UK Exposes Russian Cyber Campaign on Ukraine Support and Western Infrastructure
The UK and ten allied nations have jointly exposed a coordinated cyber espionage campaign by Russia’s military intelligence service, targeting logistics and technology organisations crucial to Western support for Ukraine.
The campaign, led by GRU Unit 26165—also known as APT28—has been active since 2022 and poses a serious risk to both public and private sector entities, The Gaze reports, citing UK’s National Cyber Security Center.
According to a newly released advisory by the center, the Russian military unit employed techniques such as credential guessing, spear-phishing, and exploiting Microsoft Exchange mailbox permissions to infiltrate systems.
They also monitored aid shipments by targeting internet-connected cameras at Ukrainian border crossings and military sites.
“These actions show the Kremlin’s continued disregard for international norms,” said Paul Chichester, Director of Operations at the NCSC. “This malicious campaign by Russia’s military intelligence service presents a serious risk to targeted organisations, including those involved in the delivery of assistance to Ukraine.”
The advisory urges UK-based logistics, defence, and tech firms to familiarise themselves with the threat and adopt key mitigation measures, including enhanced monitoring, multi-factor authentication using strong credentials like passkeys, and timely security updates.
Targeted sectors include air traffic management, ports, airports, maritime logistics, and IT services across NATO countries. The campaign’s intent appears to be surveillance, disruption, and intelligence gathering on supply chains supporting Ukraine’s war effort.
The NCSC advisory has been co-signed by cybersecurity agencies from the United States, Germany, France, Poland, Czech Republic, Denmark, Estonia, Canada, Australia, and the Netherlands.
As The Gaze previously reported, the UK government has announced the extension of sanctions against Russia in response to the massive attack on Ukraine on the night of 18 May, during which the Russian army used a record number of attack drones.
Read more on The Gaze: West is Already at War: Hybrid Attacks are Intensifying amid Trump's Flirtation with Putin