Russian group targeted COVID-19 vaccine research in Canada, U.S. and U.K., say intelligence agencies

A hackergroup "almost certainly" backed by Russiais trying to steal COVID-19-related vaccine research in Canada, the U.K. and the U.S., according to intelligence agencies in all three countries.

The Communications Security Establishment (CSE), responsible for Canada's foreign signals intelligence, saidAPT29 also known as Cozy Bear and the Dukes is behind themalicious activity.

The group was accused ofhacking the Democratic National Committee before the 2016 U.S. election.

APT29 "almost certainly operates as part of Russian intelligence services," the CSEsaid in a statement released Thursday morning in co-ordination with its international counterparts an allegation the Kremlin immediately denied.

"These malicious cyber activities were very likely undertaken to steal information and intellectual property relating to the development and testing of COVID-19 vaccines, and serve to hinder response efforts at a time when health care experts and medical researchers need every available resource to help fight the pandemic," the CSE statement says.

APT29"is likely to continue to target organizations involved in COVID-19 vaccine research and development, as they seek to answer additional intelligence questions relating to the pandemic," said a joint assessment from the CSE, theUnited Kingdom's National Cyber Security Centre andtheNational Security Agency in the U.S.

When asked if the malicious hits were successful and which facilities in Canada were targeted, a spokesperson said the CSE is generally "not able to comment on, or confirm details about specific cybersecurity incidents."

WATCH: U.K. condemns Russia for cyber attacks on COVID-19 vaccine developers

U.K. condemns Russia for cyberattacks on COVID-19 vaccine developers

4 years ago

Duration 0:36

U.K. Foreign Secretary Dominic Raab said it was 'pretty appalling' of Russia to be involved in the cyberattacks on Britain, Canada and the U.S.

In response to CBC's inquiries, CSE spokespersonEvanKoronewski did point to a recent threat bulletinthat reported a Canadian biopharmaceutical company was compromised by a foreign cyber threat actor back in mid-April.

Public Safety Minister Bill Blair said he doesn't believe the alleged attack set back Canada's research.

"But it's a useful reminder to all of those scientists and industries right across Canada who are working very diligently to find that vaccine. Canadians and the world needit. It's important work," he tolda news conference in Ottawa.

"We remain concerned. Not just the Russians targeting it, but other foreign actors as well. There are unfortunately people in this world who don't play by the rules and represent a risk even athreat to Canadian interests and to everyone's interests."

Watch |Blair asked about Russian cyber attack on Canadian COVID-19 vaccine labs

Bill Blair is asked about Russian cyber attack on Canadian COVID-19 vaccine labs

4 years ago

Duration 1:18

Federal Public Safety Minister Bill Blair spoke with reporters by video conference on Thursday.

The three targeted countries said the Russian actors have been using custom malware known as WellMess and WellMailto attack a number of organizations globally during the pandemic.

The head of Britain's cyber security centre, Paul Chichester,said the allies "condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic."

Previous warnings

In May, the CSE said authorities were investigating possible security breaches at Canadian organizations doing COVID-19-related research but did not say who was behind the attacks or where they were coming from.

The agency has been warning since the start of the COVID-19 crisis that Canadian intellectual property linked to the pandemic is a "valuable target" for state-sponsored actors.

U.K. Foreign Secretary Dominic Raab saidif Russia wants to rejoin international forums, "it needs to live up to its international responsibilities."

"I think it's important to call it out because we're not going to wait until there is harm," he told reporters earlier today.

"It's clearly wrong, contrary to international law, contrary to Russia's responsibilities as a member of the international community and indeed a permanent member of the [UN]Security Council to be targeting with cyber attacks the international effort, not just here in the UK, but in Canada, in the U.S., to try and find a vaccine, which is for the greater good of the world."

Defence Minister Harjit Sajjan and Foreign Affairs MinisterFranois-Philippe Champagneissued a statement this afternoon calling out "malicious state actors attempting to steal information and intellectual property." The statement doesn't cite Russia by name.

"We must call out irresponsible state behaviour that violates the rules-based international order and strive to live and work in a cyber environment that is open, stable, peaceful and secure," the statementreads.

"In Canada, we are committed to defending these principles in cyberspace, especially when they touch on the interests of Canadians."

TheRussian news agency RIA said Russian President Vladimir Putin'sspokespersonDmitry Peskovdenied the allegations, which he said were not backed upby proper evidence.

The CSE says Canadian health organizations should read its advisory and take necessary actions to protect themselves, and contact the Cyber Centre if they suspect they have been targeted.