This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at https://www.theguardian.com/world/2018/oct/04/netherlands-halted-russian-cyber-attack-on-chemical-weapons-body

The article has changed 11 times. There is an RSS feed of changes available.

Version 4 Version 5
Russia accused of cyber-attack on chemical weapons watchdog Russia accused of cyber-attack on chemical weapons watchdog
(about 2 hours later)
Dutch military intelligence disrupted a Russian cyber-attack on the Organisation for the Prohibition of Chemical Weapons, the Dutch defence minister has said. A Russian cyber-attack on the headquarters of the international chemical weapons watchdog was disrupted by Dutch military intelligence weeks after the Salisbury novichok attack, the Netherlands defence minister has said.
The attack, which was thwarted with the help of British officials, came after the cybercrime unit of the GRU Russian military intelligence directorate had also attempted a remote attack on the Porton Down chemical weapons facility in April and on the UK Foreign Office in March. Both attacks were unsuccessful. The incident, which was thwarted with the help of British officials, came after the Sandworm cybercrime unit of the Russian military intelligence agency GRU attempted unsuccessful spear phishing attacks on the UK Foreign Office in March and the Porton Down chemical weapons facility in April.
The attack on the OPCW is also believed to have been conducted by the GRU, which has been blamed by the British government for the attack on Sergei and Yulia Skripal in Salisbury in March. Four Russian intelligence officers, believed to have been part of a GRU “cleanup” unit for earlier failed operations, travelled to The Hague on diplomatic passports in April after unsuccessfully launching a remote attack.
The Dutch defence minister, Ank Bijleveld, said four intelligence officials from the GRU’s cybercrime unit, known as Sandworm, had been expelled from the Netherlands after being caught spying on the chemical weapons body in April. At the time, the Organisation for the Prohibition of Chemical Weapons was investigating the attempted assassination of Sergei Skripal and his daughter in the UK, as well as a chemical weapons attack in Douma, Syria.
Whitehall officials said that at the time the OPCW had been investigating the attempted assassination of Skripal and his daughter in the UK and a chemical weapons attack in Douma, Syria. The British ambassador to the Netherlands, Peter Wilson, said: “With its aggressive cyber campaigns, we see the GRU trying to clean up Russia’s own mess – be it the doping uncovered by Wada [the World Anti-Doping Agency] or the nerve agent identified by the OPCW.”
Dutch security services caught four GRU operatives “in flagrante” and immediately deported them to Russia, sources said, while retaining their technical equipment. They were caught “in flagrante” by Dutch security services on 13 April and immediately put on a plane back to Moscow. Their hire car was seized and found to contain a significant amount of technical equipment as well as laptops, phones, maps and cash.
The team of four GRU officers travelling on official Russian passports entered the Netherlands on 10 April. On 13 April they parked a car carrying specialist hacking equipment outside the headquarters of the OPCW in The Hague. At that point the Dutch counter-terrorism officers intervened to disrupt the operation and the four GRU officers were ordered to leave the country. Dutch officials also found taxi receipts from a GRU facility in Moscow to the airport and an antenna hidden under a coat, which British intelligence helped establish had been pointed at the OPCW in an attempt to intercept computer logins via the wifi network. Train tickets to Basel were also found, along with evidence of online searches for the Spiez lab, Switerland’s institute for nuclear, biological and chemical protection.
The “close access” hacking attempt, just a month after the Salisbury nerve agent attack, followed an earlier failed “spearphishing” attack on the OPCW headquarters. Authorities in the Netherlands released images of all four men arriving at Schiphol airport, accompanied by a Russian embassy official, as well as their reconnaissance pictures and passport details. All four were named, with two cyber operators identified as Aleksei Sergeyvich and Evgenii Mikhaylovich.
The Dutch authorities released pictures of the Russian agents as they arrived at Schiphol airport. The cyber-experts, who were accompanied by two support operatives, travelled on diplomatic passports with consecutive numbers under the names Aleksei Morenets and Evgenii Serebriakov. They hired a Citroën car and were picked up by the Dutch authorities with all the equipment in the boot. Senior British security officials said the same GRU “close access” unit had previously travelled to Malaysia to attempt to hack the investigation into Malaysia Airlines flight MH17, which investigators have said was shot down by a Russian military missile, killing all 283 passengers and 15 crew on board.
