Cyber Threat Actor: The Scottish Sun

Thethreat actor known by the alias “The Scottish Sun” is associated with the United Kingdom based on the information provided. This alias is the sole identifier used in the available sources, and no alternative names or additional geographic details are given. The actor’s location is explicitly noted as the United Kingdom, which frames the contextual backdrop for its activities. No further biographical or organizational data about the actor is present in the material.

Regarding targeting, the only publicly referenced incident involves a pro‑independence Scottish newspaper, The National, indicating a focus on the media sector within Scotland. The attack resulted in the newspaper’s website being temporarily inaccessible for over an hour, which demonstrates a disruptive objective rather than financial gain or espionage. The disruption of online services is the only strategic aim explicitly evidenced by the reported outcome. No other sectors, regions, or objectives are mentioned in the source material.

The description of the tactics, techniques, and procedures employed by the actor is limited to the observable effect of the incident; the sources do not specify any malware families, initial access vectors, or particular tooling styles used. Consequently, no detailed TTP themes can be asserted beyond the fact that the attack caused a temporary denial of service. Attribution to a state sponsor, criminal consortium, or any other affiliations is not established in the provided information, and the actor’s ties remain unspecified beyond its United Kingdom location. The sole documented operation linked to “The Scottish Sun” is the cyber attack against The National newspaper on March 13 2020, during which the actor’s activity originated from China and led to a brief service outage that was subsequently addressed by the newspaper’s technical team and communicated via social media. This incident represents the entirety of the publicly reported activity available for profiling the actor.