Russian unit linked to Salisbury poisoning behind cyber attacks, UK says

US authorities also charge five Russians who are part of special forces Unit 29155 with hacking

Russian military hackers linked to the Salisbury poisonings are now accused of conducting widespread cyber attacks against Ukraine and its Nato allies.
The UK’s National Cyber Security Centre (NCSC) along with the US, Ukraine and other allies confirmed on Thursday that the perpetrators belonged to Unit 29155, one of Russia’s most notorious and shadowy special forces units of the Russian military intelligence agency, GRU.
As part of a campaign known as WhisperGate, six hackers are said to have carried out large-scale cyber espionage and sabotage efforts that targeted governments and critical infrastructure organisations around the world.
It is the first time the UK has publicly exposed Unit 29155 as being responsible for malicious cyber activity, which started as far back as 2020, according to the investigation.
Russia-Ukraine war
Unit 29155 has operated for at least a decade lurking in Europe’s shadows, but Western officials only recently discovered its existence and began connecting it to a series of incidents which bore the fingerprints of Russia’s intelligence services.
The unit has since been linked to the poisoning of Sergei Skripal, the former GRU spy who acted as a double agent to the UK, in Salisbury in 2018 with Novichok nerve agent.
The US on Thursday charged five officers of Unit 29155 and one co-conspirator, all of whom are Russian nationals and residents, with conspiracy to commit computer intrusion and wire fraud.
The hackers were identified in a now-unsealed indictment as Col Yuriy Denisov, a commanding officer of cyber operations for Unit 29155 and four lieutenants, Vladislav Borovkov, Denis Denisenko, Dmitriy Goloshubov, Nikolay Korchagin, and civilian Amin Sitgal.
In May 2022, the UK and its allies attributed the use of WhisperGate malware in Ukraine to Russian military intelligence, however until now it had not been linked to Unit 29155, he said.
Paul Chichester, the director of operations at the UK’s NCSC, said: “The exposure of Unit 29155 as a capable cyber actor illustrates the importance that Russian military intelligence places on using cyberspace to pursue its illegal war in Ukraine and other state priorities.
“The UK, alongside our partners, is committed to calling out Russian malicious cyber activity and will continue to do so.”
The US indictment alleges the Russian hackers attempted to hack into and destroy computer systems belonging to the Ukrainian government ahead of the Russian full-scale invasion.
“The defendants did so in order to sow concern among Ukrainian citizens regarding the safety of their government systems and personal data,” the indictment said.
It added that later targets included governments who supported Ukraine, including the US, UK and 24 other Nato countries.
The news comes just one day after the US sanctioned a Russian state media network in a bid to combat the Kremlin’s alleged efforts to meddle in the 2024 presidential elections.