Get all your news in one place.
100’s of premium titles.
One app.
Start reading
Evening Standard
Evening Standard
World
Kit Heren

Cozy Bear and Fancy Bear: what are the Russian intelligence hacking operations?

Hackers have 'never had it so good' according to one expert (Picture: PA Archive/PA Images)

The British, US and Canadian governments have accused the Russian hacking group Cozy Bear of trying to steal vital coronavirus information, including research about a possible vaccine.

UK security minister James Brokenshire went further the next day, slamming the "completely unacceptable" actions of "Russian intelligence officers". - although there's no evidence that anything had been stolen or that damage had been done, he added.

Paul Chichester, director of operations for the UK's National Cyber Security Centre (NCSC), said: "We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic."

But who are the hackers? Here we look at Cozy Bear and their fellow Russian group Fancy Bear.

The group was allegedly trying to steal information related to a coronavirus vaccine (PA)

Who are Cozy Bear and Fancy Bear?

Cozy Bear and Fancy Bear are thought to be hacking groups within separate Russian intelligence agencies.

APT29 - mean advanced persistent threat - or Cozy Bear is believed to be working for SVR, Russia's foreign intelligence organisation.

According to the NCSC, an arm of GCHQ, Cozy Bear "almost certainly operates as part of Russian intelligence services".

Fancy Bear, or APT28, is believed to be part of GRU, Russia's military intelligence agency.

Gardens within Government Communications Headquarters, commonly known as GCHQ (PA)

What are they already known for?

Both Cozy Bear and Fancy Bear are said to have taken part in the infamous hack of the Democratic National Convention's IT systems during the 2016 US presidential election.

The FBI's Robert Mueller, who investigated Russian interference into the election, indicted 12 Fancy Bear operatives allegedly working for GRU in his final report for allegedly taking part in the cyber attacks.

Cozy Bear is also believed to have taken part in the hack, but left much less of a trace behind and was not even mentioned in Mr Mueller's report.

Former Special Counsel Robert Mueller (AFP/Getty Images)

Separately, Fancy Bear is alleged to have hacked into several national and international anti-doping agencies, revealing the cyclist Sir Bradley Wiggins' use of the corticosteroid triamcinolone before his three biggest races in 2011, 2012 and 2013, including his 2012 Tour de France victory.

Anne Neuberger, director of cyber security at the US National Security Agency, said: "APT29 has a long history of targeting governmental, diplomatic, think-tank, healthcare and energy organisations for intelligence gain so we encourage everyone to take this threat seriously and apply the mitigations issued in the advisory.”

What has Russia said?

Vladimir Putin's spokesman Dmitry Peskov (REUTERS)

Russia has denied all the allegations very strongly.

Kremlin spokesman Dmitry Peskov said in response to the claims: "We do not have information about who may have hacked into pharmaceutical companies and research centres in Great Britain. We can say one thing – Russia has nothing at all to do with these attempts. We do not accept such accusations.”

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.