Danish companies, organizations, and authorities are being warned about a specific unit within the Russian intelligence service due to an increased cyber threat. The Danish Defence Intelligence Service (FE) has collaborated with several Western intelligence agencies on a new report highlighting a Russian-sponsored hybrid warfare campaign.

The report identifies Unit 26165, part of Russia’s GRU intelligence service, as the main perpetrator of these cyber operations. This unit, also known as APT28, Fancy Bear, Forest Blizzard, and BlueDelta, has been conducting widespread cyber espionage for over two years.

The FE has observed numerous cyberattacks against organizations involved in supporting Ukraine since Russia’s invasion. The intelligence service has also noted Russian cyber espionage aimed at preparing for potential conflict with NATO, targeting the Armed Forces and its partners.

Critical infrastructure in Denmark is also at risk. State-sponsored Russian hacker groups are likely engaging in cyber espionage against organizations within this sector to prepare for destructive cyberattacks in the event of escalating conflict or crisis.

The cyberattacks employ tactics such as bombarding IT systems with numerous password attempts and targeted phishing attacks to extract sensitive information. Unit 26165 has expanded its attacks on logistics entities and technology companies involved in supporting Ukraine, including monitoring aid deliveries using Internet-connected cameras at Ukrainian border crossings.

The report is a result of a collaboration between FE and a number of American and European intelligence services and cyber authorities, including the NSA and FBI. The report aims to raise awareness of the cyber threat from Russia and provide information on how organizations can protect themselves.

Russia’s ambassador to Denmark, Vladimir Barbin, has denied the allegations against GRU and Unit 26165. He claims that the FE’s approach to cybersecurity issues is politicized and exaggerates the Russian threat. He further suggests that Denmark’s challenges may stem from other sources, referencing cable cooperation between Denmark and the USA and developments around Greenland.