Russia accused of trying to disrupt aid to Ukraine by hacking border crossings

A Russian military intelligence unit, GRU Unit 26165 (APT 28/Fancy Bear), is accused by UK intelligence and its allies of hacking into border security cameras and employing phishing tactics since 2022 to spy on and disrupt Western aid flowing into Ukraine. The unit reportedly accessed approximately 10,000 cameras, primarily in Ukraine and surrounding NATO countries, to track the movement of materials, and attempted to gather sensitive shipment information. The UK's National Cyber Security Centre (NCSC) has issued an advisory, urging private companies involved in aid delivery to enhance their cybersecurity measures in response to this ongoing threat.

Analysis

A coordinated advisory from UK intelligence services and allied nations, including the US, France, and Germany, has accused Russia's GRU Unit 26165, also known as APT 28 or Fancy Bear, of conducting an extensive cyber-espionage campaign targeting the flow of Western aid to Ukraine since 2022. The unit allegedly employed multifaceted tactics, including hacking approximately 10,000 security cameras—80% in Ukraine, 10% in Romania, and smaller percentages in Poland, Hungary, and Slovakia—primarily at border crossings, railway stations, and near military installations to monitor material movements. Beyond camera access, which provided 'snapshot' images and utilized legitimate municipal services like traffic cams, the GRU unit is accused of sending spearphishing emails with diverse subjects, including pornography and fake professional information, often from compromised or free webmail accounts in the target's native language, and attempting voice phishing by impersonating IT staff to obtain privileged account access. The objective was reportedly to gather sensitive information on shipments, such as train schedules and shipping manifests, and to disrupt aid delivery. The UK's National Cyber Security Centre (NCSC) has urged private companies involved in aid logistics to take immediate protective measures, including increased monitoring, multi-factor authentication, and prompt security updates, highlighting a serious ongoing risk from this historically active Russian military intelligence unit, previously implicated in the World Anti-Doping Agency leak and the 2016 Democratic National Committee cyber-attack.

Key Decisions for Investors

• Organizations involved in logistics, transportation, and aid delivery, particularly those operating in or supporting Eastern European regions, should immediately review and enhance their cybersecurity postures against sophisticated state-sponsored threats.
• Investors should consider the heightened geopolitical cyber risk environment, which may warrant increased scrutiny of portfolio companies' exposure and resilience to such attacks, potentially favoring investments in cybersecurity solution providers.
• Monitor for further advisories from national cybersecurity agencies, as the tactics and targets of such state-sponsored groups may evolve, impacting a broader range of sectors beyond those directly involved in the current Ukraine aid efforts.