State sponsored hackers from North Korea and other hostile states are using fake identities, manipulated video interviews and stolen passwords to gain access to Western businesses. And thanks to AI, their methods are becoming increasingly sophisticated and difficult to detect, one of the UK’s leading cyber security chiefs has told The European

Cyber criminals are gaining access to company networks by posing as legitimate employees, stealing passwords and exploiting trusted accounts, a leading security expert has warned.

Steve Durbin, chief executive of the Information Security Forum (ISF), said attackers were increasingly using sophisticated deception to gain entry to organisations, sometimes securing jobs under false identities before exploiting their access to sensitive systems.

In an exclusive interview this weekend, he warned that conventional security measures were often ineffective against criminals who had obtained legitimate login credentials.

“Attackers these days don’t tend to break in,” he said. “They log in.”

Durbin highlighted the growing threat from North Korean IT operatives who apply for remote positions using fabricated credentials and manipulated video appearances, potentially securing access to company networks once hired.

“They’re now a trusted insider because you’ve hired them into your organisation,” he said.

The practice has become sufficiently widespread to prompt repeated warnings from the FBI, which reported earlier this month that North Korean operatives were using stolen identities and intermediaries to obtain jobs with Western companies, steal information and extort their employers.

Durbin warned that European businesses employing remote workers were also vulnerable to such tactics, particularly when recruitment and identity checks were conducted entirely online.

Beyond fraudulent recruitment, hackers can gain access to company networks by stealing employee passwords, impersonating legitimate users or exploiting access granted to suppliers, allowing them to move through systems without immediately triggering security alarms.

Once inside, criminals may spend time studying an organisation’s systems, identifying valuable information and disabling backup facilities before launching ransomware attacks or demanding payment to prevent stolen material being published.

AI is making these methods easier and cheaper to deploy, Durbin warned, with criminals increasingly able to purchase ready-made tools for generating convincing fraudulent emails, cloning voices and distributing malicious software.

The consequences, he said, could be particularly serious for organisations responsible for Britain’s electricity, water, healthcare and transport networks.

Durbin identified three factors making critical infrastructure especially vulnerable – outdated systems connected to the internet, the pressure to restore essential services quickly, and hostile governments using criminal groups to conduct attacks on their behalf.

“Nobody wants to be without electricity. Nobody wants to be without water. Nobody wants to be just about to be wheeled into an operating theatre to find that all the systems go down,” he said.

The National Cyber Security Centre (NCSC) handled more than 200 incidents affecting Britain’s critical national infrastructure and its supporting organisations in the year to May 2026, with around three-quarters believed to be linked to hostile state actors.

Speaking to The European’s Juliette Foster, Durbin cited a UK government worst-case assessment suggesting that recovery from a serious cyber attack on the water sector could take several months.

He also described a manufacturer whose factories were brought to a halt after criminals disabled its corporate IT network, despite leaving the factories’ own systems untouched.

His warnings followed widespread precautionary website shutdowns last week after two critical vulnerabilities were discovered in PHP, a programming language used extensively across the internet.

Government bodies, businesses and healthcare organisations were among those affected as security authorities warned that attackers could exploit the flaws to gain unauthorised access to vulnerable systems. Emergency software updates were subsequently released to address the weaknesses.

Durbin said organisations are now spending too much on preventing attacks and too little on preparing for the consequences when their defences failed.

He called for closer cooperation between government and privately owned infrastructure providers, arguing that public-sector procurement and regulation often struggled to keep pace with rapidly developing cyber threats.

And he urged company directors to understand the risks associated with new technologies before committing substantial sums to AI projects, particularly during difficult economic conditions.

“They’re using AI just like we are. And it’s the as a service piece that really worries me the most because that removes the need for the attacker to be hugely sophisticated,” he added.

Watch the full interview with Steve Durbin, chief executive of the Information Security Forum, on The European’s YouTube channel.

VIEW MORE: Hackers exploiting wars ‘to develop cyberattacks in minutes’. Cybercriminals are using AI and global political turmoil to develop new attacks faster than businesses can defend themselves, with smaller firms increasingly vulnerable to becoming gateways into major organisations, cybersecurity expert Isabelle Meyer has warned.

Do you have news to share or expertise to contribute? The European welcomes insights from business leaders and sector specialists. Get in touch with our editorial team to find out more.

_{Main image: Steve Durbin, chief executive of the Information Security Forum, discusses the growing cyber threat to Britain’s essential services. Credit: The European}