UK Ambulance Services targeted by Kremlinprotected Russian hackers

Log In
Subscribe
News
Politics
Opinion
Culture
Money
Sport
Life & More
Puzzles
Newsletters
UKWorldScotlandHealthEducationTechnologyScienceEnvironmentBusiness



UK Ambulance Services targeted by Kremlin-protected Russian hackers
ExclusiveA cyber security expert warns the hack, uncovered by i, presents a 'terrible threat to public health safety'

An i investigation has uncovered how Kremlin-protected cyber hackers have targeted ambulance services and the Ministry of Defence
author avatar image
By Richard Holmes
Senior Reporter
October 11, 2024 2:16 pm(Updated 7:47 pm)
UK ambulance services have been targeted by Russian hackers, risking disruption to their communication systems, with the potential to severely hamper Britain’s emergency services.

Intelligence material seen by i shows that over the past 12 months, a Kremlin-protected hacking network has targeted key suppliers to the UK Ambulance Services and Ministry of Defence (MoD).

This week, MI5 director Ken McCallum announced that Russia is on a “sustained mission” to create “mayhem” across Britain and Europe.


i gained rare exclusive access to a large database of previously stolen information used by hackers to identify and target a key supplier to the Ambulance Radio Programme (ARP), which connects ambulances to the NHS and other emergency responders.

The hackers, according to intelligence seen by i, were able to access email threads discussing the ARP, and details of key personnel and components involved in its security, exposing some of the inner workings of UK Ambulance Services’ secure communication systems.

Read Next
Home Office was warned about NHS cyber hacks months before Kremlin-backed attack
News
ExclusiveHome Office was warned about NHS cyber hacks months before Kremlin-backed attack
Read More
The extracted information significantly increases the risk of further attacks on the ARP which could crash the system. This would have the potential to leave ambulance command centres unable to communicate with drivers and the police or fire services, or prevent them from receiving vital information about the precise location of major incidents, four UK intelligence sources told i.

Dr Saif Abed of The AbedGraham Group, a former NHS doctor and renowned healthcare cyber security expert, said the hack presents a “terrible threat to public health safety at scale”. He called on the Government to launch an inquiry into the resilience of the UK’s public health against cyber threats.

“The NHS and ambulance services are already under pressure to meet life-saving targets and this type of cyber attack could be catastrophic,” Dr Abed told i.

The UK Ambulance Services, Department of Health, Ministry of Defence and the National Cyber Security Centre (NCSC) referred i to the Cabinet Office, which declined comment. A government source said they did not recognise the claims made by i and they take a robust response to cyber threats.

The incident, revealed today for the first time, is believed to form part of a new Russian cyber warfare campaign dubbed by UK intelligence sources “Cyber Wagner”, in reference to the hardline Russian mercenary group run by the late Yevgeny Prigozhin.

“This is the new front in Russia’s aggression against the West,” a Western intelligence source monitoring the activity told i. “We need to prepare Western states for more aggression and hybrid warfare from Moscow.”

On Tuesday, Mr McCallum made a speech outlining the threats the country is facing. The UK spy chief said a decrease in footprint of Kremlin spies in Britain has made cyber tactics “ever more important” to Russian intelligence agencies.

“My teams and their colleagues in the National Cyber Security Centre are on the case,” he said. “But we should expect further testing – and in places defeating – of the West’s cyber defences.”

Hybrid war by Russian hackers
An i investigation based on exclusive access to the inner workings of the hacking syndicate – including internal communications and attack methods – today exposes how the Russian government is continuing to utilise cyber crime groups to launch a new hybrid war against its adversaries.

A Russian store of stolen data contains the bounty from more than 30 million cyber incidents since 2018 – and includes vast amounts of secret information from the UK. The data provides hackers with a treasure trove of intelligence, including key individuals, emails and passwords, so they can launch attacks against specific targets, a UK intelligence source told i.

In December last year the group successfully infiltrated the internal communications between a key supplier of sensitive IT systems to the Ministry of Defence and Nato, potentially exposing secret details of ongoing operations.

The hacked firm, which i is not naming for national security reasons, provides secret IT systems used to support British warships, as well as secure servers for use in Nato intelligence operations.

In recent months, the login details of more than 70,000 government employees working within Whitehall departments were stolen. Using the data, hackers have posed as staff members to launch further phishing campaigns against specific departments at will, according to intelligence seen by i.

Sources say they have seen an uptick in activity in response to the increased use of Western weapons in Ukraine.

“This changes the game entirely,” a UK intelligence source said. “This not only allows Russia to direct their cyber weapons where they want to, but also shows them the specific ammunition needed to penetrate our most vital systems.”


