UK accuses Russian GRU of carrying out cyberattacks targeting logistics, technology organizations

The United Kingdom has exposed a cyber campaign orchestrated by Russian military intelligence (GRU) targeting Western logistics and technology organizations involved in delivering foreign assistance to Ukraine, the UK's National Cyber Security Centre (NSCS) announced on May 21.

According to a release by the NSCS, GRU Unit 26165, also known as APT 28, has been working to penetrate secure networks in the defence, IT, maritime, airports, ports and air traffic management systems across NATO countries, in an attempt to disrupt the logistics deliveries to Ukraine.

Russian hacker groups have engaged in various forms of cyber warfare throughout the full-scale war, including cyberattacks against Ukraine, hacks of civilian infrastructure in Europe, and interference in foreign elections.

Since 2022, the GRU unit, has been using different tactics, including credential guessing, spear-phishing, and exploiting Microsoft Exchange mailbox permissions, to get access into various secure networks linked to delivering support for Ukraine.

The Russian military intelligence unit would also target internet-connected cameras at Ukrainian border crossings and near military installations, the NCSC said.

"This malicious campaign by Russia’s military intelligence service presents a serious risk to targeted organisations, including those involved in the delivery of assistance to Ukraine," NCSC Director of Operations Paul Chichester said in a statement.

The unit, also known as 'Fancy Bear,' has previously caught the eye of other NATO allies.

On April 29, the French Foreign Ministry accused the unit of escalating cyberattacks against French ministries. France has brought charges against the GRU's APT28 unit — also known as 'Fancy Bear' — based in Rostov-on-Don in southern Russia.

No information was publicly provided as to whether the unit was able to obtain classified information, or what specific organizations were impacted by the breaches.

NATO allies the United States, Germany, Czech Republic, Poland, Australia, Canada, Denmark, Estonia, France and the Netherlands assisted the U.K. in exposing the cyber campaign, the NSCS said.