Russian intelligence service behind ‘calculated and dangerous’ hacking

Russian intelligence services have targeted national infrastructure including UK energy companies and the engineering and industrial sectors in a “calculated and dangerous” hacking campaign spanning nearly a decade.

The UK and western allies have linked Russia’s Federal Security Service (FSB), the successor agency to the KGB, to “a historic global campaign targeting critical national infrastructure”, the Foreign, Commonwealth and Development Office (FCDO) said on Thursday.

The department said the National Cyber Security Centre (NCSC) was “almost certain” that the FSB’s Centre 16, which it said was also known by its hacker group pseudonyms of Energetic Bear, Berserk Bear and Crouching Yeti, had targeted critical IT systems and national infrastructure in Europe, the Americas and Asia.

Foreign Secretary Liz Truss said: “Russia’s targeting of critical national infrastructure is calculated and dangerous.

“It shows (Vladimir) Putin is prepared to risk lives to sow division and confusion among allies.”

It comes as the US Department of Justice unsealed two indictments charging four defendants, all Russian nationals who worked for the Russian government, in connection with hacking.

In the UK, the FCDO said Centre 16 had focused on engineering and industrial control companies, where “hackers may be able to access contact lists of hacked companies and establish long term access to networks”, and had also targeted UK energy companies.

It also linked the group to compromising software used by European manufacturers and wind turbine developers, gaining access through spear-phishing to European and North American energy sectors, and stealing user information and getting into US energy and nuclear facilities as well as the water, aviation and critical manufacturing sectors.

Spear-phishing is when targeted emails or text messages are sent to specific people, groups or organisations, for malicious purposes such as data theft, espionage, or fraud.

Centre 16 was also understood to have gained access to the email address of opposition leader Alexei Navalny, posing as the Russian Federal Tax Service to conduct spear-phishing against Russian nationals including the press secretary of Kremlin critic and former oligarch Mikhail Khordorkov, who now lives in the UK.

Separately, Ms Truss also added to the UK sanctions list a subsidiary of Russia’s defence ministry, the Central Scientific Research Institute of Chemistry and Mechanics for an incident involving overriding the safety controls of a Saudi petro-chemicals plant in 2017.

Ms Truss said: “We are sending a clear message to the Kremlin by sanctioning those who target people, businesses and infrastructure.

“We will not tolerate it.

“We will continue to work together with our allies to turn the ratchet and starve Putin’s war machine of its funding and resources.”