The British government on Thursday accused Russia’s military intelligence agency GRU of “reckless and indiscriminate cyberattacks,” blaming it for everything from the hacking of top athletes’ medical records to disruptions on the Kiev subway system to the theft of emails at the Democratic National Committee.
The accusation was unusually forthright, going further than before in assigning direct blame to the Kremlin for a series of hard-to-trace attacks. It follows the sensational poison attack against ex-spy Sergei Skripal in Salisbury in March, which Britain says was carried out by a pair of GRU agents who used a military-grade nerve agent. Villagers in Russia’s Far East have said they recognize one of Britain’s suspects in the Novichok attack as a hometown hero and a decorated military officer.
“Where Russia acts in an indiscriminate and reckless way, where they have done in terms of these cyberattacks, we will be exposing them,” British Defense Secretary Gavin Williamson said Thursday at a meeting with Defense Secretary Jim Mattis and other NATO defense ministers in Brussels. “We believe that by doing so, this will act as a disincentive for acting in such a way in the future.”
Britain’s Foreign Office said that Russian military intelligence was behind six separate cyberattacks between mid-2015 and October 2017. Four of the attacks were newly attributed on Thursday. Although some were high-profile and obviously political, including the hacking of the Democratic National Committee, others ranged across business and media life.
Britain accused the GRU of hacking email accounts at a “small UK-based TV station,” stealing their contents. It blamed Russia for the theft and subsequent release of confidential athletes’ medical files from the World Anti-Doping Agency. And it said Russia was behind the October 2017 BadRabbit ransomware attack that rendered computer systems inoperable in Ukraine and at the Russian central bank.
The Foreign Office said Russian cyber-assaults were orchestrated by GRU and identified 12 hacking cells serving as fronts for the Russian military, including Fancy Bear, Voodoo Bear, APT28, Sofacy, Pawnstorm, Sednit, CyberCaliphate, Cyber Berku, BlackEnergy Actors, STRONTIUM, Tsar Team and Sandworm.
Moscow dismissed Britain’s allegations as a delusional and a “diabolical perfume blend.”
“They mixed up everything in one bottle, which could be a bottle of Nina Ricci perfume: GRU, cyber spies, Kremlin hackers, and the WADA. This is just a diabolical perfume blend. The imagination of our U.K. colleagues is truly boundless. Who invented the whole thing? I’d like to see them. They’re simply [Hans Christian] Andersens,” Russian Foreign Ministry spokesperson Maria Zakharova said at a press briefing on Thursday.
Sergei Skripal and his adult daughter Yulia were poisoned by Novichok sprayed on their front door, according to the British investigation. They spent weeks in a coma in the hospital before recovering.
Weeks later, a British man named Charlie Rawley was rummaging through a charity shop bin and found a bottle of counterfeit Nina Ricci perfume. The applicator contained Novichok. Rawley gave it his girlfriend, Dawn Sturgess, who sprayed in on her wrists. She quickly sickened and later died in Salisbury hospital. Rawley was also seriously poisoned.
Governments have in the past been cautious about attributing similar attacks, in part because their origin can be notoriously hard to trace and because they do not want to reveal how they have tracked or penetrated the groups. But Britain and its allies have pushed this year for significantly more transparency, particularly after the Skripal attack in March. Skripal was himself a former Russian military intelligence officer turned double-agent.
Russian President Vladimir Putin on Wednesday called Skripal a “traitor” and a “scumbag.” Britain maintains that the use of Novichok and the deployment of senior GRU agents signal that the assassination attempt was directed at the highest levels in the Kremlin.
“The GRU’s actions are reckless and indiscriminate: they try to undermine and interfere in elections in other countries; they are even prepared to damage Russian companies and Russian citizens,” British Foreign Secretary Jeremy Hunt said in a statement. “This pattern of behavior demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences.”
Australian Prime Minister Scott Morrison and Foreign Minister Marise Payne issued a joint statement that Australian intelligence agencies agreed that GRU “is responsible for this pattern of malicious cyber activity.”
The Pentagon on Wednesday announced that it planned to offer its offensive cybercapabilities to the NATO allies for the first time, further expanding the alliance’s role in what is fast becoming a contested virtual battleground. Mattis has been discussing the issue with fellow defense leaders at the Brussels meetings.
Booth reported from London and Anton Troianovski in Moscow contributed to this report.
