Russian spies ‘tried to hack’ chemicals watchdog probing Novichok attack

Russia’s military intelligence service has been accused of trying to hack the global chemical weapons watchdog which is investigating the Salisbury nerve agent attack.

Officials in the Netherlands, where the Organisation for the Prohibition of Chemical Weapons (OPCW) is based, said four Russians had been expelled after the alleged cyber strike.

British intelligence helped thwart the operation which was launched in April, a month after the Salisbury Novichok poisoning which targeted Russian spy Sergei Skripal.

Details were revealed on Thursday after the UK Government accused the GRU of a wave of other cyber attacks across the globe.

Prime Minister Theresa May said the operation “further shone a light on the unacceptable cyber activities” of the GRU and demonstrated its “disregard for the global values and rules that keep us safe”.

The team of four GRU officers travelling on official Russian passports entered the Netherlands on April 10.

On April 13 they parked a car carrying specialist hacking equipment outside the headquarters of the OPCW in The Hague.

At that point Dutch counter-terrorism officers intervened to disrupt the operation and the four GRU officers were ordered to leave the country.

The “close access” hacking attempt followed a failed “spearphishing attack” on the OPCW headquarters.

Two of the officers were planning to travel on to Switzerland where the OPCW – which was at the time investigating the Salisbury attack and a suspected chemical weapons attack in Syria – has laboratories.

Dutch authorities released CCTV images of the four men arriving at Schiphol Airport as well photographs of their passports.

They were named in them as Alekski Morenets, described as a cyber operator, Evgenii Serebriakov, also a cyber operator, Oleg Soktnikov, described as humint (human intelligence) support, and Alexey Minin, also humint support.

The attempt on the OPCW headquarters followed unsuccessful “spearphishing” attacks by the GRU on the UK Foreign Office and on the defence laboratories at Porton Down, which was also investigating the Salisbury attack.

Peter Wilson, the UK’s ambassador to the Netherlands, said the hacking attack happened when the “OPCW was working to independently verify the United Kingdom’s analysis of the chemical weapons used in the poisoning of the Skripals in Salisbury”.

Mr Wilson also accused one of the GRU officers escorted out of the Netherlands of targeting the Malaysian investigation into the shooting down of flight MH17 over Ukraine in 2014, when more than 300 people travelling from Amsterdam to Kuala Lumpur died.

The OPCW has confirmed the toxic chemical that killed Dawn Sturgess in Amesbury was the same nerve agent as that which poisoned Sergei and Yulia Skripal three months earlier.

UK authorities believe two Russians, using the aliases Alexander Petrov and Ruslan Boshirov, smeared the highly toxic Novichok on a door handle at the Wiltshire home of Mr Skripal on March 4.

The attack left Mr Skripal and his daughter Yulia critically ill, and Ms Sturgess, 44, who was later exposed to the same nerve agent, died in July.

Conservative MP Tom Tugendhat, chairman of the UK’s Commons Foreign Affairs Committee, tweeted: “The catalogue of evidence shows why the Dutch are excellent partners and that the decades of theft have stripped Russia’s intelligence of the skills they once had. Putin’s corrupt greed has turned the GRU into an amateurish bunch of jokers.”

Earlier Foreign Secretary Jeremy Hunt said the GRU was waging a campaign of “indiscriminate and reckless” cyber strikes targeting political institutions, businesses, media and sport.

The National Cyber Security Centre (NCSC) said a number of hackers known to have launched attacks have been linked to the GRU.

The NCSC associated four new attacks with the GRU, on top of previous strikes believed to have been conducted by Russian intelligence.

Among targets of the GRU attacks were the World Anti-Doping Agency (Wada), transport systems in Ukraine, and democratic elections, such as the 2016 US presidential race, according to the NCSC.

The centre said it was “almost certainly” the GRU behind a “BadRabbit”attack in October 2017 that caused disruption to the Kiev metro, Odessa airport and Russia’s central bank.

Britain’s cyber security chiefs say they have “high confidence” Russian intelligence was responsible for a strike on Wada in August 2017.

The NCSC also said the GRU was “almost certainly” to blame for hacking the Democratic National Committee during the US presidential election in 2016.

And the agency pointed the finger at the GRU for accessing email accounts at a small UK-based TV station in 2015.