Kremlin’s Cyber Shadows Stalk Tech Powerhouses in Bold New Attacks

Kremlin’s Cyber Shadows Stalk Tech Powerhouses in Bold New Attacks

The short version

• Russia’s military intelligence agency is targeting Western logistics and technology firms, especially those helping deliver aid to Ukraine.
• The unit behind it is GRU Unit 26165, also known as APT28 or Fancy Bear.
• A May 21, 2025 joint advisory from CISA with the FBI and NSA, signed by allied agencies, lists its methods and indicators.
• Methods include password spraying and spearphishing, plus hijacking internet cameras near border crossings to watch aid shipments.

The GRU campaign against aid supply chains

On May 21, 2025, CISA and the FBI joined the National Security Agency (NSA) and partner agencies in Europe and elsewhere to publish a joint advisory. It says GRU Unit 26165 has been targeting logistics companies and technology firms in NATO countries since 2022. The focus is aid to Ukraine. Defense contractors were named among the targets, along with transport operators such as ports and air traffic services, and the IT providers that support them.

Who is being targeted

The targets are not only big U.S. tech companies. The advisory covers firms across North America and Europe that handle transport, logistics or IT services, because breaking into them gives Moscow a view of what aid is moving and when.

The advisory says the unit also tried to get into more than 10,000 internet-connected cameras, many of them near border crossings and rail stations, to track shipments. That is cheap surveillance. An earlier version of this article quoted a “Samantha Healy, a cybersecurity strategist at a leading tech firm.” We could not find any record of that person or quote and have removed it.

What the agencies want companies to do

The agencies urge logistics and technology firms to treat themselves as targets. They should hunt for the listed indicators, review Microsoft Exchange mailbox permissions that may have been changed by attackers, and check small office and home office routers and cameras that face the internet.

Basic controls do much of the work here. The advisory recommends multi-factor authentication that resists phishing and quick patching of internet-facing devices. It also calls for network segmentation. Watch for unusual logins from VPN or anonymization services.

How the attackers get in

The techniques are mostly familiar ones. Password spraying is one. Spearphishing with links to fake login pages is another, along with exploiting known flaws in Outlook and WinRAR or in Roundcube webmail, and abusing poorly secured routers and cameras that nobody has looked at since installation.

Once inside, the unit looked for shipment data such as train schedules and cargo manifests and kept access through account changes and scheduled tasks. Because the methods are well known, the defenses are too. The challenge is applying them across every supplier in a logistics chain.

What to watch for

APT28 has been active for well over a decade and is unlikely to stop while the war in Ukraine continues. Companies in the aid supply chain, including small ones, should expect continued attempts.

The full advisory, AA25-141A, includes indicators of compromise and detection guidance. Security teams at logistics and IT firms should check their environments against it.

An earlier version of this article ended with a quote from an unnamed “well-known cybersecurity expert.” It could not be traced and has been removed.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.