Russia accused of cyber-attack on chemical weapons watchdog

Netherlands expelled four GRU officers after alleged attacks on OPCW and UK Foreign Office

A Russian cyber-attack on the headquarters of the international chemical weapons watchdog was disrupted by Dutch military intelligence just weeks after the Salisbury novichok attack, it emerged on Thursday, amid fresh revelations of spying that escalated the diplomatic war between the west and Vladimir Putin.

The incident, which was thwarted with the help of British intelligence officials, came after the Sandworm cybercrime unit of the Russian military intelligence agency GRU had attempted unsuccessfully to hack the UK Foreign Office in March and the Porton Down chemical weapons facility in April.

Jeremy Hunt, the foreign secretary, said on Thursday that Moscow could face further sanctions as a result of an astonishingly detailed evidence trail laid out in the Netherlands, the UK and the US.

Defence secretary Gavin Williamson said Russia was now a “pariah state”, while the Russian foreign ministry dismissed the allegations on Thursday night and claimed the west was gripped by “spy mania”.

Four Russian intelligence officers, believed to have been part of a GRU “cleanup” unit for earlier failed operations, travelled to The Hague on diplomatic passports in April after unsuccessfully launching a remote attack.

At the time, the Organisation for the Prohibition of Chemical Weapons was investigating the attempted assassination of Sergei Skripal and his daughter Yulia in the UK, as well as a chemical weapons attack in Douma, Syria.

The British ambassador to the Netherlands, Peter Wilson, said: “With its aggressive cyber campaigns, we see the GRU trying to clean up Russia’s own mess – be it the doping uncovered by Wada [the World Anti-Doping Agency] or the nerve agent identified by the OPCW.”

The US government announced criminal charges against the intelligence officers for targeting the watchdog, including computer hacking, wire fraud, aggravated identity theft and money laundering to promote Russian interests by nefarious means.

They were also charged, along with three more of their colleagues, with being part of the Fancy Bears group that hacked anti-doping authorities and leaked records of sports stars including Sir Bradley Wiggins and Sir Mo Farah at a time when Russia was facing allegations of state-sponsored cheating.

Passports of four Russians
The passports of the four men apprehended by Dutch authorities. Photograph: Netherlands police

The Russian spies were named by the Dutch authorities as cyber experts Evgenii Serebriakov, 37, and Aleksei Morenets, 41, as well as Oleg Sotnikov, and Alexey Minin, both 46, who provided human intelligence.

They appeared to have made little attempt to hide their presence in the country, arriving together with Russian diplomatic passports at Schiphol airport, where they were captured on CCTV being met by a Russian embassy official. Once through customs and immigration controls, they hired a car and headed for The Hague.

Senior British security officials said they were caught “in flagrante” by Dutch intelligence three days later, on 13 April, sitting in their hire car which was parked close to the OPCW building. They tried – and failed – to destroy their equipment and were immediately put on a plane back to Moscow.

In the back of the vehicle, investigators found a laptop connected to a 4G mobile and a wifi panel antenna, partially hidden under a coat, as well as other specialist hacking equipment. They also recovered €20,000 and US$20,000 in cash, as well as taxi receipts from a GRU facility in Moscow and reconnaissance maps.

Train tickets to Basel were also found, along with evidence of online searches for the Spiez lab, Switzerland’s institute for nuclear, biological and chemical protection which had confirmed the British claim that the Skripals had been exposed to the military-grade nerve agent novichok.

The manager of the Marriott hotel next door to the OPCW headquarters where the four alleged Russian spies were staying said they were seized without force and with “no James Bond involved”. Vincent Pahlplatz told Associated Press the quartet were arrested by Dutch officers in broad daylight as they walked out of a lift.

opcw hq

Senior British security officials said the same GRU “close access” unit had previously travelled to Malaysia to attempt to hack the investigation into Malaysia Airlines flight MH17, which investigators have said was shot down by a Russian military missile, killing all 283 passengers and 15 crew on board.

They said the unit, known in the Russian military as 26165, had also travelled to Switzerland during a Wada conference, at which officials from the International Olympic Committee and the Canadian Centre for Ethics in Sport were the victims of a cyber-attack, as well as to Brazil.

It emerged last month that the Dutch government had expelled Russian spies in April after they were accused of planning to hack into the Spiez laboratory.

In a joint statement on Thursday, the British prime minister, Theresa May, and her Dutch counterpart, Mark Rutte, said: “This attempt to access the secure systems of an international organisation working to rid the world of chemical weapons demonstrates the GRU’s disregard for the global values and rules than keep us all safe.

“Our action today reinforces the clear message from the international community: we will uphold the rules-based international system, and defend international institutions from those that seek to do them harm.”

Last month, May pledged to step up action against Russian intelligence following the Salisbury attack.

Contents of car boot
The boot of a vehicle found outside the Organisation for the Prohibition of Chemical Weapons in The Hague. Photograph: Netherlands defence ministry

In a further blow to the GRU, Bellingcat, the investigative website, revealed that Russia appeared to have inadvertently identified the names and phone numbers of nearly 305 of its agents in its cyber-warfare department.

