UK and allies expose Russian cyber attacks on logistics firms aiding Ukraine

The UK and allies from 10 countries have exposed what they say is a campaign of malicious cyber activity by Russia against logistics and tech firms involved in delivering foreign assistance to Ukraine.

The National Cyber Security Centre (NCSC), which is part of GCHQ, said a unit within the Russian intelligence service, GRU, had targeted defence organisations, as well as IT services, maritime, airports, ports and air traffic management systems firms in a range of Nato countries.

The UK, along with the US, Germany, Czech Republic, Poland, Australia, Canada, Denmark, Estonia, France and Netherlands have signed and published an advisory on the issue to raise awareness of the campaign.

The NCSC said the attacks had been targeting both public and private organisations since 2022, and had focussed on those involved in the co-ordination, transport and delivery of support to Ukraine, as well as trying to hack internet-connected cameras at Ukrainian border crossings and near military bases in an effort to track aid shipments.

GRU Unit 26165 – also known as APT 28 – is said to have gained access to some networks using a range of techniques, including guessing log-in credentials and spear-phishing – where specific individuals or organisations are targeted in an effort to gain access to a network.

Paul Chichester, NCSC director of operations, said: “This malicious campaign by Russia’s military intelligence service presents a serious risk to targeted organisations, including those involved in the delivery of assistance to Ukraine.

“The UK and partners are committed to raising awareness of the tactics being deployed.

“We strongly encourage organisations to familiarise themselves with the threat and mitigation advice included in the advisory to help defend their networks.”

Earlier this week, the Government announced 100 new sanctions on Russia, as part of its ongoing support of Ukraine.

The measures are aimed at “ramping up pressure” on Russian President Vladimir Putin’s military, energy exports and information war, the Foreign, Commonwealth and Development Office said.

They will target the supply chains of weapons, including Iskander missiles which have been fired into civilian areas during the war.