovery_lead
    Date
    2025-10-22T09:09:06Z

    The Russian hacking group known as Lynx targeted multiple RAF and Royal Navy bases using a “gateway attack” tactic. Some of the affected bases are RAF Lakenheath, where US B61-12 thermonuclear gravity bombs are allegedly stored, RAF Portreath that is a top-secret radar station that forms part of NATO’s air defense network, and RAF Predannack which is a home to the UK’s National Drone Hub. After Lynx infiltrated the bases, they released a cache of sensitive defense documents on the dark web. The attackers state that they extracted roughly 4 terabytes of data.