WASHINGTON: Western governments on Thursday accused hackers believed to be part of Russian intelligence of trying to steal valuable private information about a coronavirus vaccine, calling out the Kremlin in an unusually detailed public warning to scientists and medical companies.
The alleged culprit is a familiar foe. Intelligence agencies in the United States, United Kingdom and Canada say the hacking group APT29, also known as Cozy Bear, is attacking academic and pharmaceutical research institutions involved in COVID-19 vaccine development. The same group was implicated in the hacking of Democratic email accounts during the 2016 U.S. presidential election.
It was unclear whether any useful information was stolen. But British Foreign Secretary Dominic Raab said, “It is completely unacceptable that the Russian Intelligence Services are targeting those working to combat the coronavirus pandemic.”
He accused Moscow of pursuing “selfish interests with reckless behavior.”
Sticking to more general language, White House press secretary Kayleigh McEnany said, “We worked very closely with our allies to ensure that we would take measures to keep that information safe and we continue do so so.”
The allegation that hackers linked to a foreign government are attempting to siphon secret research during the pandemic is not entirely new. U.S. officials as recently as Thursday have accused China of similar conduct. But the latest warning was startling for the detail it provided, attributing the targeting by name to a particular hacking group and specifying the software vulnerabilities the hackers have been exploiting.
Also, Russian cyberattacks strike a particular nerve in the U.S. given the Kremlin’s sophisticated campaign to influence the 2016 presidential election. And the coordination of the new warning across continents seemed designed to add heft and gravity to the announcement and to prompt the Western targets of the hackers to protect themselves.
“I think (the governments) have very specific intelligence that they can provide,” said John Hultquist, senior director of analysis at Mandiant Threat Intelligence. “The report is full of specific operational information that defenders can use” to protect their networks.
Russian President Vladimir Putin’s spokesman, Dmitry Peskov, rejected the accusations, saying, “We don’t have information about who may have hacked pharmaceutical companies and research centers in Britain.”
“We may say one thing: Russia has nothing to do with those attempts,” Peskov said, according to the state news agency Tass.
The accusations come at a tenuous time for relations between Russia and both the U.S. and U.K.
Besides political ill will, especially among Democrats, about the 2016 election interference, the Trump administration is under pressure to confront Russia over intelligence information that Moscow offered bounties to Taliban fighters to attack allied fighters.
The Democratic chairman of the House Intelligence Committee, Adam Schiff, said “it’s clear that Russia’s malign cyber operations and other destabilizing activities — from financial and other material support to non-state actors in Afghanistan to poisoning dissidents in democratic countries — have persisted, even when exposed.” He urged President Donald Trump to condemn such activities.
The vaccine assessment came two years to the day after Trump met with Putin in Helsinki and appeared to side with Moscow over U.S. intelligence agencies about the election interference. The U.K. did not say whether Putin knew about the more recent research hacking, but British officials believe such intelligence would be highly prized.
Relations between Russia and the U.K., meanwhile, have plummeted since former spy Sergei Skripal and his daughter were poisoned with a Soviet-made nerve agent in the English city of Salisbury in 2018, though they later recovered. Britain blamed Moscow for the attack, which triggered a round of retaliatory diplomatic expulsions between Russia and Western countries.
More broadly, Thursday’s announcement speaks to the cybersecurity vulnerability created by the pandemic and the global race for a vaccine.
The U.S. Department of Homeland Security’s cybersecurity agency warned in April that cybercriminals and other groups were targeting COVID-19 research, noting at the time that the increase in people teleworking because of the pandemic had created potential avenues for hackers to exploit.
Profit-motivated criminals have exploited the situation, and so have foreign governments “who also have their own urgent demands for information about the pandemic and about things like vaccine research,” Tonya Ugoretz, a deputy assistant director in the FBI’s cyber division, said at a cybersecurity conference last month.