The names appear on a list of individuals that have access to cars registered to the headquarters of the GRU’s cyber division. Bellingcat said it may constitute “one of the largest mass breaches” of personal data in recent intelligence service history.

Maria Zakharova, the Russian foreign ministry spokeswoman, dismissed the hacking accusations as “big fantasies”. A senior British security official said: “For the GRU to get caught in this way would be considered a pretty bad day.”

The Dutch defence minister, Ank Bijleveld, said Russian diplomats had been summoned to the foreign ministry. She told reporters the decision to publicise the failed attack was a “far-reaching and unusual measure” designed to “send a very strong signal” to the Kremlin that such behaviour would not be tolerated.

Mobile phones and cameras
Mobile phones, cameras and tablets found in the hire car. Photograph: Netherlands defence ministry

The head of Dutch counter-intelligence said analysis of the men’s laptops showed they had links to operations in Switzerland and Malaysia.

A senior British security official, commenting on the possible link to the Skripal investigation, said: “It’s hard to know their full intention as their operation failed. But judging from past form elsewhere, discrediting the investigation could well have been their motivation.”

One of the alleged agents, Serebriakov, was listed on a Moscow amateur football league website as a defender. “Our team is known as the ‘security services’ team. Almost everyone works for an intelligence agency,” a teammate told the Moscow Times. “I personally don’t.”

A man at the Rio Olympics
A picture believed to show one of the men at the Olympic Games in Rio de Janeiro in 2016. Photograph: Netherlands defence ministry

British officials refused to say whether the Russian agents would have been detained if they had been caught undertaking the same activity in the UK, stressing operational decisions were for Dutch authorities.

Asked if the UK undertook the same surveillance methods as Moscow, they added: “British intelligence cannot be put in the same moral and ethical bucket as the Russian security service. They do not have oversight.”

On Thursday Labour leader Jeremy Corbyn said: “The evidence is clearly against Russia on both the Salisbury attack and of course on the latest cyber-attacks so there has to be a confrontation, a diplomatic confrontation, with Russia on this.”

The revelations came hours after the British government directly accused Russian military intelligence of being behind a spate of “reckless and indiscriminate cyber-attacks” carried out on the orders of the Kremlin, including the hacking in 2016 of the US Democratic National Committee headquarters.

A joint statement by Donald Tusk and Jean-Claude Juncker, the presidents of the European council and European commission respectively, along with the EU’s foreign policy chief, Federica Mogherini, said: “We deplore such actions, which undermine international law and international institutions.

“The EU will continue to strengthen the resilience of its institutions and those of its member states, and international partners and organisations in the digital domain.”


Pippa Crerar, Jon Henley and Patrick Wintour

The GuardianTramp

Related Content

Article image
UK accuses Kremlin of ordering series of 'reckless' cyber-attacks
Foreign Office increases pressure on Russia after Skripal poisoning

Patrick Wintour Diplomatic editor

03, Oct, 2018 @11:01 PM

Article image
US and UK blame Russia for 'malicious' cyber-offensive
Security officials issue alert directly blaming Kremlin for attack as US warns Moscow it is ‘pushing back hard’

Ewen MacAskill Defence correspondent

16, Apr, 2018 @6:23 PM

Article image
Major cyber-attack on UK a matter of 'when, not if' – security chief
Exclusive: Ciaran Martin says Britain fortunate so far to avoid major, crippling attack

Ewen MacAskill Defence and intelligence correspondent

23, Jan, 2018 @6:56 AM

Article image
Hostile states pose 'fundamental threat' to Europe, says MI6 chief
Although Alex Younger does not name specific country, he makes clear that Russia is target of his remarks

Ewen MacAskill Defence and intelligence correspondent

08, Dec, 2016 @1:31 PM

Article image
Nato must defend western democracy against Russian hacking, say Fallon
UK defence secretary accuses Moscow of ‘weaponising misinformation’ to disable democratic machinery

Ewen MacAskill Defence correspondent

03, Feb, 2017 @8:12 AM

Article image
How Russian spies bungled cyber-attack on weapons watchdog
The GRU intelligence agency is undoubtedly ambitious but this operation is hardly a triumph

Luke Harding

04, Oct, 2018 @4:13 PM

Article image
The Guardian view on the defence budget: be realistic | Editorial
Editorial: The military has suffered from austerity and the world is a dangerous place, but that doesn’t mean the case for higher defence spending needs no interrogation


27, Jun, 2018 @5:31 PM

Article image
String of own goals by Russian spies exposes a strange sloppiness
The secretive, daring GRU seems to have lost its way in the age of internet search

Andrew Roth in Moscow

05, Oct, 2018 @4:00 AM

Article image
Russia summons Dutch ambassador over hacking revelations
Netherlands exposed Moscow’s attempts to hack into chemical weapons body

Patrick Wintour in London and Andrew Roth in Moscow

08, Oct, 2018 @11:25 AM

Article image
‘Trident is old technology’: the brave new world of cyber warfare
Forget debates about Britain’s nuclear deterrent. New technology means a country can be brought to its knees with the click of a mouse

Julian Borger

16, Jan, 2016 @8:00 AM