Russian hacking operations target Ukrainian law enforcement | CyberScoop<\/title> <meta name=\"description\" content=\"Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Russian hacking operations target Ukrainian law enforcement\"> <meta property=\"og:description\" content=\"Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2023-09-26T16:14:04+00:00\"> <meta property=\"article:modified_time\" content=\"2023-09-26T20:27:09+00:00\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/cdn.parsely.com\">\n<link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-0\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1695397585g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-4\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css?m=1693499496g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1695741454g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=7af46db108fbc62fdcc9\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/77286\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.3.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=77286\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Frussia-hacking-law-enforcement%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Frussia-hacking-law-enforcement%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-77286 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.355291576674\">\n<div class=\"single-article__header-content\" readability=\"30.179487179487\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"416\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement.jpg?resize=640%2C416&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=300,195 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=768,499 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=1024,666 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=1536,998 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=600,390 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=258,168 258w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=518,337 518w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=1038,675 1038w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-2.jpg?resize=1297,843 1297w\" sizes=\"(max-width: 1038px) 100vw, 1038px\"><figcaption> A mural near the Giraffe shopping mall depicting two girls drawing a lightning bolt in the colors of the Ukrainian flag on September 25, 2023 in Bucha, Ukraine. (Photo by Andrii Nesterenko\/Global Images Ukraine via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"49.362702489135\"><body readability=\"99.516856256463\"><\/p>\n<p>Russian military cyber operations in the first half of 2023 focused on targeting Ukrainian law enforcement agencies to gather information about Ukrainian investigations into war crimes and counter-intelligence efforts against Russian spies and collaborators, Ukraine\u2019s top cyber defense organization said in <a href=\"https:\/\/cip.gov.ua\/en\/news\/yak-zminyuyutsya-taktiki-cili-i-spromozhnosti-khakerskikh-grup-uryadu-rf-ta-kontrolovanikh-nim-ugrupovan-zvit\">a report released Monday<\/a>.<\/p>\n<p>The report comes against a backdrop of what officials in Kyiv describe as a move toward intelligence operations in Russian hacking activity. \u201cFrom the beginning of this year we observe a shift in disruptive cyber operations to data collection, cyber intelligence and influence operations,\u201d Victor Zhora, a top Ukrainian cyber defense official, told reporters on Tuesday.<\/p>\n<p>The State Service of Special Communications and Information Protection of Ukraine \u2014 a civilian organization tasked with investigating cyberattacks and defense of critical infrastructure and other government organizations \u2014 said in its report that Russian military commanders are directing cyber units to gather information that includes \u201cevidence, intelligence, and arguments that could be used for criminal proceedings against spies, specific individuals, institutions, or organizations in Russia, potentially leading to sanctions or other actions.\u201d<\/p>\n<p>The cyber operations are also designed to help Russians arrested in Ukraine avoid prosecution and move them back to Russia, the agency said in its report. The report\u2019s release comes on the heels of revelations that the International Criminal Court at The Hague, which investigates and prosecutes war crimes, <a href=\"https:\/\/www.reuters.com\/world\/international-criminal-court-reports-cybersecurity-incident-2023-09-19\/\">had its computer system hacked<\/a> by unknown perpetrators.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Russia appears to be increasingly integrating its cyber operations into its overall war effort, with Russian operations in the first half of 2023 seeking to assess the impact of kinetic military operations, such as missile and drone strikes, according to the SSSCIP.<\/p>\n<p>The organization described a \u201cnotable\u201d trend of Russian-state hackers repeatedly targeting the same organizations, faster data exfiltration in response to improved Ukrainian detection and remediation abilities and persistent attacks on Ukrainian media organizations.