The UK’s intelligence services and their allies in NATO have accused Russian military hackers from the GRU-linked group APT 28 (also known as Fancy Bear) of orchestrating a large-scale cyber operation to monitor Western aid deliveries to Ukraine, according to a report by The Guardian.
The report cited a joint assessment by the UK’s National Cyber Security Centre (NCSC) — which is part of GCHQ — along with U.S. intelligence and various European security agencies.
According to the report, hackers affiliated with Russia’s Main Intelligence Directorate (GRU) gained access to more than 10,000 surveillance cameras located near military facilities, railway hubs, and border crossings.
Approximately 80% of the compromised cameras were located in Ukraine, while the rest were spread across Eastern Europe: 10% in Romania, 4% in Poland, 2.8% in Hungary, and 1.7% in Slovakia. The NCSC emphasized that the cyber campaign was aimed at undermining both military and humanitarian support channels to Kyiv.
Aside from hijacking cameras, APT 28 was also accused of stealing supply chain data, including train schedules, cargo manifests, and internal documents. The group reportedly used phishing emails disguised as pornographic content or official documents to infiltrate secure systems and harvest passwords.
The NCSC called on private companies involved in the delivery of aid to Ukraine to “take immediate action to protect themselves.”
APT 28 operates under the GRU’s 85th Main Special Services Center (Military Unit 26165, based in Moscow) and is made up of career Russian military intelligence officers, according to U.S. intelligence.
The group has previously been accused of hacking the Democratic National Committee and Hillary Clinton’s emails and also of attacking Germany’s Bundestag, the Organisation for the Prohibition of Chemical Weapons (OPCW), and other Western institutions. In 2020, the EU imposed sanctions on GRU chief Igor Kostyukov and subordinates from this unit.
