Russian hackers hit 170+ Ukraine prosecutor accounts in spy breach

Russian hackers breached more than 170 email accounts belonging to Ukrainian prosecutors and investigators in recent months, Reuters reported on April 15, citing data uncovered by cyber researchers.

The leaked data, discovered by Ctrl-Alt-Intel, a group of British and American cyberthreat researchers, showed that at least 284 email accounts were compromised between September 2024 and March 2026. Most of the victims were in Ukraine, though others were in neighboring NATO countries and the Balkans.

Ctrl-Alt-Intel said the Russian hackers made a mistake by leaving open a so-called back door, giving researchers a way to examine how the espionage campaign operated.

The hackers likely targeted Ukrainian law enforcement agencies either to stay ahead of investigators trying to uncover Moscow’s spies or to gather potentially compromising material on senior officials in Kyiv, Keir Giles, a senior consulting fellow at the London-based think tank Chatham House, told Reuters.

The data showed that the hackers compromised accounts belonging to staff at the Specialized Anti-Corruption Prosecutor’s Office, or SAPO. They also targeted ARMA, the agency that manages assets seized from criminals and people seen as aiding Russia, as well as Kyiv’s prosecutor training center.

Among the victims was Yaroslava Maksymenko, who at the time headed ARMA. At the prosecutor training center, hackers breached the email accounts of 44 employees, including deputy director Oleh Duka.

The data showed that the Russians stole data from at least one senior SAPO official who was handling several of Ukraine’s highest-profile corruption cases, including one the report says led to the resignation of presidential chief of staff Andriy Yermak in November.

The data also showed that the hackers breached the email account of the central city hospital in Pokrovsk, a rail hub Russia is trying to capture, as well as the account of the city’s finance committee.

The campaign extended beyond Ukraine. The data showed that dozens of officials in neighboring NATO countries were also targeted. In Romania, hackers breached at least 67 email accounts belonging to the Romanian Air Force, including several linked to NATO air bases. In Greece, the spies compromised 27 email accounts overseen by the General Staff of National Defense, the country’s top military body.

If you find an error in the text, select it with the mouse and click Ctrl + Enter