Russian intelligence service behind cyber attacks, says UK Foreign Office

Foreign Office says KGB'S successor agency is behind global campaign hitting critical infrastructure

The UK and allies have linked Russia’s Federal Security Service to 'a historic global campaign targeting critical national infrastructure'. EPA

Live updates: follow the latest news on Russia-Ukraine

Russian intelligence services have hit national infrastructure including UK energy companies as well as the engineering and industrial sectors in a “calculated and dangerous” hacking campaign spanning nearly a decade.

The UK and western allies have linked Russia’s Federal Security Service (FSB), the successor agency to the KGB, to “a historic global campaign targeting critical national infrastructure”, the Foreign, Commonwealth and Development Office said on Thursday.

The department said the National Cyber Security Centre was “almost certain” that the FSB’s Centre 16, which it said was also known by its hacker group pseudonyms of Energetic Bear, Berserk Bear and Crouching Yeti, had attacked critical IT systems and national infrastructure in Europe, the Americas and Asia.

“Russia’s targeting of critical national infrastructure is calculated and dangerous,” said Foreign Secretary Liz Truss.

“It shows [Russian President Vladimir] Putin is prepared to risk lives to sow division and confusion among allies.”

It comes as the US Department of Justice unsealed two indictments charging four men, all Russian citizens who worked for the Russian government, in connection with hacking.

In the UK, the Foreign Office said Centre 16 had focused on engineering and industrial control companies, where “hackers may be able to access contact lists of hacked companies and establish long term access to networks”, and had also taken aim at UK energy companies.

It also linked the group to compromising software used by European manufacturers and wind turbine developers, gaining access through spear-phishing to European and North American energy sectors, stealing user information and entering the networks of US energy, nuclear, water, aviation and critical manufacturing sectors.

Spear-phishing is when targeted emails or text messages are sent to specific people, groups or organisations for malicious purposes such as data theft, espionage or fraud.

A firefighter works at a residential district that was damaged by shelling, as Russia's invasion of Ukraine continues, in Kyiv, Ukraine. Reuters

A woman removes pieces of broken glass from a shop window after a bombing in Kyiv, Ukraine. AP

Residents clean the street outside apartments damaged by shelling, in Kyiv, Ukraine. AP

A man walks at a residential district that was damaged by shelling, as Russia's invasion of Ukraine continues, in Kyiv, Ukraine. Reuters

Rescuers work at the site of buildings damaged by shelling, as Russia's invasion of Ukraine continues, in Mykolaiv, Ukraine. Reuters

Launch of missiles by the coastal missile system 'Bastion' on infrastructure facilities of the Armed Forces of Ukraine from an undisclosed position in Crimea. As a result of a strike with long-range precision weapons, an arsenal with weapons and military equipment of Ukrainian troops in the village of Orzhev, 14 kilometres north-west of the city of Rivne, two Tochka-U launchers near Kiev, and eight anti-aircraft missile systems were destroyed. EPA

Pictures lie amidst the rubble of former teacher Natalia's house which was was hit in a military strike, amid Russia's invasion of Ukraine, in Kyiv, Ukraine. Reuters

A Ukrainian serviceman rests at his position in Kharkiv, Ukraine. AP

A hug for a child at the railway station in Przemysl, near the Polish-Ukrainian border, as Ukrainian refugees make their way out of the war zone. AFP

Displaced Ukrainians on a Poland-bound train bid farewell at Lviv, western Ukraine. AP

Ukrainian servicemen rest in Kharkiv. AP

A car wrecked and burnt by shelling in a street in Kharkiv, Ukraine. AP

A member of pro-Russian unit in uniform without insignia handles a mortar round at a weapons depot near Marinka, in the Donetsk region of Ukraine. Reuters

The aftermath of shelling in the eastern Ukrainian city of Kharkiv. EPA

Nurses in tears after Russian shelling of a psychiatric hospital in Mykolaiv, southern Ukraine. AFP

Candles and lights form a giant peace sign during the Avaaz vigil in front of the European Council and Commission buildings in Brussels, Belgium. AP

A wrecked car in a ruined street in Kharkiv, Ukraine. AP

Rescue workers at an industrial building damaged by an air strike in Kyiv, Ukraine. Reuters

The monument to the Duke of Richelieu, one of the founders of the city of Odesa, is covered by sand bags. Near by, a placard shows the building before the Russian invasion. EPA

