A Russian hacking group has gone after COVID-19-related vaccine research in Canada, the U.K. and the U.S., according to Canada’s cyber spies.
The Communications Security Establishment (CSE), responsible for Canada’s foreign signals intelligence, said APT29 — also known as Cozy Bear and the Dukes — is behind the malicious activity.
The group “almost certainly operates as part of Russian intelligence services,” the CSE said in a statement released Thursday morning.
More details about the attacks are expected later this morning, but the CSE said Russian actors have been using custom malware known as WellMess and WellMail to target a number of organizations globally.
“These malicious cyber activities were very likely undertaken to steal information and intellectual property relating to the development and testing of COVID-19 vaccines, and serve to hinder response efforts at a time when health-care experts and medical researchers need every available resource to help fight the pandemic,” the CSE statement says.
When asked if the malicious hits were successful and what facilities in Canada were targeted, a spokesperson said the CSE is generally “not able to comment on, or confirm details about specific cybersecurity incidents.”
In May, the CSE said authorities were investigating possible security breaches at Canadian organizations doing COVID-19-related research but did not say who was behind the attacks and where they were coming from.
The agency has been warning since the start of the crisis that Canadian intellectual property linked to the pandemic is a “valuable target” for state-sponsored actors.
U.K. Foreign Secretary Dominic Raab tweeted that his government stands with Canada and the U.S. “against the reckless actions of Russia’s intelligence services, who we have exposed today for committing cyber attacks against those working on a COVID-19 vaccine.
The 🇬🇧 stands with 🇺🇸 & 🇨🇦 against the reckless actions of Russia’s intelligence services, who we have exposed today for committing cyber attacks against those working on a <a href=”https://twitter.com/hashtag/Covid19?src=hash&ref_src=twsrc%5Etfw”>#Covid19</a> vaccine – undermining vital 🌎 cooperation to defeat this pandemic <a href=”https://t.co/6nIq8Nu5Iz”>https://t.co/6nIq8Nu5Iz</a>