\n<\/p>\n
Russia\u2019s intelligence service has carried out a yearslong cyberattack campaign against high-profile politicians, civil servants, journalists and others, according to the British government, as part of what it called \u201cunsuccessful attempts to interfere in U.K. political processes.\u201d<\/p>\n
The announcement, part of a joint action with allies including the United States, which announced related indictments and sanctions on Thursday, was intended to sound the alarm that Russia intends to sow chaos and doubt ahead of elections in the United States and Britain.<\/p>\n
Britain\u2019s Foreign Office, in a statement<\/a> released on Thursday, said a group \u201calmost certainly\u201d linked to the Russian intelligence service engaged in sustained cyberespionage operations, including attacks that targeted lawmakers from across the political spectrum using spear-phishing attacks, or malicious emails, beginning as early as 2015.<\/p>\n The group also \u201cselectively leaked and amplified the release of information in line with Russian confrontation goals, including to undermine trust in politics in the U.K. and like-minded states,\u201d the Foreign Office said, drawing from an investigation from Britain\u2019s intelligence agency.<\/p>\n<\/div>\n<\/div>\n Some of that information, including hacked trade documents between Britain and the United States, was leaked ahead of Britain\u2019s general election in 2019.<\/p>\n Universities, journalists, the public sector, charities and other organizations were also targeted, according to the government, which warned that while Russia\u2019s attempts to undermine democracy have been so far unsuccessful, they are likely to continue.<\/p>\n Russia did not immediately respond to the accusations, but it has in the past denied any state-sponsored attacks against other countries or entities.<\/p>\n The British statement also linked a 2018 hack of the Institute for Statecraft, a British research organization focused on disinformation, and a 2021 hack of a founder of that organization, whose account was compromised. \u201cIn both instances documents were subsequently leaked,\u201d the statement said.<\/p>\n The group identified by the British authorities is often known as Star Blizzard, and has a history of conducting \u201chack and leak\u201d campaigns, in which stolen information is then leaked publicly to influence public opinion in a targeted country, Microsoft, which has been tracking the group since 2017, said last year<\/a>.<\/p>\n<\/div>\n<\/div>\n Before starting an attack, the group is known to conduct reconnaissance of the people it is targeting, including identifying contacts from their social networks or \u201csphere of influence,\u201d Microsoft said. Using names collected from that research, the group then creates fake LinkedIn profiles, email addresses and social media accounts to trick their targets into engaging in correspondence. At a certain point, they include an infected file in the communications to get access to the target\u2019s data.<\/p>\n The group\u2019s work did not appear to be directly related to Moscow\u2019s efforts to interfere with 2016 and 2020 U.S. elections, F.B.I. officials said on Thursday, but were part of President Vladimir V. Putin\u2019s broader efforts to undermine confidence in democratic institutions.<\/p>\n The hacks fit a pattern of Russian behavior stretching back more than a decade. Russia-aligned groups have been accused of infiltrating government agencies, multinational corporations and other organizations across the United States and Europe. Mixed with online disinformation campaigns, the incursions have tried to influence elections, conduct espionage and sow social discord among Western democracies.<\/p>\n Even as the United States and European allies have bolstered their cyberdefenses, the attacks disclosed on Thursday show how any protections can be undercut by a simple mistake by an individual who clicks or downloads malicious files. <\/p>\n David Cameron, Britain\u2019s recently appointed foreign secretary who previously served as the country\u2019s prime minister, said in a statement that the attempts by Russia \u201cto interfere in U.K. politics are completely unacceptable and seek to threaten our democratic processes.\u201d<\/p>\n<\/div>\n<\/div>\n \u201cDespite their repeated efforts, they have failed,\u201d he said. \u201cIn sanctioning those responsible and summoning the Russian ambassador today, we are exposing their malign attempts at influence and shining a light on yet another example of how Russia chooses to operate on the global stage.\u201d<\/p>\n In addition to summoning the Russian ambassador to Britain, the British government announced sanctions against two people linked to Star Blizzard. That group, the government said, was \u201calmost certainly subordinate\u201d to Center 18, a unit of the F.S.B., Russia\u2019s Intelligence Services, that it said directed the cyberespionage operations.<\/p>\n The two people named in the sanctions are Ruslan Aleksandrovich Peretyatko, who Britain said is a Russian F.S.B. intelligence officer and a member of Star Blizzard; and Andrey Stanislavovich Korinets, who is also a member of Star Blizzard.<\/p>\n In coordination with the British authorities, U.S. prosecutors unsealed indictments<\/a> against the two men on Thursday, accusing Moscow of engaging in a wide-ranging spearfishing campaign to hack into the accounts of American government officials from 2016 to 2022.<\/p>\n The U.S. attorney in San Francisco, Ismail J. Ramsey, charged both men with conspiracy to commit computer and wire fraud, which carries a maximum penalty of 25 years in prison if they are ever caught, tried or convicted. Officials conceded that was unlikely.<\/p>\n<\/div>\n<\/div>\n He accused the defendants of \u201cattempting to create chaos in democratic processes,\u201d in a statement.<\/p>\n The men were able to \u201ctake valuable intelligence from their victims\u2019 accounts at will, including intelligence related to United States defense, foreign affairs, and security policies, as well as nuclear energy related technology, research, and development,\u201d according to the indictment.<\/p>\n Hacking victims included a former U.S. ambassador; ex-intelligence officials; current and former defense officials, including a retired Air Force general; and current defense contractors, prosecutors said.<\/p>\n It is not clear how damaging the breach was. But prosecutors said the two men succeeded in hacking into the account of an employee of the Energy Department with a goal of stealing information on nuclear energy technology, according to senior federal law enforcement officials.<\/p>\n In addition to the Justice Department\u2019s indictment, the State and Treasury departments have also imposed sanctions on the two men, and the government has also offered a $10 million reward for their capture or new information about co-conspirators.<\/p>\n Britain\u2019s National Cyber Security Center, part of its intelligence service, said that it had issued a new cybersecurity advisory<\/a>, along with Australia, Canada, New Zealand and the United States, and published updated guidance for people at higher risk<\/a> of cyberthreats.<\/p>\n \u201cRussia\u2019s use of cyberoperations to further its attempts at political interference is wholly unacceptable, and we are resolute in calling out this pattern of activity with our partners,\u201d said Paul Chichester, the center\u2019s director of operations, adding that \u201cindividuals and organizations which play an important role in our democracy must bolster their security.\u201d<\/p>\n<\/div>\n<\/div>\n