Department of Justice Charges 6 Russian GRU Agents for Cyberattacks on French Elections, Olympics , FedEx and More

Andrew Harnik/Getty Images

The Department of Justice announced Monday that it is charging six Russian hackers accused of wreaking havoc for years with attacks aimed at FedEx, several national governments, and the 2018 Olympic Games.

“No country has weaponized its cyber capabilities as maliciously or irresponsibly as Russia, wantonly causing unprecedented damage to pursue small tactical advantages and to satisfy fits of spite,” Assistant Attorney General for National Security John C. Demers said in a statement. “Today the department has charged these Russian officers with conducting the most disruptive and destructive series of computer attacks ever attributed to a single group, including by unleashing the NotPetya malware. No nation will recapture greatness while behaving in this way.”

The six men, aged 27 to 35, are allegedly members of the Russian Main Intelligence Directorate (GRU), the same military intelligence agency previously accused by U.S. intelligence of hacking the Democratic Congressional Campaign Committee, the Democratic National Committee, and former Hillary Clinton Campaign Chairman John Podesta during the 2016 presidential election.

Andrew Harnik/Getty Image

Officials said the men were responsible for attacks that took place over a period of five years, including 2015 and 2016 attacks against Ukraine’s electric grid; 2017 attacks in France aimed at undermining President Emmanuel Macron’s political party during French elections; and attacks on the 2018 Olympics in South Korea, which took place after the International Olympic Committee banned Russia from participating due to the use of performance-enhancing drugs by some of its athletes.

The 2017 NotPetya attack, which resulted in around $1 billion in damage, was the most destructive incident for which the Justice Department said the men were responsible. Malware in that case began in Ukraine but spread to institutions around the world, including hospitals in the United States and to private companies including FedEx, which said it lost $400 million as a result of the attack.

The group is also accused of hacking institutions in France, Georgia, the Netherlands, and the United Kingdom. The charges in the case, which include wire fraud and conspiracy to commit computer fraud and abuse, carry sentences ranging from five to 27 years in prison.

“The FBI has repeatedly warned that Russia is a highly capable cyber adversary, and the information revealed in this indictment illustrates how pervasive and destructive Russia’s cyber activities truly are,” said FBI Deputy Director David Bowdich. “But this indictment also highlights the FBI’s capabilities. We have the tools to investigate these malicious malware attacks, identify the perpetrators, and then impose risks and consequences on them. As demonstrated today, we will relentlessly pursue those who threaten the United States and its citizens.”

The six men indicted all reside in Russia, which means they are unlikely to stand trial. But it is not the first time the U.S. has indicted members of the military unit. The Justice Department similarly indicted 12 alleged GRU members in 2018 on charges of hacking in the 2016 election, a result of the investigation by former Special Counsel Robert Mueller.