U.S. charges five Russian military members for destructive cyber ops, hack-and-leak campaigns | CyberScoop<\/title> <meta name=\"description\" content=\"The hackers were working with a unit in the Russian Main Intelligence Directorate, according to the DOJ.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"U.S. charges five Russian military members for destructive cyber ops, hack-and-leak campaigns\"> <meta property=\"og:description\" content=\"The hackers were working with a unit in the Russian Main Intelligence Directorate, according to the DOJ.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-09-05T18:26:45+00:00\"> <meta property=\"article:modified_time\" content=\"2024-09-05T18:26:46+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1196\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1721926675g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1725476969g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1724269863g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=ada0ad45b21fc79c6694\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/81666\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.6.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=81666\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fu-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fu-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-81666 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"4.952380952381\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Voting is open for the 2024 CyberScoop 50 awards! <\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/vote\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.72641509434\">\n<div class=\"single-article__header-content\" readability=\"31.178423236515\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/geopolitics\/\"> <span>Geopolitics<\/span> <\/a> <\/li>\n<\/ul>\n<p> The hackers were working with a unit in the Russian Main Intelligence Directorate, according to the DOJ. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"399\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns.jpg?resize=640%2C399&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=300,187 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=768,478 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=1024,638 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=1536,957 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=600,374 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=270,168 270w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=541,337 541w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=1084,675 1084w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-2.jpg?resize=1353,843 1353w\" sizes=\"(max-width: 1084px) 100vw, 1084px\"><figcaption> Cars drive past the headquarters of the Russian General Staff’s Main Intelligence Department (GRU) in Moscow on December 30, 2016. (Photo by NATALIA KOLESNIKOVA\/AFP via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"35.546164199192\"><body readability=\"71.483261802575\"><\/p>\n<p>A notorious Russian military intelligence unit <a href=\"https:\/\/www.nytimes.com\/2019\/10\/08\/world\/europe\/unit-29155-russia-gru.html\">known for poisonings and other physical aspects<\/a> of hybrid warfare has in recent years expanded to include cyber-enabled espionage, sabotage and disruptive actions, law enforcement and cyber officials in the U.S and <a href=\"https:\/\/www.ncsc.gov.uk\/news\/uk-allies-uncover-russian-military-carrying-out-cyber-attacks-digital-sabotage\">U.K.<\/a> said Thursday.<\/p>\n<p>The revelation came as the U.S. Department of Justice announced charges against six hackers working with Unit 29155 of the Russian Main Intelligence Directorate (GRU) with conspiracy to commit computer intrusion and wire fraud conspiracy. Five of the accused are officers in the GRU unit, while the sixth was a <a href=\"https:\/\/cyberscoop.com\/russian-national-indicted-for-role-in-cyberattacks-on-ukraine\/\">civilian already under indictment<\/a> in the U.S. for his alleged role in facilitating disruptive attacks.<\/p>\n<p>The charges come a day after the <a href=\"https:\/\/cyberscoop.com\/doj-russia-interfering-us-elections-2024\/\">U.S. government announced sweeping action<\/a> against alleged Russian efforts to interfere in the 2024 U.S. elections, including seizing domains and indicting two Russians working for Russia Today. Kostiantyn Kalashnikov and Elena Afanasyeva are accused of funneling $10 million into a U.S. company to covertly push Russian narratives.<\/p>\n<p>The charges announced Thursday stem from the group\u2019s alleged role in hack-and-leak and disruptive operations \u2014 including malware designed to look like ransomware \u2014 across dozens of countries dating back to 2020, according to <a href=\"https:\/\/www.justice.gov\/d9\/2024-09\/stigal_et_al._superseding_indictment.pdf\">an indictment unsealed Thursday<\/a>. On Jan. 13, 2022, the group attacked at least two dozen Ukrainian government networks using malware known as <a href=\"https:\/\/cyberscoop.com\/tag\/whispergate\/\">WhisperGate<\/a>, which was made to look like ransomware but was, instead, destructive malware \u201cdesigned to completely destroy the target computer and related data in advance of the Russian invasion of Ukraine,\u201d the <a href=\"https:\/\/www.justice.gov\/opa\/pr\/five-russian-gru-officers-and-one-civilian-charged-conspiring-hack-ukrainian-government\">DOJ said in a statement<\/a>.