UK and EU slap joint sanctions on ‘cybercriminals’ linked to Russia

The UK and EU have jointly sanctioned alleged hackers linked to Russia as Britain’s cybersecurity service urged critical sectors to strengthen their online defences against the threat from Moscow.

Some 24 individuals and entities said to be behind “destructive” operations, including proxy networks connected to the Russian Intelligence Services, have been targeted by the UK Foreign Office.

The EU said it was imposing restrictive measures on nine individuals and four entities, including GRU officers, self-proclaimed “hacktivists” and cybercriminals, citing “close co-ordination” with the UK.

Both EU member states and the UK have also attributed a cyberattack on Poland’s energy grid in the depths of winter to Russia’s cyber-intelligence unit FSB Centre 16, the Foreign Office said.

Figures and entities targeted by Britain include senior GRU officials Vyacheslav Stafeyev, Ivan Senin and Ivan Kasyanenko, who the Foreign Office said had directed the agency’s cyber and hybrid threat operations.

It comes as the UK National Cyber Security Centre published a new advisory about the methods used by FSB Centre 16 actors, “exploiting vulnerable routers and opportunistically targeting” networks belonging to critical national infrastructure.

The NCSC said Centre 16 had been seen “scanning the internet for devices that still use default or weak Simple Network Management Protocol (SNMP) passwords and community strings.”

Actors have also exploited “well-known vulnerabilities” relating to Cisco devices, Cisco’s Smart Install (SMI) feature and web-portal flaws to gain control of network devices, the NCSC said.

Sectors most at risk of being targeted such as communications, defence, energy, financial services, government and healthcare, are being urged to take action including using SNMPv3 – the most secure version of the SNMP – and disabling legacy versions.

Announcing the sanctions package on Monday, UK Foreign Secretary Yvette Cooper said: “These sanctions strike at the core of the cybercriminal networks propping up the Russian state’s aggression, and the UK and EU are sending a clear message that Russia cannot hide behind its use of these proxy groups.

“From directing criminals to targeting businesses, and striking Poland’s energy grid in the depths of winter, the Russian state is sinking to new lows in its attempts to undermine European security.

“Together with our partners, Britain will continue to call out this behaviour, bolster our resilience and respond to the hybrid threat posed by the Russian state. This will not deter us from supporting Ukraine.”