This probably comes as no surprise to anyone, but Britain’s Foreign Office revealed on Thursday that it has found long-term evidence of cyber-espionage targeting a variety of politicians, public officials and journalists by the FSB, Russia’s main security agency.

The activities were tracked back to 2015 to the present by a group called Star Blizzard by Microsoft Corp. and the Cold River Group by Google LLC’s threat intelligence groups. They used fake identities impersonating various government contacts that delivered spear-phishing emails to steal documents from both U.S. and U.K. sources.

The emails were disguised as tech support messages that were used to harvest credentials as a way to gain access to victims’ email accounts. In Microsoft’s blog post, the specific tactics used were described in detail, such as using server-side scripting to prevent network scans, hiding email and DNS TCP/IP addresses, and creating password-protected PDF files for further obscurity. Emails were sent using legit marketing services including HubSpot and MailerLite, to lend further legitimacy to the operations, as shown in the flowchart below.

“There was a clear intent to use information they obtained to meddle in British politics,” U.K. Foreign Office minister Leo Docherty told the AP. Targets included the email accounts of nongovernmental organization managers, academics and the media, among others, with the purpose of undermining trust in the political processes, such as revealing early rounds of sensitive trade negotiations between the U.S. and the U.K.

As a result of these investigations, both the U.S. and the U.K. imposed sanctions on two Russian intelligence operatives earlier this week. Along with the two charged, other confederates were featured in a January report by Nisos that had specifics of their internet identities and phishing lures used. The hacking group was also identified in an unsuccessful 2022 attempt to steal data from Lawrence Livermore National Laboratory.

“Russian interference through malign foreign influence campaigns is deplorable, and the FBI is dedicated to combating this pervasive threat and will tirelessly seek to prevent and disrupt these criminal acts,” Assistant Director Bryan Vorndran of the FBI’s Cyber Division said. The U.S. wire and computer fraud charges carry a maximum combined prison term of 25 years.

Image: Mohamed_Hassan/Pixabay, Microsoft