Russian Hackers Targeting Ukraine’s War Crimes Probes, Says Ukraine Cyber Defense Chief
KYIV/LONDON (Reuters) – Ukraine’s cyber defense chief, Yurii Shchyhol, has revealed that Russian spies are employing hackers to target computer systems at law enforcement agencies in Ukraine. Their aim is to identify and obtain evidence related to alleged Russian war crimes, according to Shchyhol. The hackers, believed to be working across Russia’s foreign, domestic, and military intelligence agencies, have recently intensified digital intrusion campaigns against the Ukrainian Prosecutor General’s office and departments responsible for documenting war crimes.
“There’s been a change in direction, from a focus on energy facilities towards law enforcement institutions which had previously not been targeted that often,” stated Shchyhol. “This shift, towards the courts, prosecutors and law enforcement units, shows that hackers are gathering evidence about Russian war crimes in Ukraine” with the intention of undermining Ukraine’s investigations, he added.
The upcoming report by the State Service of Special Communications and Information Protection of Ukraine (SSSCIP), set to be released on Monday, will highlight the espionage activity. The report, which Reuters has reviewed, also reveals that the hackers are attempting to gather intelligence on Russian nationals arrested in Ukraine in order to help them avoid prosecution and return them to Russia.
Shchyhol identified the hacking groups as being part of Russia’s GRU and FSB intelligence agencies. However, Russia’s Foreign Ministry and Federal Security Service (FSB) have not yet responded to requests for comment, and Reuters was unable to independently verify the reported hacks.
The SSSCIP’s report noted that cybersecurity incidents documented by the agency rose by 123% in the first half of this year compared to the second half of 2022. Shchyhol stated that Russian hackers primarily target government bodies and attempt to gain access to their email servers, although he provided no further details.
This revelation comes after the International Criminal Court (ICC) based in the Netherlands reported “unusual activity” on its computer network last week. It remains unclear who is behind the hack. In March, the ICC issued an arrest warrant for Russian President Vladimir Putin for alleged illegal deportation of children from Ukraine, a move rejected by the Kremlin.
Ahead of Russia’s invasion of Ukraine in February 2022, Western intelligence agencies had warned of potential cyberattacks that could cause spillover damage on global computer networks. While evidence of spillover remains limited, Russia has frequently utilized hacks alongside its military operations. In April 2022, a Russian intelligence hacking group known as “Sandworm” attempted a destructive cyberattack on Ukraine’s electricity grid, which was successfully thwarted.
According to Shchyhol, his department has evidence of Russian hackers accessing private security cameras in Ukraine to monitor the outcome of long-range missile and drone strikes. He stated, “We have documented several attempts to gain access to video cameras near the facilities they attacked, and to systems that provide information about the stability of the energy network.” Shchyhol also warned that cyber attacks targeting Ukraine’s energy infrastructure are expected to occur again this winter.
Shchyhol emphasized that the cyberwar will continue even after Ukraine achieves victory on the battlefield.
Reporting by Tom Balmforth in Kyiv and James Pearson in London; Editing by Mike Collett-White and Gareth Jones