US Offers $60 Million Bounty in Hunt for Russian Hackers

The Department of State is offering up to $60 million for information leading to the arrest of six Russian hackers, accused of engaging in cyberattacks against Ukraine, the US and dozens of their NATO allies in support of Russia's invasion.

In an indictment unveiled on Thursday, a grand jury in Maryland charged six Russian nationals with conspiracy to commit computer intrusion and wire fraud conspiracy.

The indictment alleges that the group "hacked the computers of dozens of Ukrainian Government entities and destroyed or attempted to destroy those computers in advance of the Russian invasion of Ukraine."

Their efforts, referred to in the cybersecurity community as a "WhisperGate" campaign, sought to "sow concern among Ukrainian citizens regarding the safety of their government systems and personal data."

The defendants comprise five members of the Main Directorate of the General Staff of Russia's Armed Forces (GRU), and one civilian.

Their civilian co-conspirator, Amin Stigal, was indicted in July for his role in the attacks on Ukraine's cyber infrastructure, including the country's Ministry of International Affairs, treasury department and Ministry of Energy.

The GRU officials, which include a colonel in the Russian military, are members of Unit 29155, a notorious cybergroup thought to have been involved in numerous covert attacks aimed at destabilizing Western states since 2008.

According to a 2020 report by the New York Times, GRU 29155 offered bounties to Taliban-linked militants to kill American troops in Afghanistan.

The unit has also been linked to the 2018 poisoning of Sergei Skripal, a former member of the GRU who acted as a double agent for the U.K.'s intelligence services in the 1990s and 2000s.

Alongside the latest attacks on Ukraine, Unit 29155 allegedly targeted computer systems in countries providing support for Ukraine, including the U.S. and "25 other North Atlantic Treaty Organization countries." One of these attacks included the hacking of "transportation infrastructure of a Central European country that was supporting Ukraine."

Concurrent with the six indictments, the Department of State's Rewards for Justice Program is now offering a reward of up to $10 million for information on the defendant's whereabouts or further details on cyber activity.

"Today's superseding indictment underscores our commitment to using all the tools at our disposal to pursue those who would do us and our allies around the world harm," U.S. Attorney Erek L. Barron for the District of Maryland said. "Cyber intrusion schemes such as the one alleged threaten our national security, and we will use all the technologies and investigative measures at our disposal to disrupt and track down these cybercriminals."

The bounty and criminal charges form part of a wider international effort – "Operation Toy Soldier" – which aims to counter the malicious cyber activity of Unit 29155.

Concurrent with the announcements, the FBI, NSA, CISA and intelligence agencies of several other countries released a joint cybersecurity advisory on the group, warning state agencies and organizations to shore up their cybersecurity vulnerabilities and remain on high alert for attacks by the threat actor.

Estonia, one of the partners in Operation Toy Soldier, issued international search and arrest warrants for three GRU officers, two of whom were named in the DOJ announcement.

"The Justice Department stands united with our partners and allies in supporting the Ukrainian people in the wake of Russia's unlawful and unjust invasion," Assistant Attorney General Matthew G. Olsen said on Thursday. "The National Security Division will continue to use every tool in the department's arsenal – including our private and international partnerships – to identify the individuals, take down the infrastructure and expose the tools and techniques propping up the Russian Government."

Do you have a story we should be covering? Do you have any questions about this article? Contact LiveNews@newsweek.com.

Disclaimer: The copyright of this article belongs to the original author. Reposting this article is solely for the purpose of information dissemination and does not constitute any investment advice. If there is any infringement, please contact us immediately. We will make corrections or deletions as necessary. Thank you.