UK exposes Russian cyber campaign targeting support for Ukraine
UK exposes Russian cyberattack (Illustrative photo: Getty Images)
The UK and its allies have uncovered a large-scale cyberattack by Russian intelligence (GRU) targeting Western companies that support Ukraine. Organizations in the fields of logistics, technology, defense, and humanitarian aid were affected, according to the UK's National Cyber Security Centre.
"A Russian intelligence malicious cyber campaign targeting organizations, including those involved in delivery of foreign assistance to Ukraine, has been revealed," the center stated.
According to the UK, the malicious activity is linked to GRU Unit 26165 and includes:
- credential guessing,
- spear-phishing and exploiting Microsoft Exchange mailbox permissions,
- targeting internet-connected cameras at Ukrainian border crossings and near military installations.
The National Cyber Security Center, a part of Government Communications Headquarters (GCHQ), has urged British organizations to review the threat and take immediate steps to protect themselves.
According to the center, these attacks are taking place as the UK continues to increase pressure on Russian President Vladimir Putin, while Russia's invasion of Ukraine persists.
As previously reported, the Russian attacks targeted organizations involved in:
- coordination,
- transportation and delivery of support to Ukraine,
- defense and IT services,
- naval operations,
- airports,
- ports, and air traffic control systems across multiple NATO member states.
Russia's global influence
Earlier this month, it was reported that the European Union may establish a new independent agency to counter Russian disinformation and election interference. According to Swedish MEP Tomas Tobé, the agency would serve as an independent rapid-response center to Kremlin information attacks.
Last year, the Polish news agency PAP twice published false reports about an alleged "partial mobilization" to send troops to Ukraine.
Polish media and authorities later confirmed that the incident was the result of a cyberattack carried out by Russia.
