Adversary Intelligence — 2026-08-21

GRU Unit APT28 Hacks Ukraines Asset Seizure Agency ARMA Days Before 165 Million Dollar Oligarch Asset Competition Deadline

BLUFARMA's competition will very likely proceed by August 22, but prior GRU access to internal databases may have already positioned Moscow to shape the outcome regardless of which bidder prevails.

ARMA, Ukraine's Asset Recovery and Management Agency, said on Tuesday its servers suffered unauthorized interference bearing "the hallmarks of a cyberattack," days before an August 22 deadline for applications to manage seized IDS Ukraine assets tied to sanctioned Russian billionaire Mikhail Fridman 123. Acting head Yaroslava Maksymenko said the agency has also detected unauthorized access to an internal database of ARMA officials since spring, and that specialists are examining whether that intrusion and the latest attack are connected to the IDS Ukraine competition 12. Ukraine's SBU security service opened an investigation, and TechTimes attributed the intrusion to GRU Unit 26165, tracked by researchers as APT28, which Ukrainian officials said breached over 170 prosecutor email accounts in an April 2026 campaign that Maksymenko said failed to penetrate ARMA's own systems at the time 4. IDS Ukraine called ARMA's allegations of retained sanctioned-shareholder influence "groundless," noting over 50 percent of its shares belong to the Patarkatsishvili family and the Georgian government 2. ARMA said the manager competition, run through the Prozorro procurement platform, will proceed on schedule 23.

Analysis
ARMA will very likely close the IDS Ukraine manager-application window on schedule by the August 22 deadline, since the agency has publicly committed to proceeding despite the intrusion and the SBU probe runs on a track separate from the Prozorro process. Moderate confidence reflects consistent reporting across independently sourced outlets but no technical attribution of the intrusion to a specific actor. The breach's practical impact turns on whether it exposed bidder or financial data that shapes the competition's outcome even as the deadline holds. A contested or annulled result, as occurred with the 2023 Carpathian Mineral Waters award, would extend Fridman-linked capital's practical control regardless of who nominally wins.

4 sources

Hackers target Ukrainian agency managing assets seized from sanctioned Russians - The Record (Recorded Future News)
ARMA reports cyberattack amid competition for Morshynska assets - Interfax-Ukraine
ARMA Cyberattack Hits Ukraine Asset Recovery Agency - The Cyber Express
Russias GRU Hacked Ukraines Sanctioned-Asset Agency Days Before 165M Deadline - TechTimes