On Friday, the Department of Justice unsealed two indictments charging four Russian government-based hackers in two separate conspiracies. The hack attacks on the global energy sector took place between 2012 and 2018.

These malicious hacking campaigns hit thousands of computers. And hundreds of companies and organizations were involved in 135 countries. 

The defendants worked for years to target and compromise the computer systems of energy sector companies.

In the years-long investigation, the FBI was able to identify the details of Russian hackers. They are all allegedly working directly for the Russian government.

The indictments were meant to be a "warning shot" to the Kremlin's hackers. 

The malware used by Russian government hackers

For years sophisticated attacks using Triton malware. And they presented a dangerous threat to critical infrastructures. 

The digital hackers attempted to sabotage industrial safety systems and gain access to critical infrastructure.

Four hackers were charged in the two now unsealed indictments.

The first was a June 2021 indictment in the District of Columbia, United States v. Evgeny Viktorovich Gladkikh.  It is alleged that Gladkikh and his co-conspirators attacked critical infrastructure outside the United States. This resulted in two separate emergency shutdowns at a foreign targeted facility. 

 Gladkikh is a Russian employed by the State Research Center of the Russian Federation FGUP Central Scientific Research Institute of Chemistry and Mechanics which is a branch of the Russian Ministry of Defense.

He is being charged with installing “backdoors.”  And then launching malware designed to compromise the safety of energy facilities.

The second unsealed indictment is for June 2021 in the state of Kansas. It was filed against Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov who allegedly work for the Russian Federal Security Service (FSB), which is a renaming of the KGB.

They are being charged with computer fraud and abuse, wire fraud, aggravated identity theft, and causing damage to the property of an energy facility.

These were high-level members of a Center 16 operational unit. And they were designated as “Dragonfly,” “Berzerk Bear,” “Energetic Bear,” and “Crouching Yeti” by cybersecurity researchers.

Center 16 was able to compromise the business network of the Wolf Creek nuclear power plant in Kansas. They did not make it into the operational network of the system.

US and UK partnered in investigation

 Deputy Attorney General Lisa O. Monaco said that “Russian state-sponsored hackers pose a serious and persistent threat to critical infrastructure both in the United States and around the world.”

 “Although the criminal charges unsealed today reflect past activity, they make crystal clear the urgent ongoing need for American businesses to harden their defenses and remain vigilant. Alongside our partners here at home and abroad, the Department of Justice is committed to exposing and holding accountable state-sponsored hackers who threaten our critical infrastructure with cyber-attacks,” she added.

The UK’s National Cyber Security Centre said that one of the attacks was launched at a petrochemical plant in Saudi Arabia with malware "designed specifically to target the planet's safety override." 

The NCSC said the malware "could cause significant impact, possibly including the release of toxic gas or an explosion, either of which could have resulted in a loss of life and physical damage to the facility."

Foreign Secretary Liz Truss announced that Great Britain will be sanctioning a subsidiary of the Russian defense ministry, in response to the attack on the Saudi plant.

Russia continues to deny involvement in the cyber-attacks alleged by the US, UK, and their allies.