Over the past few months, Russian-linked hackers have hacked more than 170 email accounts belonging to prosecutors and investigators across Ukraine.
Over the past few months, Russian-linked hackers have hacked more than 170 email accounts belonging to prosecutors and investigators across Ukraine.
The hackers inadvertently left this data publicly available online, where it was discovered by specialists from Ctrl-Alt-Intel, a consortium of British and American cyber threat researchers, Reuters writes .
Ctrl-Alt-Intel stated that the data left on the server (including log files of successful hacking operations and thousands of stolen emails) indicate that between September 2024 and March 2026, hackers hacked at least 284 mailboxes of Ukrainian, Romanian, Greek, Bulgarian, and Serbian institutions.
Ctrl-Alt-Intel noted that the hackers' mistake provided a rare opportunity to study the mechanisms of the Russian espionage campaign.
The hackers “simply made a huge operational blunder,” Ctrl-Alt-Intel said. “They left the front door wide open.”
Ctrl-Alt-Intel attributed the hacking campaign to Fancy Bear, a nickname for a notorious Russian military intelligence unit. Two researchers who independently verified Ctrl-Alt-Intel's report, Mathieu Fau of ESET and Feike Hackebord of TrendAI, agreed that the hackers were linked to Moscow. However, Fau said he could not confirm the involvement of Fancy Bear, and Hackebord denied involvement in the specific group.
The hackers likely targeted Ukrainian law enforcement agencies either to get ahead of investigators working to expose Moscow spies or to gather potentially embarrassing information about senior officials in Kyiv, said Keir Giles, a junior fellow at the London-based think tank Chatham House, who reviewed the list of victims.
The hackers reportedly breached accounts belonging to the Specialized Defense Prosecutor’s Office, a wartime body created to combat corruption and expose spies in the Ukrainian military. They also targeted the National Agency for Asset Detection, Tracing and Management (ARMA), which oversees assets seized from criminals and Russian collaborators, and the Ukrainian Prosecutors’ Training Center in Kyiv.
According to the data, Yaroslava Maksymenko, who headed ARMA at the time, was among the victims. At the Prosecutors' Training Center, hackers hacked the mailboxes of 44 employees, including the center's deputy director, Oleh Duka.
The Russians reportedly stole information from at least one high-ranking official in the Specialized Anti-Corruption Prosecutor’s Office (SAP), an agency that has investigated some of Ukraine’s most high-profile corruption scandals, including the one that led to the resignation of President Volodymyr Zelensky’s chief of staff, Andriy Yermak, in November.
