Russian group targeted COVID-19 vaccine research in Canada, U.S. and U.K., say intelligence agencies
Catharine Tunney | CBC News | Posted: July 16, 2020 1:14 PM | Last Updated: July 17, 2020
Hacker group APT29 — also known as Cozy Bear and the Dukes — accused of conducting malicious attacks
A hacker group "almost certainly" backed by Russia is trying to steal COVID-19-related vaccine research in Canada, the U.K. and the U.S., according to intelligence agencies in all three countries.
The Communications Security Establishment (CSE), responsible for Canada's foreign signals intelligence, said APT29 — also known as Cozy Bear and the Dukes — is behind the malicious activity.
The group was accused of hacking the Democratic National Committee before the 2016 U.S. election.
APT29 "almost certainly operates as part of Russian intelligence services," the CSE said in a statement released Thursday morning in co-ordination with its international counterparts — an allegation the Kremlin immediately denied.
"These malicious cyber activities were very likely undertaken to steal information and intellectual property relating to the development and testing of COVID-19 vaccines, and serve to hinder response efforts at a time when health care experts and medical researchers need every available resource to help fight the pandemic," the CSE statement says.
APT29 "is likely to continue to target organizations involved in COVID-19 vaccine research and development, as they seek to answer additional intelligence questions relating to the pandemic," said a joint assessment from the CSE, the United Kingdom's National Cyber Security Centre and the National Security Agency in the U.S.
When asked if the malicious hits were successful and which facilities in Canada were targeted, a spokesperson said the CSE is generally "not able to comment on, or confirm details about specific cybersecurity incidents."
WATCH: U.K. condemns Russia for cyber attacks on COVID-19 vaccine developers
In response to CBC's inquiries, CSE spokesperson Evan Koronewski did point to a recent threat bulletin that reported a Canadian biopharmaceutical company was compromised by a foreign cyber threat actor back in mid-April.
Public Safety Minister Bill Blair said he doesn't believe the alleged attack set back Canada's research.
"But it's a useful reminder to all of those scientists and industries right across Canada who are working very diligently to find that vaccine. Canadians and the world need it. It's important work," he told a news conference in Ottawa.
"We remain concerned. Not just the Russians targeting it, but other foreign actors as well. There are unfortunately people in this world who don't play by the rules and represent a risk — even a threat — to Canadian interests and to everyone's interests."
Watch | Blair asked about Russian cyber attack on Canadian COVID-19 vaccine labs
The three targeted countries said the Russian actors have been using custom malware known as WellMess and WellMail to attack a number of organizations globally during the pandemic.
The head of Britain's cyber security centre, Paul Chichester, said the allies "condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic."
Previous warnings
In May, the CSE said authorities were investigating possible security breaches at Canadian organizations doing COVID-19-related research but did not say who was behind the attacks or where they were coming from.
The agency has been warning since the start of the COVID-19 crisis that Canadian intellectual property linked to the pandemic is a "valuable target" for state-sponsored actors.
U.K. Foreign Secretary Dominic Raab said if Russia wants to rejoin international forums, "it needs to live up to its international responsibilities."
"I think it's important to call it out because we're not going to wait until there is harm," he told reporters earlier today.
"It's clearly wrong, contrary to international law, contrary to Russia's responsibilities as a member of the international community — and indeed a permanent member of the [UN] Security Council — to be targeting with cyber attacks the international effort, not just here in the UK, but in Canada, in the U.S., to try and find a vaccine, which is for the greater good of the world."
Defence Minister Harjit Sajjan and Foreign Affairs Minister François-Philippe Champagne issued a statement this afternoon calling out "malicious state actors attempting to steal information and intellectual property." The statement doesn't cite Russia by name.
"We must call out irresponsible state behaviour that violates the rules-based international order and strive to live and work in a cyber environment that is open, stable, peaceful and secure," the statement reads.
"In Canada, we are committed to defending these principles in cyberspace, especially when they touch on the interests of Canadians."
The Russian news agency RIA said Russian President Vladimir Putin's spokesperson Dmitry Peskov denied the allegations, which he said were not backed up by proper evidence.
The CSE says Canadian health organizations should read its advisory and take necessary actions to protect themselves, and contact the Cyber Centre if they suspect they have been targeted.