Great Britain exposed Russia's cyber campaign against foreign support for Ukraine
The United Kingdom, along with 10 allied countries, has issued a warning about a Russian military intelligence cyber campaign targeting organizations involved in providing foreign aid to Ukraine, according to a statement from the British National Cyber Security Center.
According to the NCSC, the military unit 26165 of the Russian Main Intelligence Directorate has been conducting a malicious cyber campaign against government and private organizations since 2022.
This included attacks on organizations involved in coordinating, transporting, and providing support to Ukraine, as well as organizations in the defense sector, IT services, the maritime sector, airports, ports, and air traffic control systems in many NATO member countries.
Unit 26165, also known as APT 28, was able to gain access to the networks of cyberattack victims, using a combination of methods including credential harvesting, phishing, and exploiting Microsoft Exchange mailbox permissions.
They also attacked internet-connected cameras at Ukrainian border crossings and near military facilities to monitor and track aid deliveries to Ukraine.
The NCSC warning was signed by the United States, Germany, the Czech Republic, Poland, Australia, Canada, Denmark, Estonia, France, and the Netherlands.
Countries have called on organizations that may be at risk to take immediate steps to protect themselves.
- In recent months, Russia has launched two major hacking attacks on Ukraine. First, it managed to delete the Ministry of Justice’s registers and then took down the online systems of Ukrzaliznytsia .
- After that, the National Cybersecurity Coordination Center under the National Security and Defense Council decided that Ukraine needed a unified infrastructure for processing and storing state data.
- On April 26, Ukraine experienced a massive outage of digital services due to problems in one of its data centers. There were problems with the operation of Diya, Nova Poshta, and bank terminals.
- On April 28, Epicenter's online systems were affected by hackers.
