UK 'increasingly concerned' about Russian intelligence links to hacktivists

BIRMINGHAM, United Kingdom — British officials are “increasingly concerned about growing links between the Russian intelligence services and proxy groups to conduct cyberattacks,” a senior intelligence chief warned on Tuesday.

Anne Keast-Butler, director of signals and cyber intelligence agency GCHQ, warned that the Kremlin’s partnership with criminal groups was also contributing to “suspected physical surveillance and sabotage operations.”

Her warning follows the British government last week announcing a “major package of measures to target and dismantle Russian intelligence gathering operations,” including removing the diplomatic premises status of a countryside estate used as a retreat by Russian embassy staff — and allegedly as a safe meeting place with agents.

In the past few months, police officers have arrested the suspected members of two groups allegedly directed by Russian spies to carry out hostile activities in Britain.

There are ongoing cases against six Bulgarian nationals who are accused of conspiring to commit espionage activities on behalf of Russia, as well as against a group of four British nationals charged in connection to an arson attack against a Ukrainian logistics company in London.

The use of proxies by foreign governments has been a growing issue for Western national security communities in recent months. Cases have involved an alleged Iranian drug trafficker with ties to Tehran’s intelligence services being charged in the United States with recruiting a member of the Hells Angels in a plot to murder an Iranian defector.

Such groups can provide a layer of deniability for the governments involved, but — particularly in the cyber domain — potentially also expose those behind the operations due to shortcomings in tradecraft.

In her first major public speech since becoming the director of GCHQ, Keast-Butler told the CyberUK conference in Birmingham that the relationship between the Kremlin and these proxies was changing.

The NCSC had previously said that cybercriminals and hacktivisits “operating from within Russia’s borders benefit from the tacit consent of the Russian State.”

Keast-Butler expanded on this observation, noting that “before, Russia simply created the right environments for these groups to operate, but now they are nurturing and inspiring these non-state cyber operations.”

She warned that in “some cases” the Russian intelligence services and these proxies were “seemingly co-ordinating physical attacks against the West.”

“The Russia threat is acute and globally pervasive. It requires constant vigilance and collaboration to defeat it. We can see that Putin has not given up his maximalist goal of subjugating the population of Ukraine,” said the GCHQ director.

“Which is why the U.K.’s support will remain steadfast, for as long as it takes, because only through strength and partnership will Putin be deterred.”