<\/p>\n<p>Cyber incidents identified by the SSSCIP rose 123% in the first half of this year compared to the second half of 2022, according to the report. The number of critical incidents, the rate of malware distribution via email and incidents targeting the energy sector are all down significantly, however, likely in part due to improved Ukrainian defenses.<\/p>\n<p>Russian state hackers \u201cappear to be using less sophisticated tactics,\u201d the agency said, as part of a \u201cspray and pray approach, while Ukraine\u2019s defense of its infrastructure has markedly improved compared to six months ago.\u201d Nevertheless, the agency noted, Russian hackers have \u201cstill managed to achieve some success in cases involving attempts at wiping data or other destructive operations.\u201d<\/p>\n<p>In January 2023, for example, the Russian hacktivist persona CyberArmyofRussia Reborn released data purportedly from Ukrinform, a Ukrainian news agency, the report noted. In that case the attackers claimed to have \u201cburned\u201d the organization\u2019s \u201centire network infrastructure.\u201d Ukrainian investigators determined that five strains of wiper malware had been used in the attack and attributed the operation to a group it tracks as UAC-0082, which is known more widely as <a href=\"https:\/\/cyberscoop.com\/tag\/sandworm\/\">Sandworm<\/a> and is believed to be one of the Russian military\u2019s most enduring and impactful hacking units.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>UAC-0010, Ukraine\u2019s designation for another group linked to the Russian Federal Security Service (FSB) and tracked widely as <a href=\"https:\/\/cyberscoop.com\/tag\/gamaredon\/\">Gamaredon<\/a>, exhibited a notable increase in activity over the first half of 2023 compared to the second half of 2022, according to the report. Ukrainian officials attribute the increase to an expansion of manpower, including \u201cthe infusion of new talent from Russia\u2019s abundant pool of skilled individuals, and the mobilization of IT professionals from the private sector to serve in the military.\u201d <\/p>\n<p>The group \u201cdemonstrated an explicit interest\u201d in Ukrainian law enforcement operations, the report said, accounting for roughly 54% of its detected activity. \u201cThis group has a huge human resource and applies primitive methods that nonetheless are quite resultative,\u201d the report notes.<\/p>\n<p>Given the overall targeting patterns and observations over the last six months, Ukrainian officials expect increased attacks on software supply chain developers, a continued and bigger shift to espionage and attempts at avoiding detection, more complex attack chains and continued Russian government encouragement of so-called \u201cpatriotic\u201d hackers \u201cwho could easily become cyber-criminal threat actors\/ransomware operators in the future,\u201d according to the report. <\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.2146017699115\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/10\/russian-hacking-operations-target-ukrainian-law-enforcement-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Russian hacking operations target Ukrainian law enforcement | CyberScoop Skip<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[302,466,270,1031,880,1030,354],"tags":[306,470,276,1033,881,1032,358],"class_list":["post-1826","post","type-post","status-publish","format-standard","hentry","category-geopolitics","category-gru","category-russia","category-russian-spies","category-sandworm","category-ssscip","category-ukraine","tag-geopolitics","tag-gru","tag-russia","tag-russian-spies","tag-sandworm","tag-ssscip","tag-ukraine"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/gru\/\" rel=\"category tag\">GRU<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russia\/\" rel=\"category tag\">Russia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russian-spies\/\" rel=\"category tag\">Russian spies<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/sandworm\/\" rel=\"category tag\">Sandworm<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ssscip\/\" rel=\"category tag\">SSSCIP<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine\/\" rel=\"category tag\">Ukraine<\/a>","tag_info":"Ukraine","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1826","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=1826"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/1826\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=1826"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=1826"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=1826"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":1826,"date":"2023-09-26T16:14:04","date_gmt":"2023-09-26T16:14:04","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=77286"},"modified":"2023-09-26T16:14:04","modified_gmt":"2023-09-26T16:14:04","slug":"russian-hacking-operations-target-ukrainian-law-enforcement","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/09\/26\/russian-hacking-operations-target-ukrainian-law-enforcement\/","title":{"rendered":"Russian hacking operations target Ukrainian law enforcement"},"content":{"rendered":"