Adversary Intelligence — 2026-04-16
Russian GRU Hackers Breached Over 170 Ukrainian Prosecutors' Email Accounts and Romanian Air Force Systems
Russia-linked GRU hackers operating as APT28 compromised at least 284 email accounts belonging to Ukrainian prosecutors and investigators between September 2024 and March 2026, Reuters reported based on data uncovered by UK-US cyber threat researchers at
Analysis
Targeting the Specialized Defense Prosecutor's Office and Asset Search and Management Agency points GRU requirements beyond battlefield collection into Ukraine's legal proceedings against Russian agents and disposition of seized Russian assets, both carrying post-conflict negotiation leverage, while the concurrent extension to Romanian Air Force accounts at NATO airbases establishes Alliance-wide tasking and a scope shift that may trigger collective response protocols. The inadvertent log exposure, primary evidence chain per UK-US researchers at Ctrl-Alt-Intel whose data drove the Reuters exclusive, reflects the 85th GTsSS scaling operations faster than its counterintelligence protocols could absorb; APT28 will almost certainly rotate infrastructure and tradecraft in the coming weeks. The logs may instead have been deliberately seeded to redirect Ukrainian counterintelligence toward infrastructure GRU has already vacated.
Targeting the Specialized Defense Prosecutor's Office and Asset Search and Management Agency points GRU requirements beyond battlefield collection into Ukraine's legal proceedings against Russian agents and disposition of seized Russian assets, both carrying post-conflict negotiation leverage, while the concurrent extension to Romanian Air Force accounts at NATO airbases establishes Alliance-wide tasking and a scope shift that may trigger collective response protocols. The inadvertent log exposure, primary evidence chain per UK-US researchers at Ctrl-Alt-Intel whose data drove the Reuters exclusive, reflects the 85th GTsSS scaling operations faster than its counterintelligence protocols could absorb; APT28 will almost certainly rotate infrastructure and tradecraft in the coming weeks. The logs may instead have been deliberately seeded to redirect Ukrainian counterintelligence toward infrastructure GRU has already vacated.
3 sources
- Russia hacks over 170 accounts of Ukrainian prosecutors, investigators, Reuters reports -
Kyiv Independent - Russian Hackers Breach Ukrainian Prosecutors' Emails—Then Accidentally Expose Themselves -
United24 Media - Exclusive: Russia-linked hackers compromised scores of Ukrainian prosecutors' email accounts, data shows -
Reuters