Western Allies Unite Against Russian Cyber Threat in New Advisory

Western Allies Unite Against Russian Cyber Threat in New Advisory

• Who issued it: CISA, the NSA, the FBI and partner agencies in Europe and elsewhere published joint advisory AA25-141A on May 21, 2025.
• Who is behind the activity: Russia’s GRU military unit 26165, better known as APT28 or Fancy Bear, running an espionage campaign.
• Who is being targeted: Logistics and technology companies, including those moving aid to Ukraine, plus defense, transport hubs, maritime, air traffic management and IT services.
• Why it matters: The advisory shows the U.S. and its allies sharing what they know about one Russian unit in a single, coordinated warning.

One advisory, many signatures

On May 21, 2025, CISA, the National Security Agency, the FBI and a long list of allied agencies released a joint advisory titled “Russian GRU Targeting Western Logistics Entities and Technology Companies.” It describes a cyber espionage campaign run by GRU military unit 26165, and the agencies say they expect it to continue.

The campaign has been running since 2022. As Western countries sent aid to Ukraine, the unit widened its targeting to the companies coordinating, shipping and delivering that aid, and to the technology firms that support them. Dozens of organizations have been hit or probed, across air, sea and rail.

How unit 26165 gets in

The tradecraft is mostly familiar, which is part of the warning. The advisory lists password spraying, spearphishing and changes to Microsoft Exchange mailbox permissions so the attackers can keep reading mail. Once inside one company, the actors went after its business partners in the transport sector, abusing those trust relationships to reach new targets.

The agencies also tie the campaign to the unit’s large-scale targeting of internet-connected cameras in Ukraine and neighboring NATO countries. Cameras at border crossings were used to watch and track aid shipments.

Which sectors are on the list

The advisory names the defense industry, transportation hubs such as ports and airports, maritime companies, air traffic management and IT services, in NATO member states, in Ukraine and at international organizations. A logistics firm in Poland and a software vendor in Texas can sit on the same target list.

The guidance for defenders is blunt: assume you are a target. Executives and network teams at logistics and technology companies should step up monitoring, hunt for the techniques and indicators of compromise listed in the advisory, and turn on multi-factor authentication wherever password spraying could work. Watch Exchange mailbox permissions closely.

Why the joint format matters

A single advisory signed by many national agencies gives defenders one set of indicators instead of a dozen partial ones. It also signals that the authoring governments are pooling intelligence on this unit and want companies to act on it now.

For companies on the list, the practical message is simple. Pull the indicator files CISA published with AA25-141A and check your logs against them this week.

Where companies should start

The advisory is a detailed picture of how one Russian intelligence unit has gone after the supply chain behind aid to Ukraine. Most of what it describes is preventable with basic controls applied well.

The harder part is follow-through. Password spraying works when MFA has gaps, and mailbox-permission abuse goes unnoticed when nobody reviews those settings. Both are fixable.

Companies outside logistics should read it too. Unit 26165 picked its targets by their business ties, so a supplier to a supplier can end up in scope.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.