The Foreign Office, the attacks on the 2020 Games were the latest in a campaign of Russian 'malicious activity' against the Olympics and Paralympics
Credit: AFP
The Russian military intelligence unit behind the Novichok attack on Salisbury targeted the summer Olympics before they were cancelled because of the pandemic, British spy chiefs have disclosed.
The GRU launched "cyber reconnaissance" operations on both the 2020 Olympic and Paralympic Games, which had been due to be held in Tokyo. Targets included the Games’ organisers and sponsors.
The public disclosure is designed to cause further embarrassment to Vladimir Putin’s regime as part of a strategy to "call out" illegal Russian cyber hacking. It is also intended to deter the Russians from launching further attacks when the Games finally take place.
Russia is banned from competing at the Olympics under its own national flag because of repeated breaches of doping rules.
Dominic Raab, the Foreign Secretary, said: "The GRU’s actions against the Olympic and Paralympic Games are cynical and reckless. We condemn them in the strongest possible terms. The UK will continue to work with our allies to call out and counter future malicious cyber attacks."
According to the Foreign Office, the attacks on the 2020 Games were the latest in a campaign of Russian "malicious activity" against the Olympics and Paralympics.
In a statement, the UK said it was also "confirming for the first time today the extent of GRU targeting of the 2018 Winter Olympic and Paralympic Games", which took place in Pyeongchang, South Korea.
The Government has identified the GRU cyber unit responsible for the hacking as its Main Centre for Special Technologies (GTsST). It is also known by its field post number, 74455, and has been described by a variety of different names in technology circles including Sandworm, BlackEnergy Group and VoodooBear.
The GRU orchestrated the attempted assassination of Sergei Skripal, a former GRU colonel, in Salisbury in March 2018. Two senior officers travelled to the UK, smuggling in a military grade nerve agent that was then smeared on Colonel Skripal’s front door.
He and his daughter survived the attack, but a British woman, Dawn Sturgess, was killed when she inadvertently picked up discarded nerve agent that had been concealed in a perfume bottle.
The Foreign Office said the GRU’s cyber unit had previously attempted to disguise itself as North Korean and Chinese hackers when it targeted the opening ceremony of the 2018 Winter Games. It went on to target broadcasters, a ski resort, Olympic officials and sponsors of the 2018 Games.
The GRU deployed "data-deletion malware" against the Winter Games IT systems and targeted devices across South Korea.
The National Cyber Security Centre (NCSC), part of GCHQ, has concluded that the incident was intended to sabotage the running of the Winter Olympic and Paralympic Games, as the malware was designed to wipe data from and disable computers and networks.
Administrators worked to isolate the malware and replace the affected computers, preventing potential disruption.
The UK has already acted against the GRU’s destructive cyber unit by working with international partners to impose asset freezes and travel bans against its members through the EU cyber sanctions regime.
An attack designed to sow disruption and chaos
While many Russian hacking attacks are designed to smuggle out information, the hacking of the Olympics in 2018 and 2020 were instead designed to cause disruption and sow chaos inside the organisers of the Games and their sponsors.
Russian government hackers used a specially built malicious piece of software, known as VPNFilter, to infect devices and delete data stored on them. The same malicious software had previously been used when Russian hackers attempted to hack into a chlorine plant in Ukraine in 2018.
The VPNfilter malware is a variant of another type of software, known as BlackEnergy, which Russian hackers used in 2015 to disrupt the Ukrainian energy grid during the depths of winter.
Deleting data stored on servers is a common tactic used by hackers seeking to disrupt a business by removing vital documents. If the organisation did not have regular backups, the files could have been permanently deleted.
However, the Olympic IT teams managed to track down the malicious software and isolate the infected devices before Russian hackers were able to gain access to large parts of the Olympic IT network.
The skilled Russian hacking group also took steps to disguise themselves in 2018 as appearing to be from North Korea and China, a common tactic which involves intentionally reusing the digital fingerprints of other countries to trick cybersecurity experts into believing the hacking attack is coming from somewhere else.
Свежие комментарии