Russian group targeted COVID-19 vaccine research in Canada, U.S. and U.K., say intelligence agencies

A hacker group "almost certainly" backed by Russia has tried to steal COVID-19-related vaccine research in Canada, the U.K. and the U.S., according to intelligence agencies in all three countries.

Hacker group APT29 — also known as Cozy Bear and the Dukes — accused of conducting malicious attacks

Russia blamed for attempted hack on COVID-19 vaccine research

3 years ago
Duration 1:54
Canada, the U.K. and the U.S. are blaming Russia for hacking attempts on COVID-19 vaccine research — either to use the information in its own research or to undermine other countries’ efforts.

A hacker group "almost certainly" backed by Russia is trying to steal COVID-19-related vaccine research in Canada, the U.K. and the U.S., according to intelligence agencies in all three countries.

The Communications Security Establishment (CSE), responsible for Canada's foreign signals intelligence, said APT29 — also known as Cozy Bear and the Dukes — is behind the malicious activity.

The group was accused of hacking the Democratic National Committee before the 2016 U.S. election.

APT29 "almost certainly operates as part of Russian intelligence services," the CSE said in a statement released Thursday morning in co-ordination with its international counterparts — an allegation the Kremlin immediately denied.

"These malicious cyber activities were very likely undertaken to steal information and intellectual property relating to the development and testing of COVID-19 vaccines, and serve to hinder response efforts at a time when health care experts and medical researchers need every available resource to help fight the pandemic," the CSE statement says.

APT29 "is likely to continue to target organizations involved in COVID-19 vaccine research and development, as they seek to answer additional intelligence questions relating to the pandemic," said a joint assessment from the CSE, the United Kingdom's National Cyber Security Centre and the National Security Agency in the U.S.

When asked if the malicious hits were successful and which facilities in Canada were targeted, a spokesperson said the CSE is generally "not able to comment on, or confirm details about specific cybersecurity incidents."

WATCH: U.K. condemns Russia for cyber attacks on COVID-19 vaccine developers

U.K. condemns Russia for cyberattacks on COVID-19 vaccine developers

3 years ago
Duration 0:37
U.K. Foreign Secretary Dominic Raab said it was 'pretty appalling' of Russia to be involved in the cyberattacks on Britain, Canada and the U.S.

In response to CBC's inquiries, CSE spokesperson Evan Koronewski did point to a recent threat bulletin that reported a Canadian biopharmaceutical company was compromised by a foreign cyber threat actor back in mid-April.

Public Safety Minister Bill Blair said he doesn't believe the alleged attack set back Canada's research.

"But it's a useful reminder to all of those scientists and industries right across Canada who are working very diligently to find that vaccine. Canadians and the world need it. It's important work," he told a news conference in Ottawa.

"We remain concerned. Not just the Russians targeting it, but other foreign actors as well. There are unfortunately people in this world who don't play by the rules and represent a risk — even a threat — to Canadian interests and to everyone's interests."

Watch | Blair asked about Russian cyber attack on Canadian COVID-19 vaccine labs

Bill Blair is asked about Russian cyber attack on Canadian COVID-19 vaccine labs

3 years ago
Duration 1:19
Federal Public Safety Minister Bill Blair spoke with reporters by video conference on Thursday.

The three targeted countries said the Russian actors have been using custom malware known as WellMess and WellMail to attack a number of organizations globally during the pandemic.

The head of Britain's cyber security centre, Paul Chichester, said the allies "condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic."

Previous warnings

In May, the CSE said authorities were investigating possible security breaches at Canadian organizations doing COVID-19-related research but did not say who was behind the attacks or where they were coming from.

The agency has been warning since the start of the COVID-19 crisis that Canadian intellectual property linked to the pandemic is a "valuable target" for state-sponsored actors.

U.K. Foreign Secretary Dominic Raab said if Russia wants to rejoin international forums, "it needs to live up to its international responsibilities."

"I think it's important to call it out because we're not going to wait until there is harm," he told reporters earlier today.

"It's clearly wrong, contrary to international law, contrary to Russia's responsibilities as a member of the international community — and indeed a permanent member of the [UN] Security Council —  to be targeting with cyber attacks the international effort, not just here in the UK, but in Canada, in the U.S., to try and find a vaccine, which is for the greater good of the world."

Defence Minister Harjit Sajjan and Foreign Affairs Minister François-Philippe Champagne issued a statement this afternoon calling out "malicious state actors attempting to steal information and intellectual property." The statement doesn't cite Russia by name.

"We must call out irresponsible state behaviour that violates the rules-based international order and strive to live and work in a cyber environment that is open, stable, peaceful and secure," the statement reads.

"In Canada, we are committed to defending these principles in cyberspace, especially when they touch on the interests of Canadians."

The Russian news agency RIA said Russian President Vladimir Putin's spokesperson Dmitry Peskov denied the allegations, which he said were not backed up by proper evidence.

The CSE says Canadian health organizations should read its advisory and take necessary actions to protect themselves, and contact the Cyber Centre if they suspect they have been targeted.

With files from Reuters

Add some “good” to your morning and evening.

A variety of newsletters you'll love, delivered straight to you.

Sign up now


To encourage thoughtful and respectful conversations, first and last names will appear with each submission to CBC/Radio-Canada's online communities (except in children and youth-oriented communities). Pseudonyms will no longer be permitted.

By submitting a comment, you accept that CBC has the right to reproduce and publish that comment in whole or in part, in any manner CBC chooses. Please note that CBC does not endorse the opinions expressed in comments. Comments on this story are moderated according to our Submission Guidelines. Comments are welcome while open. We reserve the right to close comments at any time.

Become a CBC Account Holder

Join the conversation  Create account

Already have an account?