Britain accused Russian military intelligence on Thursday of directing a host of cyberattacks aimed at undermining Western democracies by sowing confusion in everything from the 2016 U.S. presidential election to the global chemical weapons watchdog.
In a British assessment based on work by its National Cyber Security Centre (NCSC), Russian military intelligence (GRU) was cast as a pernicious cyber aggressor that used a network of hackers to spread discord across the world.
GRU, Britain said, was almost certainly behind the BadRabbit and World Anti-Doping Agency attacks of 2017, the hack of the Democratic National Committee (DNC) in 2016 and the theft of emails from a U.K.-based TV station in 2015.
This pattern of behaviour demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity.– Jeremy Hunt, British foreign secretary
The Netherlands said it had caught four GRU officers red handed as they tried to hack into the Organisation for the Prohibition of Chemical Weapons from a hotel next door in April.
“The GRU’s actions are reckless and indiscriminate: they try to undermine and interfere in elections in other countries,” said British Foreign Secretary Jeremy Hunt.
“Our message is clear — together with our allies, we will expose and respond to the GRU’s attempts to undermine international stability,” Hunt said. Britain believes the Russian government is responsible for the attacks.
Maria Zakharova, a spokesperson for the Russian Ministry of Foreign Affairs, told a news briefing that the British accusations were the product of someone with a “rich imagination.”
“It’s some kind of a diabolical perfume cocktail [of allegations],” TASS quoted Zakharova as telling reporters.
Though less well known than the Soviet Union’s once mighty KGB, Russia’s military intelligence service played a major role in some of the biggest events of the past century, from the Cuban missile crisis to the annexation of Crimea.
Russian cyberpower?
Though commonly known by the acronym GRU, which stands for the Main Intelligence Directorate, its name was formally changed in 2010 to the Main Directorate of the General Staff (or just GU). Its old acronym, GRU, is still more widely used.
It has agents around the globe, and answers directly to the chief of the general staff and the Russian defence minister. The GRU does not comment publicly on its actions. Its structure, staff numbers and financing are Russian state secrets.
The Main Directorate of the General Staff of the Armed Forces of Russia is also known as the Russian military intelligence service. It is increasingly taking on high-profile, high-risk operations to damage Russia’s enemies. (Pavel Golovkin/Associated Press)
The GRU traces its history back to the times of Ivan the Terrible, though it was founded as the Registration Directorate in 1918 after the Bolshevik Revolution. Vladimir Lenin insisted on its independence from other secret services.
British Prime Minister Theresa May has said GRU officers used a nerve agent to try to kill former double agent Sergei Skripal, who was found unconscious in the English city of Salisbury in March along with his daughter, Yulia. Russia has repeatedly denied the charges.
Sergei Skripal and his daughter Yulia recovered from poisoning after lengthy stays in hospital. (Misha Japaridze/AP; Yulia Skripal/Facebook via AP)
After the Skripal poisoning, the West agreed with Britain’s assessment that Russian military intelligence was to blame and launched the biggest expulsion of Russian spies working under diplomatic cover since the height of the Cold War.
According to a presentation by the head of the Netherlands’ military intelligence agency, four Russians arrived in the Netherlands on April 10 and were caught with spying equipment at a hotel located next to the OPCW headquarters.
At the time, the OPCW was working to verify the identity of the substance used in the Salisbury attack. It was also seeking to verify the identity of a substance used in an attack in Douma, Syria.
Long list of attacks
Russian President Vladimir Putin, a former KGB spy, said on Wednesday that Skripal, a GRU officer who betrayed dozens of agents to Britain’s MI6 foreign spy service, was a “scumbag” who had betrayed Russia.
Britain said the GRU was associated with a host of hackers including APT 28, Fancy Bear, Sofacy, Pawnstorm, Sednit, CyberCaliphate, Cyber Berkut, Voodoo Bear and BlackEnergy Actors.
“This pattern of behaviour demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences,” Hunt said.
The United States sanctioned GRU officers, including its chief, Igor Korobov, in 2016 and 2018 for attempted interference in the 2016 U.S. election and cyberattacks.
Australia and New Zealand backed the United Kingdom’s findings on the GRU.
“Cyberspace is not the Wild West. The International Community — including Russia — has agreed that international law and norms of responsible state behaviour apply in cyberspace,” Australia’s Prime Minister Scott Morrison said.
“By embarking on a pattern of malicious cyber behaviour, Russia has shown a total disregard for the agreements it helped to negotiate,” Morrison said.