Russian military intelligence services tried to hack the Foreign Office, government chemical weapons laboratory Porton Down, and the Organisation for the Prohibition of Chemical Weapons in the wake of the Skripal poisoning, UK officials have said.
An attempt to hack the Foreign Office was carried out in March by the military intelligence unit GRU, while Porton Down was targeted in April and the OPCW in May, officials said.
All of the incidents took place after former Russian spy Sergei Skripal and his daughter, Yulia, were poisoned with military-grade nerve agent Novichok in Salisbury on March 4.
The remote attacks were carried out in addition to an attempted cyberattack against the OPCW in the Hague on April 13, which British and Dutch authorities disclosed on Thursday. Four GRU operatives were escorted out of the Netherlands on the same day.
Dutch authorities have identified these four men as Russian agents involved in close-proximity cyber operations including against the OPCW in The Hague: https://t.co/Nhr8UcWB7m
“On 13th April this year MIVD [Dutch Military Intelligence and Security Service] carried out an operation to disrupt a GRU operation targeting the Organisation for the Prohibition of Chemical Weapons, [in] the Hague,” Dutch defence minister Ank Bijleveld said at a joint press conference of the British and Dutch defence ministries.
Peter Wilson, the UK ambassador to the Netherlands, said the April 13 attack was attempted as the OPCW was working to verify the UK’s analysis of the substance used in the attack on the Skripals.
“This operation in the Hague by the GRU was not an isolated act,” he said. “The unit involved, known in the Russian military as Unit 26165, has sent officers around the world to conduct brazen close-access cyber operations.”
He said the GRU had operated under the hacker pseudonym “Sandworm” to carry out the attacks.
NATO secretary general Jens Stoltenberg warned Russia to halt its “reckless” behaviour amid a series of global cyberattacks blamed on Moscow.
In a statement issued Thursday during a meeting of NATO defence ministers, Stoltenberg said NATO allies “stand in solidarity with the decision by the Dutch and British governments to call out Russia on its blatant attempts to undermine international law and institutions”.
“Russia must stop its reckless pattern of behaviour, including the use of force against its neighbours, attempted interference in election processes, and widespread disinformation campaigns,” he said.
The 29 allies are discussing cybersecurity at talks in Brussels, with the US, Britain, Denmark and the Netherlands due to announce that they will provide offensive cyber capabilities for use by NATO.
The UK will discuss imposing further sanctions on Russia with its allies, foreign secretary Jeremy Hunt announced.
“We will also be discussing how we need, working with our friends and allies, to counter this pattern of cyberattacks, which is a new type of attack that the whole world is having to deal with,” he said.
In a joint statement with Dutch prime minister Mark Rutte, UK prime minister Theresa May said the attempted attacks demonstrated the GRU’s “disregard for the global values and rules that keep us all safe”.
The operatives intercepted in the Netherlands were named as Aleksei Morenets, Evgenii Serebriakov, Oleg Sotnikov, and Aleksey Minin. They are understood to have travelled on diplomatic passports from Moscow, and were met at the airport by a member of the Russian embassy in the Hague.
Arrived in NL 10 April 2018. Identified as #GRU intelligence officers #Russia
British authorities had said ahead of Thursday’s press conference that the UK and its allies would expose a GRU “campaign” of “indiscriminate and reckless cyber attacks targeting political institutions, businesses, media and sport".
Intelligence collected from a laptop of one of the operatives as part of a Dutch investigation found that it had been active in in Brazil, Malaysia, and Switzerland.
The US Department of Justice is expected to make a statement on the GRU’s operations on Thursday afternoon.
Speaking in Thursday’s press conference, Wilson said that Serebriakov had conducted “malign activity” in Malaysia, where he was part of an operation targeting Malaysian institutions to collect information about the investigation into Malaysia Airlines Flight 17, which was shot down over eastern Ukraine in 2014.
One of the GRU agents had connected to Wi-Fi in the same hotel where a World Anti-Doping Agency conference was taking place in Lausanne, Switzerland, in September 2016, when officials from the International Olympic Committee and the Canadian Centre for Ethics in Sport were targets of a cyberattack.
Tom Tugendhat, chair of the UK’s foreign affairs select committee, blamed the actions of the GRU on “Putin’s corrupt greed”.
The catalogue of evidence shows why the Dutch are excellent partners and that the decades of theft have stripped Russia’s intelligence of the skills they once had. Putin’s corrupt greed has turned the GRU into an amateurish bunch of jokers. https://t.co/n3kQw0BXm6
UK defence secretary Gavin Williamson said Russia was acting in a “reckless and indiscriminate” manner.
“These are not the actions of a great power, these are the actions of a pariah state,” he said. “We will continue working with allies to isolate them and make them understand they cannot continue to conduct themselves in such a way.”
For its part, Russia has angrily denied the UK and Dutch version of events, with Kremlin spokesperson Maria Zakharova telling a press conference: “The vivid imagination of our UK colleagues has no boundaries.
“Who comes up with all this? I’d like to look at these people. ... It’s just undignified of this country, which pretends to play one of the leading roles in the world.”
The UK's "imagination has no boundaries." Russia rejects cyber attack allegations by UK and Dutch authorities, dismissing them as an "infernal perfume mix". Read about how Russian spies targeted Britain's Foreign Office: https://t.co/A36t9vVHi5 https://t.co/4S2RLcxkpe
This is a developing story. Check back for updates.