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The U.S. and a coalition of international partners <a href=\"https:\/\/www.state.gov\/attribution-of-russias-malicious-cyber-activity-against-ukraine\/?\">in May 2022 attributed the destructive activity<\/a> to the Russian government. <\/p>\n<p>In August 2022, the same group hacked transportation infrastructure in an unnamed central European country that was supporting Ukraine, according to the DOJ, and had \u201cprobed\u201d a variety of computer systems associated with 26 NATO member countries searching for potential vulnerabilities. <\/p>\n<p>Between Aug. 5, 2021 and Feb. 3, 2022, the same group had also probed computers belonging to an unnamed U.S. federal government agency in Maryland, according to the indictment.<\/p>\n<p>The defendants charged are Yuriy Denisov, a colonel in the Russian military and commanding officer of Cyber Operations for Unit 29155, and four of his lieutenants: Vladislav Borokov, Denis Denisenko, Dmitriy Goloshubov and Nikolay Korchagin. <\/p>\n<p>A civilian co-conspirator, Amin Stigal, was <a href=\"https:\/\/cyberscoop.com\/russian-national-indicted-for-role-in-cyberattacks-on-ukraine\/\">indicted in June<\/a> for his role in WhisperGate activities, but the superseding indictment announced Thursday added wire fraud conspiracy to his list of charges.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Also on Thursday, the U.S. State Department <a href=\"https:\/\/rewardsforjustice.net\/rewards\/foreign-malicious-cyber-activity-against-u-s-critical-infrastructure\/?\">announced a reward of up to $10 million<\/a> for information on any of the suspects\u2019 locations or cyber activity.<\/p>\n<p>\u201cThey are marked people,\u201d Assistant Attorney General Matthew G. Olsen of the DOJ\u2019s National Security Division told reporters Thursday, speaking about the logic of bringing charges against Russian military officers. \u201cNow we know who they are. There\u2019s a reward on their head, and we\u2019re going to pursue them relentlessly.\u201d<\/p>\n<p>Olsen added that the action sends a broader message to Russian military intelligence and the Russian government: \u201cWe are on to you. We penetrated your systems. \u2026 You better pay attention to the fact that we have gotten to you and we are in your system.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.2465753424658\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/09\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns-1.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>U.S. charges five Russian military members for destructive cyber ops,<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[302,466,270,288,354,2611,2258],"tags":[306,470,276,294,358,2612,2259],"class_list":["post-5158","post","type-post","status-publish","format-standard","hentry","category-geopolitics","category-gru","category-russia","category-threats","category-ukraine","category-unit-29155","category-whispergate","tag-geopolitics","tag-gru","tag-russia","tag-threats","tag-ukraine","tag-unit-29155","tag-whispergate"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/geopolitics\/\" rel=\"category tag\">Geopolitics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/gru\/\" rel=\"category tag\">GRU<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russia\/\" rel=\"category tag\">Russia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine\/\" rel=\"category tag\">Ukraine<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/unit-29155\/\" rel=\"category tag\">Unit 29155<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/whispergate\/\" rel=\"category tag\">WhisperGate<\/a>","tag_info":"WhisperGate","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5158","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=5158"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/5158\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=5158"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=5158"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=5158"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":5158,"date":"2024-09-05T13:26:45","date_gmt":"2024-09-05T18:26:45","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=81666"},"modified":"2024-09-05T13:26:45","modified_gmt":"2024-09-05T18:26:45","slug":"u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/09\/05\/u-s-charges-five-russian-military-members-for-destructive-cyber-ops-hack-and-leak-campaigns\/","title":{"rendered":"U.S. charges five Russian military members for destructive cyber ops, hack-and-leak campaigns"},"content":{"rendered":"