Revealed: UK Ambulance Services targeted by Kremlin-protected Russian hackers

UK ambulance services have been targeted by Russian hackers, risking disruption to their communication systems, with the potential to severely hamper Britain’s emergency services.

Intelligence material seen by i shows that over the past 12 months, a Kremlin-protected hacking network has targeted key suppliers to the UK Ambulance Services and Ministry of Defence (MoD).

This week, MI5 director Ken McCallum announced that Russia is on a “sustained mission” to create “mayhem” across Britain and Europe.

i gained rare exclusive access to a large database of previously stolen information used by hackers to identify and target a key supplier to the Ambulance Radio Programme (ARP), which connects ambulances to the NHS and other emergency responders.

The hackers, according to intelligence seen by i, were able to access email threads discussing the ARP, and details of key personnel and components involved in its security, exposing some of the inner workings of UK Ambulance Services’ secure communication systems.

Read Next

[Home Office was warned about NHS cyber hacks months before Kremlin-backed attack](https://wp.inews.co.uk/wp-content/uploads/2024/06/SEI_210216227.jpg?crop=4px%2C0px%2C1912px%2C1080px&resize=640%2C360)

The extracted information significantly increases the risk of further attacks on the ARP which could crash the system. This would have the potential to leave ambulance command centres unable to communicate with drivers and the police or fire services, or prevent them from receiving vital information about the precise location of major incidents, four UK intelligence sources told i.

Dr Saif Abed of The AbedGraham Group, a former NHS doctor and renowned healthcare cyber security expert, said the hack presents a “terrible threat to public health safety at scale”. He called on the Government to launch an inquiry into the resilience of the UK’s public health against cyber threats.

“The NHS and ambulance services are already under pressure to meet life-saving targets and this type of cyber attack could be catastrophic,” Dr Abed told i.

The UK Ambulance Services, Department of Health, Ministry of Defence and the National Cyber Security Centre (NCSC) referred i to the Cabinet Office, which declined comment. A government source said they did not recognise the claims made by i and they take a robust response to cyber threats.

The incident, revealed today for the first time, is believed to form part of a new Russian cyber warfare campaign dubbed by UK intelligence sources “Cyber Wagner”, in reference to the hardline Russian mercenary group run by the late Yevgeny Prigozhin.

“This is the new front in Russia’s aggression against the West,” a Western intelligence source monitoring the activity told i. “We need to prepare Western states for more aggression and hybrid warfare from Moscow.”

On Tuesday, Mr McCallum made a speech outlining the threats the country is facing. The UK spy chief said a decrease in footprint of Kremlin spies in Britain has made cyber tactics “ever more important” to Russian intelligence agencies.

“My teams and their colleagues in the National Cyber Security Centre are on the case,” he said. “But we should expect further testing – and in places defeating – of the West’s cyber defences.”

Hybrid war by Russian hackers

An i investigation based on exclusive access to the inner workings of the hacking syndicate – including internal communications and attack methods – today exposes how the Russian government is continuing to utilise cyber crime groups to launch a new hybrid war against its adversaries.

A Russian store of stolen data contains the bounty from more than 30 million cyber incidents since 2018 – and includes vast amounts of secret information from the UK. The data provides hackers with a treasure trove of intelligence, including key individuals, emails and passwords, so they can launch attacks against specific targets, a UK intelligence source told i.

In December last year the group successfully infiltrated the internal communications between a key supplier of sensitive IT systems to the Ministry of Defence and Nato, potentially exposing secret details of ongoing operations.

The hacked firm, which i is not naming for national security reasons, provides secret IT systems used to support British warships, as well as secure servers for use in Nato intelligence operations.

In recent months, the login details of more than 70,000 government employees working within Whitehall departments were stolen. Using the data, hackers have posed as staff members to launch further phishing campaigns against specific departments at will, according to intelligence seen by i.

Sources say they have seen an uptick in activity in response to the increased use of Western weapons in Ukraine.

“This changes the game entirely,” a UK intelligence source said. “This not only allows Russia to direct their cyber weapons where they want to, but also shows them the specific ammunition needed to penetrate our most vital systems.”

ImageHackers enjoy a safe haven in Russia, from where they carry out ransomware attacksThe revelations come just months after i disclosed how hackers behind a catastrophic NHS cyber attack in the summer were part of a wider cyber army working under the Kremlin’s protection trying to destabilise the UK.

In June, healthcare services were disrupted across London after a major cyber attack targeted Synnovis, a pathology testing organisation, severely affecting services including at several major hospitals in the capital.

Qilin, which was held responsible for the assault, is merely one arm of the wider web of hacking affiliates, using servers based in Russia to carry out attacks on UK critical infrastructure.

The hackers said the incident was in response to “unspecified wars”. The attack on the NHS was a “major escalation” of the Kremlin’s use of cyber warfare, according to investigators, whose work i was given access to.

Last month i gained access to a cache of intelligence – including a rare and detailed insight into the extent of stolen data being stored by Russian cyber criminals – to reveal how a large-scale information campaign is stealing swathes of data from critical UK services, posing a severe threat to the country.

Read Next

[Ukrainian forces target Russian oil depot in occupied Luhansk](https://wp.inews.co.uk/wp-content/uploads/2024/10/SEI_224567171.jpg?crop=0px%2C61px%2C1200px%2C677px&resize=640%2C360)

A UK intelligence source said they believed Vladimir Putin was using crime groups as a tool to attack adversaries so the Kremlin can steal secrets and direct the groups back out to attack more specific targets.

The UK was not readily prepared to deal with the “catastrophic” impact the hacking group could have on critical infrastructure, they warned.

“This is the new front by which Russia is attacking its enemies,” they told i. “The UK is not yet in a place to properly combat this challenge.”

Another UK source expressed worries about the Government’s lack of resilience against sophisticated cyber warfare.

“There is serious concern over the widespread and persistent public data exfiltration from the UK,” they said. “This proxy war of Russian affiliates accelerates their ability to conduct mass data exfiltration operations with complete obfuscation.”

The threat has become a top priority for UK intelligence agencies, i has learnt.

(continues in next comment)