The SSU Cyber Security Department identified hackers of the notorious ARMAGEDON group, which carried out over 5,000 cyber attacks against public authorities and critical infrastructure of Ukraine. They are officers of the ‘Crimean’ FSB and traitors who defected to the enemy during the occupation of the peninsula in 2014.

The SSU has managed to identify the perpetrators’ names, intercept their communication and obtain irrefutable evidence of their involvement in the attacks. All of that, despite the fact that they used the FSB’s own malicious software and tools to remain anonymous and hidden online.

5 members of the group have been notified of suspicion of treason.

The ARMAGEDON hacker group is an FSB special project, which specifically targeted Ukraine. This ‘line of work’ is coordinated by the FSB’s 18th Center (Information Security Center) based in Moscow.

Since the Russian aggression in 2014, this unit has carried out over 5,000 cyber attacks and attempted to infect over 1,500 government computer systems. The attackers’ goals were:

• control over critical infrastructure facilities (power plants, heat and water supply systems);
• theft and collection of intelligence, including information with restricted access (related to security and defence sector, government agencies);
• informational and psychological influence;
• blocking information systems.

The investigation and forensic examinations are underway to bring the FSB employees to justice for the following crimes: espionage; unauthorized interference in the work of computers, automated systems, etc.; creation of malicious software or hardware for use, distribution or sale.

The SSU is continuously taking steps to contain and neutralize Russia’s cyber aggression against Ukraine.

The SSU Cyber ​​Security Department, the SSU investigators carried out the operation jointly with the Main Intelligence Directorate of the Ministry of Defense of Ukraine and under the supervision of the Prosecutor General’s Office.

Technical report Armagedon.