Russian Intelligence Attack on NATO 'Logistics and Technology' Exposed

Newsweek

22-05-2025

Based on facts, either observed and verified firsthand by the reporter, or reported and verified from knowledgeable sources.
Newsweek AI is in beta. Translations may contain inaccuracies—please refer to the original content.
Russia's military intelligence is targeting logistics operations in NATO countries which help Ukraine, according to the UK's National Cyber Security Centre (NSCS).
The NSCS, part of the U.K's GCHQ (Government Communications Headquarters) said that Russia's GRU Unit 26165 is trying to penetrate networks across defense and transport systems both in Ukraine and in several of its allies.
Newsweek has contacted the Russian defense ministry for comment.
Why It Matters
Western leaders have raised the alarm over the cyber warfare that Russian hacker groups have engaged in since the start of Moscow' full-scale invasion of Ukraine.
These include accusations that Russia has conducted cyberattacks against Ukraine and on civilian infrastructure in Europe, and interfered in foreign elections. The NSCS report will reinforce these concerns.
This generic image from 2017 shows a computer exploited by computer hackers.
This generic image from 2017 shows a computer exploited by computer hackers.
Getty Images
What To Know
The NSCS said the U.K. government and its allies had exposed a campaign of "malicious cyber activity" carried out by Russia's GRU military intelligence unit 26165, also known as APT 28, against western logistics entities and technology companies.
The unit, also known as 'Fancy Bear,' has raise the alarm among NATO allies with France accusing the unit in April of carrying out cyberattacks against its government ministries.
The U.K. and partners from ten countries found that it had conducted the operations against both public and private organizations since 2022, the NSCS said in its press release.
These included organizations across the defense sector, IT services, maritime, airports, ports and air traffic management systems and other sectors which help deliver support to Ukraine.
The GRU unit's activity included credential guessing, spear-phishing and exploiting Microsoft Exchange mailbox permissions. Russian intelligence also targeted internet-connected cameras at Ukrainian border crossings and near military installations.
The countries apart from Ukraine which were targeted were Bulgaria, the Czech Republic, France, Germany, Greece, Italy, Moldova, the Netherlands, Poland, Romania, Slovakia and the U.S.
No specific organizations were named and there was no information about whether the unit managed to obtain classified information.
The NCSC called on leaders at technology and logistics firms to recognize the elevated cyber threat and take immediate action to protect themselves.
What People Are Saying
Paul Chichester, NCSC Director of Operations: "This malicious campaign by Russia's military intelligence service presents a serious risk to targeted organizations, including those involved in the delivery of assistance to Ukraine."
Atlantic Council report released May 20: "American and Western policymakers must size up the threat, unpack the complexity of Russia's cyber web, and invest in the right proactive measures to enhance their security and resilience."
What Happens Next
A report by the Atlantic Council released Tuesday concluded that Russia is a persistent and well-resourced cyber threat to the United States and its allies and partners, and the threat Moscow poses will continue to emerge in future.