A senior British security official said: “For the GRU to get caught in this way would be considered a pretty bad day.” They said the unit, known in the Russian military as 26165, had also travelled to Switzerland during a Wada conference, at which officials from the International Olympic Committee and the Canadian Centre for Ethics in Sport were the victims of a cyber-attack, as well as to Brazil.
Russian foreign ministry spokeswoman Maria Zakharova dismissed the hacking accusations as “big fantasies”. It emerged last month that the Dutch government had expelled Russian spies in April after they were accused of planning to hack into the Spiez laboratory, which confirmed a British claim that the Skripals had been exposed to the military-grade nerve agent novichok. The laboratory had also been investigating poison gas attacks by the Syrian regime, which is backed by the Kremlin.
The British ambassador to the Netherlands, Peter Wilson, said British intelligence would continue “confronting, exposing and disrupting” Russian cyber-security attacks. In a joint statement, the British prime minister, Theresa May, and her Dutch counterpart, Mark Rutte, said: “This attempt to access the secure systems of an international organisation working to rid the world of chemical weapons demonstrates the GRU’s disregard for the global values and rules than keep us all safe.
He said: “The GRU can only succeed in the shadows. We are all agreed that where we see their malign activities, we must expose it to the light together.” “Our action today reinforces the clear message from the international community: we will uphold the rules-based international system, and defend international institutions from those that seek to do them harm.”
He said that intelligence from the laptops seized from one of the Russian operatives showed that they had previously also launched a cyber-attack during a world anti-doping conference in Lausanne, as well as travelling to Malaysia during the investigation into flight MH17, which international investigators said was shot down by a Russian military missile. Maria Zakharova, the Russian foreign ministry spokeswoman, dismissed the hacking accusations as “big fantasies”.
Wilson said that it was clear that the GRU was attempting to “clean up Russia’s own mess”. He added: “We will shine a light on their actions, we will expose their methods and we will share this with our allies.” A senior British security official said: “For the GRU to get caught in this way would be considered a pretty bad day”.
Senior Whitehall officials said the GRU unit had first attempted to hack into the OPCW remotely with a “spearphishing” attack from Russia, but when that failed it launched a “close access” attack by sending four agents in person to The Hague, where they attempted to access the computer network through wifi. The Dutch defence minister, Ank Bijleveld, said Russian representatives had been summoned to the foreign ministry. She told reporters the decision to publicise the failed attack was a “far-reaching and unusual measure” designed to “send a very strong signal” to the Kremlin that such behaviour would not be tolerated.
When they were caught by the Dutch authorities, they were found with a large amount of cash, technical equipment including multiple phones, and an antenna hidden under a coat. They were assisted by an official from the Russian embassy in the Netherlands. The head of Dutch counter-intelligence, Onno Eichelsheim, said: “We have concluded they targeted the OPCW during the period that the OPCW was occupied with the Skripal investigation, but we have not been able to prove that they targeted the OPCW because of the Skripal investigation.”
A joint statement from the British prime minister, Theresa May, and her Dutch counterpart, Mark Rutte, said: “This attempt to access the secure systems of an international organisation working to rid the world of chemical weapons, demonstrates the GRU’s disregard for the global values and rules that keep us all safe. He said analysis of the men’s laptops showed they also had links to Switzerland and Malaysia.
“The GRU’s reckless operations stretch from destructive cyber-activity to the use of illegal nerve agents, as we saw in Salisbury. That attack left four people fighting for their lives and one woman dead. Commenting on the possible link to the Skripal investigation, a senior British security official said: “It’s hard to know their full intention as their operation failed. But judging from past form elsewhere, discrediting the investigation could well have been their motivation.”
