Russian spies have launched a series of cyberattacks targeting British authorities and chemical weapons investigators following the Salisbury attack, it has been revealed
The GRU military intelligence agency allegedly tried to strike the Porton Down defence laboratory and Foreign Office following the poisoning of Sergei Skripal in March.
In April, four Russians were arrested while attempting to launch a major "close access" cyberattack against the headquarters of the Organisation for the Prohibition of Chemical Weapons (OPCW) in the Hague.
Dutch investigators said the spies also intended to travel onwards to its accredited Spiez laboratory in Switzerland, which was testing novichok samples from Salisbury at the time.
Prime minister Theresa May and Dutch PM Mark Rutte condemned Russia's actions in a joint statement, accusing Moscow of showing a "disregard for the global values and rules that keep us all safe".
At briefings on Thursday, Whitehall officials confirmed British intelligence helped thwart the cyber operation against the OPCW.
The Russian men taken into custody, travelled under the names Aleksei Sergeyvich Morenets, Evgenii Mikhaylovich Serebriakov, Oleg Mikhaylovich Sotnikov and Alexey Valeryevich Minin.
They had arrived in The Hague three days earlier on diplomatic passports and it is unclear whether they were using aliases.
Two of the passports - for the two "cyber operators" involved - were issued on the same day in April 2017 and have numbers just one digit apart.
The two GRU assassins who poisoned Mr Skripal in Salisbury were found to be travelling on fake passports that were three digits apart.
The men rented a Citroen C3, with a spacious boot, in Minin’s name to undertake their operation before going to their hotel.
Then on 13 April – the same day Donald Trump gave a press conference on US air strikes against Syria – they travelled in the car to OPCW headquarters, just off Johan de Wittlaan street in The Hague.
Pictures show that they parked outside the perimeter fence and opened the boot to use a computer, powered by a portable battery that had been bought in the Netherlands and connected to a wifi antenna which they hid from view under a coat.
As Dutch officers moved in, one of the men attempted to destroy some of the equipment but failed, leaving a computer and phones which revealed a sizeable amount of extra intelligence.
The men had cleaned out their hotel room, taking rubbish and any other items with them that might somehow allow counter-espionage agents to track them.
But once they were arrested they were escorted to the airport and put on a plane back to Russia, with UK officials explaining this would have been a decision by the Dutch government.
The British ambassador to the Netherlands, Peter Wilson, said the GRU officers stopped in the Hague had planned to travel onwards to an OPCW-approved laboratory in Speiz, Switzerland, which was testing Skripal samples.
At the same time, the OPCW was also analysing the substance used in a chemical attack on the Syrian rebel stronghold of Douma.
The watchdog later found chlorine was used in the Syrian incident, which US, British and French authorities attributed to Vladimir Putin’s ally Bashar al-Assad.
Speaking of the attempted hacking on the OPCW, Mr Wilson said: “This was not an isolated act.
“The unit involved, known in the Russian military as Unit 26165, has sent officers around the world to conduct brazen close-access cyber operations.”
Officials also revealed that a GRU linked group called “Sandworm” had attempted to compromise Foreign Office and Porton Down computer systems immediately after the Salisbury poisoning in March.
They said that because the "spear phishing" attack, where hackers attempt to fool recipients into opening malicious emails by posing as someone else, did not work they are unsure what the Russians wanted to do.
Other attacks have been aimed at intercepting and monitoring communications, gaining information or disrupting systems and operations.
Among the men arrested in the Hague was one officer accused of conducting “malign activity” targeting Malaysian institutions investigating the downing of flight MH17 by rebels supplied with a Russian missile system in Ukraine.
Mr Wilson said another of the GRU officers arrested in the Hague had also previously visited Lausanne, Switzerland, in September 2016.
They connected to wifi in a hotel where a world anti-doping agency conference was taking place, including Olympic committee officials who became victims of a cyber attack.
Malware from another GRU linked group, APT28, compromised an official’s laptop, the hotel’s system and then the IP addresses of the International Olympic Committee.
Then in May, Russian hackers sent emails impersonating Swiss federal authorities to OPCW employees in an effort to compromise their systems.
A government official said the timing and targeting of cyberattacks suggested that when there are international investigations into Russian activity, the "GRU seems to deploy".
Mr Wilson said: “The GRU has interfered in free elections and pursued a hostile campaign of cyber attacks against state and civilian targets.
“The GRU is an aggressive, well-funded official body of the Russian state. It can no longer be allowed to act aggressively across the world against vital international organisations, with apparent impunity.”
In a joint statement, Theresa May and Dutch prime minister Mark Rutte said the GRU had shown “disregard for the global values and rules that keep us all safe”.
“The GRU’s reckless operations stretch from destructive cyber activity to the use of illegal nerve agents, as we saw in Salisbury,” they added.
“We will uphold the rules-based international system and defend institutions from those that seek to do them harm.”
British officials say they do not know how Russia will react to the latest revelations, but are expecting a fresh swell of disinformation and conspiracy theories.
Russian foreign ministry spokeswoman Maria Zakharova dismissed the new accusations, calling them “big fantasies.”
