Allied Intelligence — 2026-11-11

UK Defence Cyber Force Deploys Specialist Hunt Teams Abroad to Disrupt Adversary Cyber Operations Before They Reach British Networks

BLUFForward-deploying cyber hunt teams into allied states signals a doctrinal shift toward offensive disruption abroad, but the admitted possibility of existing compromise in MoD networks undercuts the premise that these operations can outpace adversary intrusions.

Major General Mike Fayers, commander of the Defence Cyber and Electromagnetic Force, told The Times that UK military "hunt forces" are being dispatched by land, sea or air to countries across Europe and Asia to search for state and criminal adversaries preparing attacks on British military systems 12. Fayers said deployments occur only with host-nation agreement and that operations often necessitate approval from Defence Secretary Wes Streeting 13. He said AI-driven exploitation has cut vulnerability response windows from a few days to double-digit minutes, and warned that malicious code may already reside inside Ministry of Defence IT systems 1. NationalWorld reported that French Foreign Minister Jean-Noël Barrot attributed the Europe-wide supermarket refrigeration attacks to Iran's Islamic Revolutionary Guard Corps 3; the scale of the UK deployments is not known 1.

Analysis
The UK is shifting military cyber defence from guarding its own networks to operating inside partner states, which commits DCEMF personnel to foreign jurisdictions and ties each operation to ministerial approval. Speed drives the shift: AI-assisted exploitation has cut patch windows from days to double-digit minutes, favouring early detection of adversary staging infrastructure over reactive patching. Fayers' warning that malicious code may already sit in Ministry of Defence systems implies the department cannot rule out compromise at home. The French attribution of the refrigeration attacks to Iran's Revolutionary Guard illustrates the physical-infrastructure threat these teams would pre-empt, though no source links them to that campaign. The announcement may instead be mainly signalling to support defence budgets and deter adversaries, describing small, long-standing allied cooperation in more dramatic terms. Confidence is low: the account is a single Times interview relayed by secondary outlets, with no public detail on deployment size, host countries or results.
4 sources
  1. UK military 'hunt forces' look to track down cyber criminals in real world - ITPro
  2. UK military deploys cyber hunt forces to track adversaries overseas - SC Media
  3. France blames Iran for fridge hacks as Britain deploys teams to stop cyber attacks - NationalWorld
  4. France accuses Iran of being behind Europe-wide hacks on fridges - The National

View in full brief →

UNCLASSIFIED // OPEN SOURCE