Russian hackers are seeking to target western countries supporting Ukraine in its efforts to resist Moscow’s invasion, the head of GCHQ has said.
Jeremy Fleming, the director of the British spy agency, said in a speech on Tuesday morning that while fears of a fully fledged online war between Russia and Ukraine had perhaps failed to materialise, there remained “plenty” of cyber activity as part of the conflict.
As well as affecting Ukraine directly, there had been “some spillover of activity affecting other countries”, Fleming said, and evidence that Russian actors were trying to escalate the conflict further afield.
“We’ve seen indications that Russia’s cyber operatives continue to look for targets in countries that oppose their actions,” the GCHQ chief said. “That’s why we have increased our efforts to ensure UK businesses and government urgently improve levels of cyber resilience.”
Fleming did not provide extra evidence, but last month, Britain’s National Cyber Security Agency, an arm of GCHQ, joined forces with its US counterpart, the Cybersecurity and Infrastructure Security Agency, in producing an advisory notice warning against a potential Russian escalation.
At the time they warned there was a risk some Russian criminal hackers “have recently publicly pledged support for the Russian government” and that they could be willing to engage “in retaliation for perceived cyber offensives against the Russian government or the Russian people”.
Russia has been accused of staging more than 200 cyber-attacks on Ukraine since launching its invasion on 24 February, according to an analysis from Microsoft, targeting government agencies and media companies with hacking attempts or destructive malware designed to disable systems.
Fleming said the UK, in conjunction with the US and other allies, was engaged in continuing “to support Ukraine in shoring up their cyber defences” – a recognition that the country is the frontline of what could yet spread into an international cyber conflict.
Last month, Ukraine said Russian hackers had tried to take out the country’s power grid, and came close to cutting off power for about 2 million people using a variant of the Industroyer malware. Although these attacks were aimed at Ukraine, there remains the risk that such malware could spread uncontrolled.
In 2017, Russian state actors launched the NotPetya malware against Ukrainian companies, but it spread indiscriminately around the world, affecting a string of western companies and even some Russian corporations. Western spy agencies have previously said that attack was also conducted by operatives from the GRU, or main intelligence directorate of the Russian army.
Fleming also used his speech to highlight that the National Cyber Force (NCF), a new offensive hacker group, run jointly by GCHQ and the Ministry of Defence, was involved in tackling cybercrime.
“Through the NCF we are actively undermining the cybercriminals’ assumption that they can act with impunity on the internet. We have disrupted criminals, making it clear that they are being observed, and going after their ability to profit from illegal activities,” he said.
The NCF activities have included actions to prevent cybercriminals “from profiting from their crimes” – though it was not spelled out how – and “denying them access to their cyber tools and malware” which are used to carry out attacks.
Later this month, Fleming added, Suella Braverman, the attorney general, would set out further details on how far the NCF can go in its efforts to maintain national security. She would “set out the government’s latest legal views on the responsible use of cyber capabilities”, he said.
