News / Foreign Policy

Pharmaceutical and research groups allegedly targeted by Moscow backed group known as APT29

Thursday, 16 July 2020 2:10 PM [ Last Update: Thursday, 16 July 2020 2:10 PM ]

The APT29 group has been active for a number of years, and is also known in the hacker community as ‘the Dukes’ or ‘Cozy Bear’. Photograph: John Williams/Alamy Stock Photo

Russian state-sponsored hackers are targeting UK, US and Canadian organisations involved in developing a coronavirus vaccine development, according to British security officials.

The UK’s National Cyber Security Centre said drug companies and research groups were being targeted by a group known as APT29, which it said was “almost certainly” part of the Kremlin’s intelligence services.

British officials would not say if any of the attacks had been successful in their goal of stealing medical secrets – although they stressed that none of the vaccine research had been compromised as a result.

It is rare for the UK to explicitly state that it believes another country is behind a coordinated campaign of cyber-attacks, but British officials indicated it shared its assessment with the United States and Canada, both of whom are expected to release their own updates shortly.

The APT29 group has been active for a number of years, and is also known in the hacker community as “the Dukes” or “Cozy Bear”.

APT29 uses a variety of tools and techniques to try and steal secrets, including using phishing emails and custom malware known as “WellMess” and “WellMail”. Also being targeted are governments, thinktanks and the energy sector.

Paul Chichester, director of operations for NCSC, said: “We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic.”

The organisation is releasing a security advisory to help potentially affected organisations tackle the threat.

(Source: The Guardian)

Press TV’s website can also be accessed at the following alternate addresses:

www.presstv.ir