Liam Fox is latest in long line of victims duped by Russia's GRU
Liam Fox, the former UK trade secretary, is merely the latest in a long line of victims apparently duped by the GRU, Russia’s military intelligence agency.
Over the past two decades GRU spies have stolen classified information from numerous targets around the world. According to Reuters, last summer they broke into Fox’s email account. They made off with secret US-UK trade documents later dumped out before the 2019 election.
The GRU’s favourite hacking method is crude but effective. It involves sending phishing emails to targets. The emails look as if they come from a trusted source. Typically they ask the recipient to click on a link or to change a password. Those who fall for the ruse effectively hand over their inboxes to shadow Russian operatives.
The suspicion will be that Fox did precisely that, using either his personal or official email.
The most likely outfit behind the cyber-raid is the GRU’s military unit 26165. It is based at 20 Komsomolsky Prospekt, a yellow-painted neo-classical building in the heart of Moscow. In spring 2016 the unit broke into the servers of Hillary Clinton’s Democratic party. It stole hundreds of thousands of documents. These were then leaked via intermediaries as part of a sweeping operation to help Donald Trump win the US election.
GCHQ, the government’s listening station, first detected the US intrusion. For several months the GRU spies ran amok inside Democrat computer networks. The most prominent victim was Clinton’s campaign chairman, John Podesta. Podesta and other volunteers all clicked on phishing messages, allowing Moscow to hoover up their private emails.
In Fox’s case, the GRU appears to have had access to his inbox for about four months, possibly including when he was a government minister, and in the run-up to the general election. It is unclear who else Moscow may have targeted. Given the GRU’s opportunistic approach, it is certain similar emails will have been sent to other cabinet ministers, along with their staff and private offices.
The GRU unit is also known as Fancy Bear and AP28. It has been engaged in disruptive activities since the mid-2000s. Its reach is global. It has previously hacked Germany’s Bundestag and the French television station TV5, among others. The US cyber-security firm CrowdStrike, which investigated the Democratic National Committee (DNC) hack, describes its technical skills as “superb”.
But Moscow’s hackers have also suffered embarrassing setbacks. In April 2018 four GRU operatives flew to The Hague in the Netherlands. They targeted the offices of the Organisation for the Prohibition of Chemical Weapons (OPCW). Their apparent mission was to steal information that might help Moscow following the poisoning by two GRU assassins of Sergei and Yulia Skripal.
The Dutch defence intelligence service tracked the group. It arrested them when they parked their rented Citroën vehicle outside the OPCW’s office. It turned out that the car had been converted into a mobile hacking unit. The Dutch recovered a transformer, a laptop connected to an antenna, and a 4G smartphone. Plus cash – $20,000 and €20,000. Their equipment was seized and they were deported.
The US special prosecutor Robert Mueller subsequently charged 12 of the GRU’s spies with cyber crimes. The hackers had clocked up an impressive number of air miles. They visited Rio during the 2016 Olympic Games as part of a major operation to discredit the world anti-doping agency and other international sporting bodies. They even went to Malaysia, hacking into the local police force following the shooting down in 2014 of Malaysian Airlines MH17 over eastern Ukraine.
The latest hack suggests that Moscow continues to regard the UK as a top cyber-target. In the weeks after Skripal was poisoned in Salisbury, the GRU tried to break into the Foreign and Commonwealth Office – then headed by Boris Johnson as foreign secretary. The hack failed. It tried a similar raid on the UK’s Defence Science and Technology Laboratory, which was also unsuccessful.
It is clear Moscow’s hackers will continue to try their luck with British politicians. And, inevitably, that some of them will click on suspicious emails.
Luke Harding’s latest book Shadow State: Murder, Mayhem and Russia’s Remaking of the West (Guardian Faber) is available from the Guardian Bookshop.
