Russian Military Intelligence Targets Western Logistics Firms in Ukraine Aid Campaign

26 October 2026

Western cyber agencies warned on May 21, 2025 that Russian military intelligence has been conducting a large-scale cyber campaign since 2022 targeting logistics entities in the U.S., NATO countries, and Ukraine.

The UK's National Cyber Security Centre (NCSC) and allies in the U.S., Germany, Poland, Australia, and other countries exposed the campaign as the work of an intelligence unit within Russia's military intelligence agency, the GRU.

GRU Unit 26165, also known in cybersecurity circles as the APT28 hacking group, sought to infiltrate organisations involved in coordinating and delivering aid to Ukraine, the NCSC said. Putin's forces have been actively tracking foreign assistance to Ukraine to get the shipments disrupted.

The targeted sectors included defence, IT services, maritime and aviation logistics, ports and border management across multiple NATO member states. The aim was to collect information on the "type, quantity, and routing of assistance entering Ukraine", the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said. Hundreds of organisations were probed, many of them in transportation and technology.

To gain access, the Russian hackers used traditional phishing tactics, tried to guess user credentials, and looked for vulnerabilities in mail servers. In one novel twist, they targeted internet-connected surveillance cameras, believed to be at Ukrainian border stations, to covertly watch the movement of aid convoys.

"The campaign has disrupted coordination, transport, and delivery of foreign assistance to Ukraine," an NCSC official said. "This is a serious effort to degrade practical support for Kyiv's resistance."

The international agencies recommended all logistics and related tech firms in the affected sectors take immediate action to monitor for intrusion attempts, install multi-factor authentication for all emails, and patch up any vulnerable networks.

"Do not leave any backdoor open for the Russians to exploit," the NCSC told companies. The NCSC also highlighted that in some cases, Russian intelligence had scanned for entry points in as little as 18 minutes after a software vulnerability was made public.

The Associated Press reported that Russia denies any involvement or responsibility for the cyber activity.