LAHORE MIRROR — Hackers suspected of working for Russia’s foreign intelligence agency targeted dozens of diplomats at embassies in Ukraine with a fake used car advert in a bid to break into their computers, according to a cybersecurity firm report published on Wednesday.
The wide-reaching espionage activity targeted diplomats working in at least 22 of the roughly 80 foreign missions in Ukraine’s capital, Kyiv, analysts at Palo Alto Networks’ Unit 42 research division said in the report.
“The campaign began with an innocuous and legitimate event,” said the report, which was first reported by Reuters.
“In mid-April 2023, a diplomat within the Polish Ministry of Foreign Affairs emailed a legitimate flyer to various embassies advertising the sale of a used BMW 5-series sedan located in Kyiv”.
The Polish diplomat, who declined to be identified citing security concerns, confirmed the role of his advertisement in the digital intrusion.
The hackers, known as APT29 or “Cozy Bear”, intercepted and copied that flyer, embedded it with malicious software, then sent it to dozens of other foreign diplomats working in Kyiv, Unit 42 said.
“This is staggering in scope for what generally are narrowly scoped and clandestine advanced persistent threat (APT) operations,” said the report, using an acronym often used to describe state-backed cyberespionage groups.
In 2021, U.S. and British intelligence agencies identified APT29 as an arm of Russia’s foreign Intelligence Service, the SVR. The SVR did not respond to a request from Reuters for comment about the hacking campaign.
In April, Polish counterintelligence and cybersecurity authorities warned that the same group had conducted a “widespread intelligence campaign” against NATO member states, the European Union, and Africa.
Researchers at Unit 42 were able to tie the fake car advert back to the SVR because the hackers re-used certain tools and techniques which have previously been connected to the spy agency.
“Diplomatic missions will always be a high-value espionage target,” the Unit 42 report said. “Sixteen months into the Russian invasion of Ukraine, intelligence surrounding Ukraine and allied diplomatic efforts are almost certainly a high priority for the Russian government”.
