Russian 'Cozy Bear' hackers are targeting UK organisations working on coronavirus vaccine

The National Cybersecurity Centre (NCSC), together with counterparts in the USA and Canada, said today that hackers known as Cozy Bear, The Dukes, or APT29, had launched attacks to try and steal intellectual property around vaccine and therapeutics development for the pandemic, including information on the supply chain.

It is understood security officials believe this was known about at the highest levels in Russia.

And that the hacks have mainly targeted the pharmaceutical and academic sectors, and have exploited vulnerabilities in security software such as VPNs and external mail servers.

The APT29 group was implicated in the hacks against the Democratic Party in the USA in 2016, and has been tracked for a number of years.

NCSC Director of Operations, Paul Chichester, said: “We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic.

“Working with our allies, the NCSC is committed to protecting our most critical assets and our top priority at this time is to protect the health sector.

“We would urge organisations to familiarise themselves with the advice we have published to help defend their networks.”

It comes after Foreign Secretary Dominic Raab said earlier today the Government was “almost certain that Russian actors sought to interfere in the 2019 General Election” by illicitly obtaining and disseminating a leaked document on the UK/US trade deal.

And also follows the long-awaited forming of the new parliamentary Intelligence and Security Committee (ISC).

At its first meeting today, the ISC agreed that it would publish a long-awaited report into Russian interference in UK politics drawn up by its predecessor committee before the last election before Parliament breaks next week for the summer.

The Prime Minister’s official spokesman dismissed suggestions that the timing of Mr Raab’s statement was intended to pre-empt that report as “nonsense”.

The NCSC has previously warned that APT groups have been targeting organisations involved in both national and international Covid-19 responses.

The Prime Minister’s official spokesman said: “The attacks which are taking place against scientists and others doing vital work to combat coronavirus are despicable. Working with our allies, we will call out those who seek to do us harm in cyber space and hold them to account.”

Mr Raab added: “It is completely unacceptable that the Russian intelligence services are targeting those working to combat the coronavirus pandemic.

“While others pursue their selfish interests with reckless behaviour, the UK and its allies are getting on with the hard work of finding a vaccine and protecting global health.

“The UK will continue to counter those conducting such cyber attacks, and work with our allies to hold perpetrators to account.”