Russian cyber actors target coronavirus vaccine development

Homeland July 22, 2020

UK security officials have revealed that Russian cyber actors are targeting organisations involved in coronavirus vaccine development.

The National Cyber Security Centre (NCSC), a part of GCHQ, has published an advisory, detailing activity of the threat group known as APT29, which has exploited organisations globally.

The NCSC assesses that APT29, also named “the Dukes” or “Cozy Bear” almost certainly operate as part of Russian intelligence services. This assessment is also supported by partners at the Canadian Communication Security Establishment (CSE), the US Department for Homeland Security (DHS) Cybersecurity Infrastructure Security Agency (CISA) and the National Security Agency (NSA).

APT29’s campaign of malicious activity is ongoing, predominantly against government, diplomatic, think-tank, healthcare and energy targets to steal valuable intellectual property.

NCSC Director of Operations, Paul Chichester, said:“We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic.

“Working with our allies, the NCSC is committed to protecting our most critical assets and our top priority at this time is to protect the health sector.

“We would urge organisations to familiarise themselves with the advice we have published to help defend their networks.”

The NCSC has previously warned that APT groups have been targeting organisations involved in both national and international COVID-19 responses.

Known targets of APT29 include UK, US and Canadian vaccine research and development organisations. The group uses a variety of tools and techniques, including spear-phishing and custom malware known as “WellMess” and “WellMail”.

To learn more about cyber security and how your business can stay protected from threats, visit the Cyber Essentials Online website.

If you would like to join our community and read more articles like this then please click here.

cyber security NCSC Russia