Air traffic, defence sector on Russian hackers’ radar, alleges UK

The United Kingdom with its international allies claims to have exposed a Russian state-sponsored cyber campaign aimed at organisations supporting Ukraine and critical Western infrastructure. The UK's National Cyber Security Centre (NCSC) identified the campaign as being orchestrated by Russia's military intelligence service, targeting both public and private entities since 2022.

The cyber campaign has targeted various sectors, including defence, IT services, logistics, maritime operations, airports, ports, and air traffic management systems across multiple NATO member countries and Australia. Notably, internet-connected cameras at Ukrainian border crossings and near military installations were hacked, allowing the unit to monitor aid deliveries and troop movements.

Russian cyber actors employed various hacking techniques to infiltrate networks. These methods included spear-phishing emails, exploiting known vulnerabilities, and deploying malware to gain unauthorised access and exfiltrate sensitive information. The campaign's sophistication shows the persistent threat posed by state-sponsored cyber activities.


In response to the revelations, the UK and its allies have issued joint advisories to raise awareness of the threat and provide guidance on mitigating risks. Paul Chichester, NCSC Director of Operations, stated, "This malicious campaign by Russia’s military intelligence service presents a serious risk to targeted organisations, including those involved in the delivery of assistance to Ukraine."

He urged organisations to familiarise themselves with the threat and implement recommended cybersecurity measures.

The exposure of this cyber campaign highlights the ongoing risks posed by state-sponsored cyber threats. The UK's NCSC continues monitoring the situation and collaborating with international partners to enhance cybersecurity resilience and protect critical infrastructure from malicious activities.

To mitigate potential cyber threats, organisations are advised to remain vigilant, regularly update their security protocols, and report suspicious activities to the relevant authorities.