UK imposes sanctions on three units of Russia's GRU, 18 of their agents

The UK has imposed sanctions on three units of Russia's GRU and 18 Russian military personnel and agents, and has also exposed that Russian military intelligence used malicious software to spy on email accounts linked to Britain and its allies.

"The Government has today (18 July) exposed Russian military intelligence actors for using previously unknown malicious software to enable espionage against victim email accounts, in a move that will keep the UK and its allies safer," the GCHQ's National Cyber Security Centre press service said in a statement.

A hacking group known as APT 28 is reportedly responsible for the distribution of sophisticated malware called AUTHENTIC ANTICS, which targets users' emails. The malware steals victims' authentication credentials to gain long-term access to their emails.

As previously reported, APT 28 is part of the 85th Main Center of Special Services of the Russian GRU, military unit 26165.

The new British sanctions cover three GRU units: 26165, 29155 and 74455 and 18 agents involved in cyber operations in the interests of Russia. The strategic defense review from the British National Cyber Security Center identifies Russia as the most acute threat.

Analysis of the AUTHENTIC ANTICS malware showed that it was created specifically to gain long-term access to Microsoft cloud accounts by simulating normal activity.

"The Kremlin should be in no doubt: we see what they are trying to do in the shadows and we won't tolerate it. That's why we're taking decisive action with sanctions against Russian spies. Protecting the UK from harm is fundamental to this government's Plan for Change," Foreign Secretary David Lammy said.

"Putin's hybrid threats and aggression will never break our resolve. The UK and our Allies support for Ukraine and Europe's security is ironclad," he added.

According to media reports, the Russian hacking group APT 28 has been operating around the world since at least 2004. In April, France accused them of cyberattacks, including during Macron's presidential campaign.