Hackers enjoy a safe haven in Russia, from where they carry out ransomware attacks
The revelations come just months after i disclosed how hackers behind a catastrophic NHS cyber attack in the summer were part of a wider cyber army working under the Kremlin’s protection trying to destabilise the UK.

In June, healthcare services were disrupted across London after a major cyber attack targeted Synnovis, a pathology testing organisation, severely affecting services including at several major hospitals in the capital.

Qilin, which was held responsible for the assault, is merely one arm of the wider web of hacking affiliates, using servers based in Russia to carry out attacks on UK critical infrastructure.

The hackers said the incident was in response to “unspecified wars”. The attack on the NHS was a “major escalation” of the Kremlin’s use of cyber warfare, according to investigators, whose work i was given access to.

Last month i gained access to a cache of intelligence – including a rare and detailed insight into the extent of stolen data being stored by Russian cyber criminals – to reveal how a large-scale information campaign is stealing swathes of data from critical UK services, posing a severe threat to the country.

Read Next
How Putin is taking advantage of climate change to support Russia’s ambitions
John Lough
How Putin is taking advantage of climate change to bolster Russia’s ambitions
Read More
A UK intelligence source said they believed Vladimir Putin was using crime groups as a tool to attack adversaries so the Kremlin can steal secrets and direct the groups back out to attack more specific targets.

The UK was not readily prepared to deal with the “catastrophic” impact the hacking group could have on critical infrastructure, they warned.

“This is the new front by which Russia is attacking its enemies,” they told i. “The UK is not yet in a place to properly combat this challenge.”

Another UK source expressed worries about the Government’s lack of resilience against sophisticated cyber warfare.

“There is serious concern over the widespread and persistent public data exfiltration from the UK,” they said. “This proxy war of Russian affiliates accelerates their ability to conduct mass data exfiltration operations with complete obfuscation.”

The threat has become a top priority for UK intelligence agencies, i has learnt.

The intelligence was shared with i amidst pressing concern over the UK’s current response to Russia’s cyber warfare. The names of individual companies infiltrated by hackers have been left out of reporting to help further protect UK national security.

In April last year, the NCSC warned that a “new class” of “state-aligned” Russian cyber adversary had emerged. The warning highlighted the activity of hackers sympathetic to Russia’s invasion of Ukraine who are ideologically, rather than financially, motivated.

“Although these groups can align to Russia’s perceived interests, they are often not subject to formal state control, and so their actions are less constrained and their targeting broader than traditional cyber crime actors,” the NCSC warned. “Some have stated a desire to achieve a more disruptive and destructive impact against western critical national infrastructure.”

The networks are mainly Russian-based but some elements of the group work out of nations across Eastern Europe, including Belarus and Moldova. However, all stolen information flowed back to servers based in Russia, intelligence seen by i showed.

The Kremlin is thought to have access to the database and is enabling the hacking army in its attack on Western governments and firms. There is no evidence to suggest the Russian state is explicitly directing hacking groups.

Alon Gal, founder of Israeli cyber threat intelligence firm Hudson Rock, said the large store of stolen data enables a “vast array of sensitive information” to be “easily exploited” by state-protected groups.

“We’ve consistently seen how data from Infostealer infections [a form of malicious software] provides an entry point for deeper attacks, ranging from ransomware deployments to data thefts,” he told i. “It’s no stretch to imagine that governments may leverage this data to carry out cyberattacks, espionage, or other covert activities.”

Topics
Cyber AttacksCyber CrimeHackersHackingRussiaSpyingSubscribers
Editor's Picks
Article thumbnail
Lifestyle
First PersonI'm fat - here's why I won't take a weight-loss jab
Article thumbnail: LONDON, ENGLAND - OCTOBER 16: Thomas Tuchel, Manager of England, speaks to the media during a press conference as he is announced as the new England manager at Wembley Stadium on October 16, 2024 in London, England. (Photo by Ryan Pierse/Getty Images)
Football
‘Football's motherland has a German dad’: Germany reacts to England hiring Tuchel
Article thumbnail: rivals jilly cooper filming location cotswolds
Travel
I've read Rivals 40 times – this Cotswolds town is the perfect filming location

