Russian hackers try to steal COVID-19 vaccine data

Russian hackers have been accused by Britain, the United States, and Canada of trying to steal COVID-19 vaccine and treatment research from academic and pharmaceutical institutions around the world.

The world is currently battling the COVID-19 pandemic, and the race for a vaccine has been on for months now.

A co-ordinated statement from Britain, the United States, and Canada, announced by Britain’s National Cyber Security Centre (NCSC), has now claimed Russian state-backed hackers are trying to steal vaccine data, as fingers have been pointed at group APT29.

The hacker group, which is also known as Cozy Bear, is said to be operating as part of Russian intelligence services.

“We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic,” said NCSC Director of Operations Paul Chichester.

Cybersecurity researchers said an APT29 hacking tool was used against clients located in the United States, Japan, China, and Africa over the last year.

Russian news agency RIA cited spokesman Dmitry Peskov as saying the Kremlin rejected London’s allegations, which he said were not backed by proper evidence.

In a separate announcement, Britain also accused “Russian actors” of trying to interfere in its 2019 election by trying to spread leaked documents online.

Russia’s foreign ministry said those accusations were “foggy and contradictory”.

Britain is expected to publish a long-delayed report into Russian influence in British politics next week.

British foreign minister Dominic Raab said it was “completely unacceptable” for Russian intelligence services to target work on the pandemic.

The NCSC said the group’s attacks were continuing and used a variety of tools and techniques, including spear-phishing and custom malware.

The U.S. Department of Homeland Security and U.S. Cyber Command also released technical information on Thursday about three hacking tools being deployed by the Russian hackers, codenamed WELLMAIL, SOREFANG and WELLMESS.

Private sector cybersecurity researchers who had spotted the WELLMESS malware over the last year were unaware of its Russian origins until Thursday.

In several cases, WELLMESS was found within U.S. pharmaceutical companies, said three investigators familiar with the matter, who spoke on condition of anonymity to discuss confidential information. The tool allowed the hackers to stealthily gain remote access to secure computers. They declined to name the victims.

Britain and the United States said in May that networks of hackers were targeting national and international organisations responding to the pandemic.

But such attacks have not previously been explicitly connected to the Russian state.