CyberBerkut: what is on the public record

Who CyberBerkut is

CyberBerkut took its name from the Berkut, the riot police that former Ukrainian President Viktor Yanukovych deployed against protesters in Kyiv in 2013 and 2014. The group appeared online that year, during Russia's annexation of Crimea and the war in eastern Ukraine, presenting itself as Ukrainian opponents of the new government in Kyiv. It posted claims of attacks and leaked documents on its own websites and social media.

Who is behind it?

On October 4, 2018 the UK government and its National Cyber Security Centre published an assessment of Russian military intelligence activity. It listed names it said were associated with the GRU, among them APT28, Fancy Bear, Sandworm and Cyber Berkut, and said it assessed with high confidence that the GRU was almost certainly responsible for a series of attacks. The UK did not publish the underlying evidence. Earlier, after the January 2015 attack on German sites, Ukraine's prime minister publicly blamed Russian intelligence, as The Register reported, while the group's own claim could not be independently verified at the time.

Incidents attributed to or claimed by CyberBerkut

Ukraine's 2014 presidential election. The Christian Science Monitor reported that CyberBerkut claimed to have broken into Ukraine's Central Election Commission computers days before the May 25, 2014 vote and to have destroyed parts of its network. Ukrainian officials said government experts removed hidden software that would have displayed a false result showing the far-right candidate Dmytro Yarosh in the lead, about 40 minutes before results were due. DDoS attacks also hit the results system on election night. Some experts quoted by the paper said there was no solid public proof of the fake-results claim. International observers still judged the vote genuine.

German government websites, 2015. On January 7, 2015 the websites of Chancellor Angela Merkel and the Bundestag were knocked offline for hours in a DDoS attack. CyberBerkut claimed it and demanded that Germany stop supporting Ukraine's government. The attack came hours before Ukraine's prime minister, Arseniy Yatsenyuk, was due in Berlin. Radio Free Europe and Reuters, via Voice of America, reported that the claim could not be independently verified.

The group also published material it said came from hacked Ukrainian and Western officials' accounts. We have not listed individual leaks because their authenticity has not been independently established in sources we could check.

How the group operated

• DDoS attacks: flooding sites with traffic to knock them offline, as in the German case. See the glossary for the term.
• Intrusions and leaks: claiming to break into systems and publishing documents, sometimes alongside messages for propaganda effect.
• Public claims: announcing operations on its own sites, which made its activity visible but also hard to verify.

Why it matters

CyberBerkut is an early example of a pattern later seen more widely: a group that presents itself as independent activists while governments assess it as a front for a state agency. For the wider picture, see cyber attacks and our hackers overview.