Russian Hackers Breach Ukrainian Prosecutors' Email Accounts

Recent investigations have revealed that Russia-linked hackers compromised over 170 email accounts belonging to Ukrainian prosecutors and investigators in a significant espionage campaign. This operation, which targeted officials involved in anti-corruption efforts and investigations into Russian collaborators, has raised concerns about the security of sensitive information within Ukraine's law enforcement agencies.

BenzingaThe Straits Times

According to data reviewed by Ctrl-Alt-Intel, a collective of British and American cyberthreat researchers, the hackers accessed at least 284 inboxes between September 2024 and March 2026. The compromised accounts included those from the Specialized Prosecutor’s Office in the Field of Defense, the Asset Recovery and Management Agency (ARMA), and the Prosecutor’s Training Center in Kyiv. Notable victims included Yaroslava Maksymenko, the former chief of ARMA, and Oleg Duka, the deputy director of the Prosecutor’s Training Center, where 44 mailboxes were breached.

BenzingaThe Straits Times

The hackers also infiltrated email accounts belonging to military and government officials in neighboring NATO countries, including Romania, Greece, Bulgaria, and Serbia. In Romania, at least 67 accounts linked to the Romanian Air Force were compromised, while in Greece, the Hellenic National Defense General Staff reported breaches of 27 inboxes.

The Straits Times

The espionage campaign appears to be part of a broader strategy by Russian state actors to monitor Ukrainian officials and gather intelligence on anti-corruption efforts. Keir Giles, an associate fellow at Chatham House, suggested that the hackers aimed to stay ahead of investigations into Russian espionage or to collect potentially damaging information about Ukrainian officials.

Benzinga

Ukraine's Computer Emergency Response Team acknowledged awareness of the hack and stated that investigations into the compromises were underway. However, many of the targeted agencies, including ARMA and the Prosecutor’s Training Center, did not respond to requests for comment. The Russian Embassy in Washington also did not provide a response, despite Moscow's consistent denial of involvement in hacking operations.

Benzinga

Independent cybersecurity researchers have attributed the hacking campaign to a group known as "Fancy Bear," although there is some disagreement regarding the specific group responsible. Matthieu Faou from ESET noted that while the campaign aligns with Russian state interests, he could not definitively verify Fancy Bear's involvement.

The Straits Times

There are discrepancies among cybersecurity experts regarding the attribution of the hacking campaign. While Ctrl-Alt-Intel and some researchers link the operation to Fancy Bear, others, including Dr. Feike Hacquebord from TrendAI, dispute this connection. Additionally, the extent of the impact on NATO countries remains unclear, as some agencies have not responded to inquiries.

The Straits Times

• “They left their front door wide open.” — Ctrl-Alt-Intel

The Straits Times

• “A supposedly close relationship with Moscow is no insurance against Russian espionage,” — Keir Giles, Chatham House

The Straits Times

This breach highlights the ongoing vulnerabilities faced by Ukrainian officials amid heightened tensions with Russia, emphasizing the need for enhanced cybersecurity measures in the region.

Benzinga