U.S. Offers $10M for Info on Five State-Backed Russian Hackers

The U.S. government has indicted five Russian military intelligence officers from the GRU and one civilian for their role in a series of cyberattacks on Ukraine and NATO countries. In connection with this, the U.S. Department of State is offering a reward of up to $10 million for any information leading to their capture or details about their cyber activities. These individuals are accused of orchestrating attacks designed to undermine Ukraine’s governmental systems and critical infrastructure ahead of Russia’s 2022 invasion.

The charges were unsealed by a Maryland grand jury, revealing that five of the accused belong to Unit 29155, a notorious cyber division within the GRU (Russian Main Intelligence Directorate). The sixth defendant, a civilian, is charged with conspiracy to commit computer intrusion. The group allegedly targeted multiple Ukrainian government agencies and global entities supporting Ukraine, using a malware known as WhisperGate. The U.S. Department of Justice (DoJ) stated that the WhisperGate campaign was part of Russia’s broader effort to destabilize Ukraine and disrupt the country’s digital infrastructure, particularly before and during the early stages of the invasion.

The indictment is part of a broader international initiative named Operation Toy Soldier, aiming to curb cyber threats stemming from GRU hackers. According to the DoJ, the cyberattacks started as early as January 2022, when the defendants breached various Ukrainian government networks, including the Ministry of Internal Affairs, the State Treasury, and the Ministry of Education, among others. These attacks, using WhisperGate, were framed as ransomware incidents but were in fact designed to destroy data completely, sowing fear among Ukrainian citizens about their data's security.

These malicious activities did not stop at Ukraine's borders. The hackers also probed systems across twenty-six NATO countries, hunting for vulnerabilities, and even compromised a Central European country’s transportation infrastructure. Moreover, U.S. authorities revealed that the group probed systems within U.S. critical infrastructure, particularly focusing on sectors such as energy, government, and aerospace.

The six defendants charged in this case are:

• Yuriy Denisov: Colonel in the Russian military and commanding officer for Unit 29155's cyber operations.
• Vladislav Borovkov: Lieutenant in the Russian military, also assigned to Unit 29155.
• Denis Denisenko: Lieutenant in Unit 29155, charged with cyber operations.
• Dmitriy Goloshubov: Another lieutenant in Unit 29155, specializing in cyber activities.
• Nikolay Korchagin: Lieutenant and key hacker in Unit 29155.
• Amin Sitgal: Civilian co-conspirator, facing wire fraud conspiracy charges.

The U.S. Department of State’s Rewards for Justice program is now offering up to $10 million for information about the whereabouts of the hackers or any intelligence that leads to their capture. This reward reflects the seriousness of the indictment and the U.S.’s commitment to curbing Russian cyber operations that threaten not only Ukraine but also Western infrastructure and security.