“Our action today reinforces the clear message from the international community. We will uphold the rules-based international system, and defend international institutions from those that seek to do them harm.” The OPCW had confirmed the UK’s analysis that a novichok nerve agent was used in the Salisbury attack, which was carried out by serving GRU officers who also operated under false aliases.
Last month, May pledged to step up action against Russian intelligence in the wake of the Salisbury attack. She told MPs: “We are increasing our understanding of what the GRU is doing in our countries, shining a light on their activities, exposing their methods and sharing them with our allies, just as we have done with Salisbury.” Wilson said British intelligence would continue “confronting, exposing and disrupting” Russian cyber-attacks.
“We will shine a light on their activities, we will expose their methods, and we will share this with our allies. The GRU can only succeed in the shadows. We all agree that where we see their malign activities, we must expose it to together,” he said.
A senior British government official said: “Russian intelligence services are constantly conducting operations to try to penetrate UK government networks. It is a constant and pervasive threat.
“Whenever international institutions investigate activities attributed to the Russian state, such as the work of OPCW or MH17, it seems the GRU pops up. There is a correlation between international investigation of Russian activity and the GRU.”
British officials refused to say whether the Russian agents would have been detained if they had been caught undertaking the same activity in the UK, stressing operational decisions were for Dutch authorities.
Asked if the UK undertook the same surveillance methods as Moscow, British government officials said: “British intelligence cannot to be put in the same moral and ethical bucket as the Russian security service. They do not have oversight.”
Last month, Theresa May pledged to step up action against Russian intelligence following the Salisbury attack.
The British defence secretary, Gavin Williamson, called Russia a “pariah state” and said it would continue to be isolated by the international community.The British defence secretary, Gavin Williamson, called Russia a “pariah state” and said it would continue to be isolated by the international community.
“These are the actions of a state acting in a reckless and indiscriminate manner ... these are not the actions of a great state; these are the actions of a pariah state and we will continue working with allies to isolate them and make them understand they cannot continue to conduct themselves in such a way,” he said. The shadow chancellor, John McDonnell, called for tougher financial penalties against Russia. “If there is hard evidence that we can accuse the Russians of activities in our country which are unacceptable and even criminal, we have to hit them where it hurts, in the pocket.,” he said.
The shadow chancellor, John McDonnell, called for tougher state action against Russian individuals. “If there is hard evidence that we can accuse the Russians of activities in our country which are unacceptable and even criminal, we have to hit them where it hurts: in the pocket. If we use our financial penalties effectively, that’s the way we can end the threats that we have from Russia at the moment.”
The revelations came hours after the British government directly accused Russian military intelligence of being behind a spate of “reckless and indiscriminate cyber-attacks” carried out on the orders of the Kremlin, including the hacking in 2016 of the US Democratic National Committee headquarters.The revelations came hours after the British government directly accused Russian military intelligence of being behind a spate of “reckless and indiscriminate cyber-attacks” carried out on the orders of the Kremlin, including the hacking in 2016 of the US Democratic National Committee headquarters.
In an unprecedented statement, the foreign secretary, Jeremy Hunt, said the National Cyber Security Centre (NCSC) had found that a number of hackers widely known to have been conducting attacks around the world were covers for the the Russian GRU intelligence service. He added that their attacks had been undertaken with the consent and knowledge of the Kremlin. A joint statement by Donald Tusk and Jean-Claude Juncker, the presidents of the European council and European commission respectively, along with the EU’s foreign policy chief, Federica Mogherini, said: “We deplore such actions, which undermine international law and international institutions.
“The EU will continue to strengthen the resilience of its institutions and those of its member states, and international partners and organisations in the digital domain.”
RussiaRussia
CyberwarCyberwar
HackingHacking
EspionageEspionage
NetherlandsNetherlands
InternetInternet
newsnews
Share on FacebookShare on Facebook
Share on TwitterShare on Twitter
Share via EmailShare via Email
Share on LinkedInShare on LinkedIn
Share on PinterestShare on Pinterest
Share on Google+Share on Google+
Share on WhatsAppShare on WhatsApp
Share on MessengerShare on Messenger
Reuse this contentReuse this content