People clean up a room in an apartment building in Kyiv destroyed in an air raid, as Russia presses on with its invasion of Ukraine. Reuters

An instructor shows citizens how to fire the weapon during a shooting training session in Ivano-Frankivsk, Ukraine. Reuters

Russian troops hurl stun grenades at demonstrators protesting against the invasion, in Kherson, Ukraine. Reuters

Ukrainian servicemen stand guard at a military checkpoint in Kyiv. AFP

Ukrainian refugees Sasha Alexandra and Olena embrace shortly before being allowed to cross into the United States to seek asylum in Tijuana, Mexico. They fled their city of Dnipro this month and travelled to Germany before flying to Mexico. AFP

Ukrainian President Volodymyr Zelenskyy in a broadcast speech in Kyiv, calling on citizens to 'drive the occupiers out'. EPA

An unexploded rocket in a cemetery in Mykolaiv, southern Ukraine. AFP

A portrait of a young woman who died during a Russian attack, next to her fresh grave in the Mykolaiv cemetery. AFP

Tents set up for Ukrainian refugees inside a train station in Bucharest, Romania. AFP

Workers cover a sculpture outside the home of Lviv National Opera to protect it from damage amid fighting in Ukraine. Reuters

Olena, the mother of Denys Snihur, a 25-year-old soldier killed by Russian shelling in the northern town of Ovruch, mourns him at his funeral in Lviv. Reuters

All that is left of a shopping centre after shelling in Kyiv. AP

Civilian volunteers attend a Ukrainian Territorial Defence Forces training camp in Brovary, north-east of Kyiv. AP

Refugees at a temporary accommodation centre in a school gymnasium in Taganrog, Russia. EPA

Oil storage tanks burn in Chernihiv, Ukraine, in a satellite image from Maxar Technologies. EPA

President Joe Biden discusses the US response to Russia's invasion of Ukraine at the Business Roundtable CEO Quarterly Meeting. EPA

The wreck of a Russian military vehicle near Kharkiv. EPA

Firefighters work at the site of a shopping centre bombing in Kyiv. Reuters

Seven-year-old Amellia Anisovych, a refugee from Ukraine, sings the Ukraine national anthem at the start of a fund-raising concert in Lodz, Poland. Amellia became known for singing a song from the film 'Frozen' in a bomb shelter in Kyiv. AP

People queue at the National Stadium in Warsaw to apply for ID numbers that will entitle them to work and receive free health care and education in Poland. AP

Checkout tills are damaged at a supermarket in a shopping centre that was damaged in a bombing in Kyiv. Reuters

Cars are damaged at the site of a bombing at a shopping center in Kyiv. Reuters

A woman comforts a boy while refugees wait for Ukrainian police to check their papers and belongings in Brovary, Ukraine. AP

A refugee family sit in front of a tent at a temporary shelter offered by the Free Christian Church in Uszka, Hungary. Getty Images

Firefighters carry a ladder across the debris following Russian shellings that destroyed the Retroville shopping mall in Kyiv. AFP

A rescuer inside a shopping mall damaged by an airstrike in Kyiv. Reuters

Centre 16 was also understood to have gained access to the email address of opposition leader Alexei Navalny, posing as the Russian Federal Tax Service to conduct spear-phishing against Russian citizens including the press secretary of Kremlin critic and former oligarch Mikhail Khordorkov, who now lives in the UK.

Separately, Ms Truss also added to the UK sanctions list a subsidiary of Russia’s Defence Ministry, the Central Scientific Research Institute of Chemistry and Mechanics, for an incident involving overriding the safety controls of a petrochemicals plant in Saudi Arabia in 2017.

“We are sending a clear message to the Kremlin by sanctioning those who target people, businesses and infrastructure,” Ms Truss said.

“We will not tolerate it.

“We will continue to work together with our allies to turn the ratchet and starve Putin’s war machine of its funding and resources.”

In 2020, the National Cyber Security Centre linked another Russian hacking group, APT29 — also known as Cosy Bear or The Dukes — with going after organisations working on Covid-19 vaccines.

It said the hacking group was “almost certainly” linked to the Russian state.

The FCDO on Thursday said APT29 fell under Russia’s Foreign Intelligence Service, the SVR.

Other groups such as APT28 — also known as Fancy Bear or Strontium — and Sandworm came under Russia’s military intelligence wing, the GRU.

APT28 was thought to be behind the September 2016 cyber attack on the World Anti-Doping Agency, where hackers accessed the personal information of athletes.