Exclusive: Russian hackers seek evidence of war crimes, says Ukraine cyber chief

KIEV/LONDON, Sept 22 (Reuters) – Russian spies are using hackers to attack the computer systems of law enforcement agencies in Ukraine in a bid to identify and obtain evidence related to alleged Russian war crimes, he said. Ukraine’s cyber defense chief told Reuters on Friday.

The hackers, working in Russia’s foreign, domestic and military intelligence agencies, have intensified digital intrusion campaigns targeting Ukraine’s Prosecutor General’s office and departments documenting war crimes, said Yurii Shchyhol, head of the State Service for Special Communications and Information Protection of Ukraine (SSSCIP), which is responsible for cyber defense in the besieged country.

“There has been a change in direction, from a focus on energy facilities toward law enforcement institutions that had not previously been targeted as frequently,” Shchyhol said.

“This turn toward courts, prosecutors and law enforcement shows that hackers are gathering evidence about Russian war crimes in Ukraine” with a view to further Ukraine investigations, he added.

The espionage activity will be highlighted in an upcoming SSSCIP report, due to be published on Monday.

The report, a copy of which was reviewed by Reuters, said the hackers were also trying to collect information on Russian citizens arrested in Ukraine, in order to “help these individuals avoid prosecution and transfer them back to Russia.”

“The groups we have identified as involved in this activity are part of the Russian intelligence agencies GRU and FSB,” Shchyhol said.

Russia’s Foreign Ministry and the Federal Security Service (FSB) did not immediately respond to Reuters’ written requests for comment. The Russian military intelligence agency GRU could not be reached for comment.

Shchyhol declined to identify exactly which units had been targeted by the hacking campaign, citing security concerns. The number of cybersecurity incidents documented by the SSSCIP grew by 123% in the first six months of this year compared to the second half of 2022, he added.

Russian hackers have made it a priority to attack government agencies and try to gain access to their email servers, Shchyhol said, without elaborating. Reuters could not independently verify any of the attacks detailed by Shchyhol and the report.

On Tuesday, the International Criminal Court (ICC), based in the Netherlands, said that had detected “unusual activity” on its computer network late last week. As of Friday, it was still unclear who was behind the hack.

The court made headlines in March when issued an arrest warrant for Russian President Vladimir Putin on suspicion of illegally deporting children from Ukraine. The Kremlin rejects the accusations and the jurisdiction of the court.

HYBRID WAR

Ahead of Russia’s invasion of Ukraine in February 2022, Western intelligence agencies warned of possible cyberattacks that could spread elsewhere and cause “collateral” damage to global computer networks.

While there has been little evidence of spillover effects to date, Russia has periodically taken advantage of cyberattacks alongside its military operations.

An attempt by a Russian intelligence hacker group nicknamed “Sandworm” to launch destructive cyberattack against Ukraine’s power grid was foiled in April 2022.

Shchyhol said his department saw evidence that Russian hackers were accessing private security cameras inside Ukraine to monitor the outcome of long-range missile and drone attacks.

“We have documented several attempts to access video cameras near the attacked facilities and systems that provide information on the stability of the energy grid,” he said.

Russia attacked Ukrainian energy infrastructure with a winter air campaign last year that caused major power outages for millions of people. Shchyhol said energy infrastructure was also targeted by cyberattacks and that he expected those attacks to occur again this winter.

“You have to understand that the cyber war will not end even after Ukraine wins on the battlefield,” Shchyhol said.

Our standards: The Thomson Reuters Trust Principles.