UK accuses Kremlin of ordering series of 'reckless' cyber-attacks

Foreign Office increases pressure on Russia after Skripal poisoning

The British government has directly accused Russian military intelligence of being behind a spate of “reckless and indiscriminate cyber-attacks” carried out on the orders of Vladimir Putin’s Kremlin, including the hacking in 2016 of the US Democratic National Committee headquarters.

The claim is a precursor to the announcement of further UK intelligence revelations of Russian state involvement in the poisoning in Salisbury of Sergei Skripal, the Russian double agent.

In an unprecedented statement, the foreign secretary, Jeremy Hunt, said the National Cyber Security Centre (NCSC) had found that a number of hackers widely known to have been conducting attacks around the world were covers for the the Russian GRU intelligence service. He added that their attacks had been undertaken with the consent and knowledge of the Kremlin.

The British government claimed the attacks had been conducted “in flagrant violation of international law, had affected citizens in a large number of countries, including Russia, and had cost national economies millions of pounds”.

The Foreign Office attributed six specific attacks to GRU-backed hackers and identified 12 hacking group code names as fronts for the GRU – Fancy Bear, Voodoo Bear, APT28, Sofacy, Pawnstorm, Sednit, CyberCaliphate, Cyber Berku, BlackEnergy Actors, STRONTIUM, Tsar Team and Sandworm.

The assertions by the British government fulfil a pledge made by Theresa May to reveal the full extent of GRU disruption in the wake of the poisoning of Skripal earlier this year. Skripal had himself been a member of the GRU since 1979 before defecting to the British.

The UK government has been unusually aggressive in identifying the two men suspected of travelling to Salisbury to poison Skripal and his daughter, Yulia, as Russian intelligence agents. Official Russian explanations for the two men’s visit to Salisbury have been widely ridiculed, prompting tensions inside the Russian government over the inept handling of the episode.

In its statement, Britain for the first time identified four cyber-attacks as Russian-sourced. They include an October 2017 attack through BadRabbit ransomware that rendered IT inoperable, causing disruption to the Kiev metro, Odessa airport, Russia’s central bank and two Russian media outlets.

Further attacks attributed to Russia for the first time are the 2017 hacking of confidential medical files of international athletes under the control of the World Anti-Doping Agency, attacks on a small, still functioning British-based TV station and finally the 2016 hacking of the Democratic National Committee (DNC), which was used to take thousands of internal party emails published by outlets including WikiLeaks during that year’s US presidential election campaign.

The cyber-attack on the DNC headquarters, critical to the outcome of the 2016 elections, has often been attributed to the Russians, but it is the first time the UK intelligence services have made the claim.

Two other attacks previously attributed to Russia were also highlighted in the UK statement.

In an accompanying statement, Hunt said: “These cyber-attacks serve no legitimate national security interest, instead impacting the ability of people around the world to go about their daily lives free from interference, and even their ability to enjoy sport.

“The GRU’s actions are reckless and indiscriminate: they try to undermine and interfere in elections in other countries; they are even prepared to damage Russian companies and Russian citizens. This pattern of behaviour demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences.”

Prof Malcolm Chalmers of the defence thinktank Rusi said: “Most intelligence services try to gain advantage through stealing the secrets of their adversaries. But the GRU’s activities go well beyond this traditional peacetime espionage role. By launching disruptive operations that threaten life in target societies, they blur the line between war and peace.”

The Foreign Office warning came as the US prepares to offer to mount cyberdefence operations on behalf of the 29-nation Nato defence alliance, an issue on which the UK has been leading. Nato has said it would create a cyberspace operations centre to coordinate Nato’s cyber activities, including by integrating individual nations’ cyber capabilities into alliance operations.

In a speech on Monday night the former UK national security adviser Sir Mark Lyall Grant warned cyber-attacks were now one of the great threats to the survival of liberal world order.

He said 50% of all UK companies had been attacked and as a result were having to invest millions in cybersecurity.

The new allegations are bound to be dismissed as propaganda by Russia, but Lyall Grant claimed Putin would be taken aback by the depth of the exposure of his intelligence service’s actions.


Patrick Wintour Diplomatic editor

The GuardianTramp

Related Content

Article image
String of own goals by Russian spies exposes a strange sloppiness
The secretive, daring GRU seems to have lost its way in the age of internet search

Andrew Roth in Moscow

05, Oct, 2018 @4:00 AM

Article image
Russia accused of cyber-attack on chemical weapons watchdog
Netherlands expelled four GRU officers after alleged attacks on OPCW and UK Foreign Office

Pippa Crerar, Jon Henley and Patrick Wintour

04, Oct, 2018 @2:48 PM

Article image
Jeremy Hunt vows to step up fight against election cyber-attacks
Foreign secretary to call for global action but say there is no proof of interference in UK

Peter Walker Political correspondent

07, Mar, 2019 @12:01 AM

Article image
David Cameron challenges China to be more open about cyber-security

Prime minister seeks talks on 'issue of mutual concern' amid western fears that Beijing is behind most aggressive online attacks

Nicholas Watt in Shanghai

04, Dec, 2013 @12:01 AM

Article image
Nato must defend western democracy against Russian hacking, say Fallon
UK defence secretary accuses Moscow of ‘weaponising misinformation’ to disable democratic machinery

Ewen MacAskill Defence correspondent

03, Feb, 2017 @8:12 AM

Article image
The Cambridge Analytica exposé shows the UK needs better data protection | Liam Byrne
From the savagery in Salisbury to ‘dark social ads’, Russia’s hybrid warfare is here and needs a swift response, says the shadow digital minister, Liam Byrne

Liam Byrne

19, Mar, 2018 @9:47 AM

Article image
Hostile states trying to steal coronavirus research, says UK agency
Experts say Russia, Iran and China likely to be behind cyber-attacks on universities

Jamie Grierson and Hannah Devlin

03, May, 2020 @3:12 PM

Article image
Private sector must join battle against cyber-attacks, says Hammond
National Cyber Security Centre to be formally opened as chancellor warns of sophisticated and severe attacks

14, Feb, 2017 @12:01 AM

Article image
Revealed: UK’s push to strengthen anti-Russia alliance
Exclusive: ministers will use series of summits to pursue containment strategy and urge rethink of diplomatic dialogue

Patrick Wintour Diplomatic editor

03, May, 2018 @2:00 PM

Article image
Major cyber-attack on UK a matter of 'when, not if' – security chief
Exclusive: Ciaran Martin says Britain fortunate so far to avoid major, crippling attack

Ewen MacAskill Defence and intelligence correspondent

23, Jan, 2018 @6:56 AM