“Some of them are using their cyber capabilities to, for example, attempt to break into the networks of those who are conducting this research as well as into nongovernmental organizations to satisfy their own information needs,” Ugoretz said.
The alert did not name the targeted organizations themselves or say how many were affected. But it did say the organizations were in the U.S., U.K. and Canada, and said the goal was to steal information and intellectual property related to vaccine development.
Britain’s NCSC said its assessment was shared by the National Security Agency, the Cybersecurity and Infrastructure Security Agency and by the Canadian Communication Security Establishment.
A 16-page advisory prepared by Western agencies and made public Thursday accuses Cozy Bear of using custom malicious software to target a number of organizations globally. The malware, called WellMess and WellMail, has not previously been associated with the group, the advisory said.
“In recent attacks targeting COVID-19 vaccine research and development, the group conducted basic vulnerability scanning against specific external IP addresses owned by the organizations. The group then deployed public exploits against the vulnerable services identified,” the advisory said.
Cozy Bear is one of two hacking groups suspected of separate break-ins of computer networks of the Democratic National Committee before the 2016 U.S. election. Stolen emails were then published by WikiLeaks in what U.S. intelligence authorities say was an effort to aid Trump’s campaign over Democratic rival Hillary Clinton.
A report on Russian election interference by former special counsel Robert Mueller called out another group, Fancy Bear, in the hack-and-leak operation. Cozy Bear, though, operates “quietly gaining access and gathering intelligence,” said Hultquist of the Mandiant cybersecurity firm.
Their goal, he said, is “good old-fashioned espionage.”
Separately, Thursday, Britain accused “Russian actors” of trying to interfere in December’s U.K. national election by circulating leaked or stolen documents online. Unlike in the vaccine report, the U.K. did not allege that the Russian government was involved in the political meddling.
KATHMANDU: Over 150 vaccines are being developed and tested around the world to stop the COVID-19 pandemic, of which 28 are in human clinical trials, according to the World Health Organization. Meanwhile, Russia has become the first country in the world to grant regulatory approval to a COVID-19 Read More...
KATHMANDU: Nepal’s Health Ministry, in its regular press briefing, shared the latest updates on coronavirus contagion from across the country, and government’s response to the health crisis. As of today, 473,179 tests through Polymerase Chain Reaction (PCR) method have been carried out wh Read More...
KATHMANDU: Nepal has logged eight more Covid-19 related fatalities in the last 24 hours. This is the highest single day death-toll from the coronavirus infection recorded so far. Spokesperson at Ministry of Health and Population, Dr Jageshwar Gautam, informed public about the eight cases of fatal Read More...
At least 20,414,289 people have been reported to be infected by the novel coronavirus globally and 742,207 people have died, a Reuters tally showed. Infections have been reported in more than 210 countries and territories since the first cases were identified in China in December 2019. Read More...
COVID-19 Global Lens The COVID-19 pandemic presents the world with a huge challenge: everyone and every area is affected, and the response has to be both quick and consorted. This pandemic may be primarily a health crisis for some states, but COVID-19 is also an education crisis, an employment an Read More...
KATHMANDU: Kathmandu valley, yet again, recorded the highest single-day Covid-19 cases on Wednesday with 109 new cases in Kathmandu district, 21 in Lalitpur, and eight in Bhaktapur. A total of 138 new infections were reported today from inside the valley. With today’s additions, active case Read More...
DHADING: A prohibitory order has been decreed in Dhading's headquarters Dhadingbesi and its peripheral areas with the increase in COVID-19 transmission, since Wednesday. In an attempt to curb further potential spread of the highly contagious infection, the District Administration Office took a de Read More...
KATHMANDU: Bollywood actor Sanjay Dutt, who was rushed to hospital in Mumbai after complaining of chest discomfort and breathlessness, has been diagnosed with lung cancer. The news was confirmed by Bollywood's trade analyst and film industry insider Komal Nahta on August 11 night, according to I Read More...