US charges five Russian military hackers with targeting Ukraine’s government with destructive malware

On Thursday, the U.S. Department of Justice accused five members of Russia’s military intelligence agency of hacking several Ukrainian government agencies, an unnamed U.S. government agency in Maryland, and computers belonging to 26 NATO countries, among other victims. 

The DOJ announced the indictment of the five members of Russia’s Main Intelligence Directorate, also known as GRU, and in particular its hacking Unit 29155. The indictment names Russian GRU colonel and commanding officer of cyber operations, Yuriy Denisov; lieutenants Vladislav Borovkov, Denis Denisenko, Dmitriy Goloshubov and Nikolay Korchagin; and a civilian co-conspirator Amin Sitgal, who was previously indicted for some of the same crimes. 

Prosecutors allege that the six indicted individuals were behind the WhisperGate cyberattack, an operation that was designed to appear like a ransomware attack on the Ukrainian government, but was actually a destructive attack that would make the targeted computers unusable. The Russian government has been accused of launching WhisperGate in support of its full-scale invasion of Ukraine in February of 2022. 

According to the indictment, Denisov, Deniskno, Korchagin, Goloshubov, and Borovkov, and other unnamed individuals planned meetings at Cafe Shokoladnitsa in the Sofia Shopping Center in Moscow. The indictment does not explain how the U.S. government was able to get information about these meetings, nor the picture of the suspects, but it suggests the authorities gained significant access to the hackers’ infrastructure. 

“The message is clear. To the GRU and to the Russians: we are onto you, we penetrated your systems. The FBI, the Department of Justice will be relentless in pursuing you, so you better pay attention to the fact that we have gotten to you, and we are in your systems,” Matt Olsen, the U.S. Assistant Attorney General for National Security, said during a press conference announcing the indictments.

The indictment included details about the six Russian’s cyber operations, as well as a group picture of four of the lieutenants, and one of general Denisov.

The six Russians are accused of hacking several government and civilian targets in Ukraine over the last couple of years, including the Ministry of Internal Affairs, State Treasury, Judiciary Administration, several other government departments, and the state-owned Ukrainian railways. 

Around October 2022, the six allegedly hacked what the indictment only described as the transportation infrastructure of “a Central European Country.” As previously reported, the timing of this attack suggests it was the cyberattack against Denmark, which caused delays and outages across the country’s train network, according to the indictment. 

During a press conference, U.S. government representatives declined to specify which U.S. agency based in Maryland was allegedly by the Russian hackers.

Also on Thursday, the FBI, U.S. cybersecurity agency CISA, the U.K’s National Cyber Security Centre, as well as European, Canadian, and Australian government agencies, released a joint cybersecurity advisory with technical details of Unit 29155’s operations. 

The FBI, which dubbed the international effort against the six alleged Russian hackers as Operation Toy Soldier, also published a poster with the hackers’ pictures soliciting tips that could lead to their arrest, and offered a reward of $10 million for each alleged hacker. 

In a post on the official X account for the Rewards for Justice bug bounty program following the indictments, the U.S. government referred to the hackers as having “baby faces.”