UK, US, Canada accuse Russia of hacking virus vaccine trials

Photo: The Canadian Press

Britain, the United States and Canada accused Russia on Thursday of trying to steal information from researchers seeking a COVID-19 vaccine.

The three nations alleged that hacking group APT29, also known as Cozy Bear and said to be part of the Russian intelligence service, is attacking academic and pharmaceutical research institutions involved in coronavirus vaccine development.

Britain's National Cybersecurity Centre made the announcement, which was co-ordinated with authorities in the U.S. and Canada.

"It is completely unacceptable that the Russian Intelligence Services are targeting those working to combat the coronavirus pandemic," Foreign Secretary Dominic Raab said in a statement. "While others pursue their selfish interests with reckless behaviour, the U.K. and its allies are getting on with the hard work of finding a vaccine and protecting global health."

The persistent and ongoing attacks are seen by intelligence officials as an effort to steal intellectual property, rather than to disrupt research. The campaign of "malicious activity" is ongoing and includes attacks "predominantly against government, diplomatic, think-tank, healthcare and energy targets," the National Cybersecurity Centre said in a statement.

It was unclear whether any information actually was stolen but the centre says individuals’ confidential information is not believed to have been compromised. The Russian Foreign Ministry did not immediately respond to a request for comment.

Cozy Bear, also known as the “dukes," has been identified by Washington as one of two Russian government-linked hacking groups that broke into the Democratic National Committee computer network and stole emails ahead of the 2016 presidential election. The other group is usually called Fancy Bear.

A 16-page advisory made public by Britain, the U.S. and Canada on Thursday accuses Cozy Bear of using custom malicious software to target a number of organizations globally. The malware, called WellMess and WellMail, has not previously been associated with the hacking group, the advisory said.