Russia hacked Danish defence ministry emails for 2 years

Denmark's defence minister, Claus Hjort Frederiksen, has directly accused the Russian government of launching "aggressive" cyberattacks against his country after an intelligence report claimed that Kremlin-linked hackers had, for two years, targeted government email accounts.

"What's happening is very controlled. It's not small hacker groups doing it for the fun of it," Frederiksen told Berlingske newspaper. "It's connected to intelligence agencies or central elements in the Russian government, and holding them off is a constant struggle," he added.

Speaking to Danish news agency Ritzau, he added: "This is part of a continuing war from the Russian side in this field, where we are seeing a very aggressive Russia."

On 23 April (Sunday), the Centre for Cyber Security (CFCS), a fork of the Danish Defence Intelligence Service (DDIS), claimed pro-Kremlin hacking teams infiltrated the emails of defence ministry personnel for an undisclosed period of time between 2015 and 2016.

The CFCS said APT28 – also known as "Fancy Bear" – was involved in the hacking but claimed the cybercriminals only accessed "non-classified" information, the Copenhagen Post reported. "The hacked emails did not contain military secrets, but it is of course serious," Frederiksen said.

Last December, US intelligence released a report pointing at APT28 as the culprits in the hacking of the Democratic National Committee (DNC) and other political institutions. It claimed the group worked on behalf of Russian spies, tasked with spreading leaks, propaganda and misinformation.

"The recent activity in the US is but one of many instances of Russian government influence operations conducted in support of strategic political objectives, and it will not be the last," the report warned. APT28 has many names, including Fancy Bear, Pawn Storm, Sofacy and Sednit.

Officials in Russia, including president Vladimir Putin, have denied all involvement in the cyberattacks. In October last year, he said: "The hysteria is simply to distract the American people from the contents of what the hackers have posted. There's nothing there benefiting Russia."

The denials continued on 24 April in relation to Frederiksen's fresh claims. Sputnik, a Russian state news outlet, was provided a quote from Kremlin spokesman Dmitry Peskov spinning the story by claiming Russia "as a country" does not engage in hacking and cybercrime.

Peskov said: "In this case, of course, it is interesting to understand, what is Russia? Russia is a country, and Russia does not engage in hacker attacks." He said more needs to be done to understand "what is at issue and what was the basis for [the] statements."

This is not the first time Frederiksen has been outspoken on the alleged threat posed by Russia-directed hackers. In January this year, he warned state-sponsored hackers were poised to "attack hospitals, infrastructure and the electrical supply by breaking into computer systems".

"We need to make it clear in Denmark that we are all under one type of threat or another. And we need to act," he told Berlingske newspaper.