The UK government has revealed a large-scale Russian cyber campaign aimed at disrupting international aid to Ukraine, marking a significant escalation in the ongoing cyber warfare tied to the conflict. The National Cyber Security Centre (NCSC) reported that the campaign has targeted numerous organizations, both governmental and private, responsible for providing support services to Ukraine since the Russian invasion in 2022.
Working in conjunction with allies including the United States, Germany, and France, the NCSC identified a unit of the Russian military known for its extensive hacking efforts, GRU Unit 26165, commonly referred to as Fancy Bear. This infamous group has a long history of cyber espionage, including past high-profile hacks such as the 2016 intrusion into the US Democratic National Committee.
The joint cyber advisory highlights that Russian operatives have leveraged a range of hacking strategies to infiltrate networks, specifically targeting organizations linked to defense logistics, IT services, and the transport of military aid to Ukraine. A concerning revelation from the report indicates that approximately 10,000 internet-connected cameras, some positioned at Ukraine’s borders and critical infrastructure such as rail stations and military installations, were accessed by hackers to monitor the transit of essential supplies.
Paul Chichester, NCSC’s Director of Operations, emphasized the grave risks posed by these malicious cyber activities aimed at assistance organizations, urging entities involved in logistics to remain vigilant against potential cyber threats. John Hultquist from Google’s Threat Intelligence Group added that these attempts may not only focus on gathering intelligence but also disrupt aid efforts through various means.
The hacking team employed established tactics such as password guessing and spearphishing, where tailored email scams bait specific individuals to compromise their passwords or employ malicious software via fraudulent links. They also exploited a vulnerability within Microsoft Outlook to harvest login information through customized calendar invitation requests.
Cybersecurity experts warn that these tactics have been staples for cybercriminals for over a decade and allow adversaries to monitor the movement of military supplies into Ukraine. Observations from the cyber-security firm Dragos indicated that the attackers' objectives extend beyond mere network infiltration, aiming to penetrate deeper into industrial control systems to obtain sensitive information and prepare for disruptive cyber attacks.