Most Popular
Article thumbnail: Sir Keir Starmer and his wife at "Taylor Swift | The Eras Tour" concert at Wembley Stadium 21 June 2024 Image from X formerly Twitter Keir Starmer @Keir_Starmer ?Jun 21 ?Swift? campaign pitstop. https://x.com/Keir_Starmer
Opinion
Our braincells can’t withstand any more of these vacuous attacks on Starmer
Article thumbnail
News
Happy on Snapchat, then he was gone: Liam Payne’s last posts
Article thumbnail: FILE - OCTOBER 16: Singer Liam Payne, a former member of One Direction, died after falling from a hotel in Buenos Aires, Argentina. He was 31 years old. LONDON, ENGLAND - SEPTEMBER 03: Liam Payne visits the Kiss FM Studio's on September 03, 2019 in London, England. (Photo by Jeff Spicer/Getty Images for ABA )
News
Ex-One Direction star Liam Payne dead after falling from balcony in Argentina
Article thumbnail
News
'Just a boy': Stars pay tribute after Liam Payne's 'heartbreaking' death
Article thumbnail: This image is strictly embargoed from publication until 00.01 Tuesday 30th April 2019 From Spungold Productions THE ALL NEW MONTY LADIES NIGHT: WHO BARES WINS Tuesday 7th May 2019 on ITV Pictured: Top row (L-R) Megan Barton-Hanson, Laurie Brett, Danielle Armstrong, Crissy Rock, Lisa Maffia, Bottom row (L-R) Victoria Derbyshire, Martina Navratilova and Coleen Nolan As the men prepare to reveal all for ITV?s The All New Monty 2019: Who Bares Wins, a group of brave women celebrities are getting ready to outdo their male counterparts in baring all for The All New Monty Ladies Night: Who Bares Wins. Legendary tennis icon Martina Navratilova, EastEnders star Laurie Brett, Love Island?s Megan Barton-Hanson, So Solid Crew?s Lisa Maffia, TOWIE?s Danielle Armstrong, and Benidorm?s Crissy Rock are gearing up to put their inhibitions aside and lay their bodies and emotions bare, to boost awareness of women?s cancers. Planning a brand-new routine for this award-winning show, Coleen Nolan, Victoria Derbyshire and Ashley Banjowill be showing the ladies the ropes and providing support and motivation to inspire them to put on the performance of their lives and, in doing so, encourage women to examine their breasts, have regular cervical smear checks and be more health aware regarding their bodies. This year Coleen and Victoria are determined that their women, for all of whom women?s cancers are close to their hearts, will make Ladies Night bigger and better than ever before and are planning to out-dance and out-perform the men to prove She Who Bares, Wins! ? ITV This photograph is ? ITV and can only be reproduced for editorial purposes directly in connection with the programme THE ALL NEW MONTY LADIES NIGHT: WHO BARES WINS or ITV. Once made available by the ITV Picture Desk, this photograph can be reproduced once only up until the Transmission date and no reproduction fee will be charged. Any subsequent usage may incur a fee. This photograph must not be syndicated to any other publication or website, or permanently archived, without the express written permission of ITV Picture Desk. Full Terms and conditions are available on the website www.itv.com/presscentre/itvpictures
Opinion
How I live a life with no regrets - even dancing topless
Article thumbnail: Pensioner Linda Southall fears she won't ever be able to afford to retire
Pensions and Retirement
I'm still working at 67 - the state pension boost won't touch the sides for me
Article thumbnail: A close up of a woman wearing red lipstick pouting with her eyes closed about to kiss
Opinion
Kissing has become a class issue – and posh people are weaponising it
Article thumbnail: Democratic presidential nominee Vice President Kamala Harris speaks during a stop at Cred Cafe, a local Detroit small business owned by former NBA players Joe and Jamal Crawford, in Detroit, Tuesday, Oct. 15, 2024. (AP Photo/Jacquelyn Martin)
Opinion
The sobering reality of Kamala Harris's poll lead
Article thumbnail: CUMMING, GEORGIA - OCTOBER 15: Republican presidential nominee, former President Donald Trump attends a townhall event hosted by Fox News on October 15, 2024 in Cumming, Georgia. Trump and Democratic opponent Vice President Kamala Harris have scheduled multiple events in battleground states ahead of the November 5 election. (Photo by Megan Varner/Getty Images)
World
Donald Trump’s three biggest claims during his all female town hall in Georgia
Article thumbnail: India's KL Rahul walks back to the pavilion after his dismissal during the second day of the first Test cricket match between India and New Zealand at the M. Chinnaswamy Stadium in Bengaluru on October 17, 2024. (Photo by IDREES MOHAMMED / AFP) / -- IMAGE RESTRICTED TO EDITORIAL USE - STRICTLY NO COMMERCIAL USE -- (Photo by IDREES MOHAMMED/AFP via Getty Images)
Cricket
India skittled for 46 by rampant New Zealand in record low home score


Essentials
News
Sport
Lifestyle
Culture
Opinion
Puzzles
Useful links
Contact Us
About
Advertise
i Print Subscriptions
iRewards
i app
i Student Digital Subscription
Sitemap
Newsletters
Saved Articles
Manage account
Follow us on
All rights reserved. © 2024 Associated Newspapers Limited.

Cookie Settings
Do not sell or share my personal information
Terms and Conditions
Privacy Policy