Jeremy Hunt warns Russia it could face more sanctions after latest evidence of cyber-attacks

Details about the hacking of the Organisation for the Prohibition of Chemical Weapons[OPCW] were revealed today just hours after the UK Government accused the GRU, the Russian military intelligence agency, of carrying out a wave of other cyber-attacks across the globe.

Asked what actions, beyond words, the UK would take against Russia's cyber activity, the Foreign Secretary said the first action was to expose it.

"The words matter,” insisted Mr Hunt, “because there are countries all over the world that are hearing both sides of the story; they're hearing what the Russians say as well.

"This is the evidence; that what we are getting from Russia is fake news and here is the hard evidence of Russian military activity.”

He added: "But, of course, it will go beyond that and that is why we will be discussing with our allies what further sanctions should be imposed.

"We will also be discussing how we need - working with our friends and allies - to counter this pattern of cyber-attacks, which is the new type of attack that the whole world is having to deal with."

Officials in the Netherlands, where the OPCW is based, said four Russians had been expelled after the alleged cyber-strike.

The UK Government also accused one of those GRU officers escorted out of the Netherlands of targeting the Malaysian investigation into the shooting down of flight MH17 over Ukraine in 2014 when over 300 people travelling from Amsterdam to Kuala Lumpur died.

Ank Bijleveld, the Dutch Defence Minister, said that, after the Netherlands disrupted the Russian hacking attack, it expelled four Russian intelligence officers.

The team of four GRU officers travelling on official Russian passports entered the Netherlands on April 10.

On April 13 they parked a car carrying specialist hacking equipment outside the headquarters of the OPCW in The Hague.

At that point the Dutch counter-terrorism officers intervened to disrupt the operation and the four GRU officers were ordered to leave the country.

The "close access" hacking attempt, just a month after the Salisbury nerve agent attack, followed an earlier failed "spear-phishing attack" on the OPCW headquarters.

At a press conference in The Hague, Peter Wilson, the British ambassador to the Netherlands, said: "The disruption of this attempted attack on the OPCW was down to the expertise and the professionalism of the Dutch security services in partnership with the United Kingdom.

"The OPCW is a respected international organisation, which is working to rid the world of chemical weapons. Hostile action against it demonstrates complete disregard for this vital mission," he declared.

Tory backbencher Tom Tugendhat, Chairman of the Commons Foreign Affairs Committee, tweeted: "The catalogue of evidence shows why the Dutch are excellent partners and that the decades of theft have stripped Russia's intelligence of the skills they once had. Putin's corrupt greed has turned the GRU into an amateurish bunch of jokers."

But Maria Zakharova, the Russian Foreign Ministry spokeswoman, dismissed the new hacking accusations from the UK as "big fantasies".

Mr Wilson pointed out how the disruption of the GRU operation happened in April and around the time the OPCW was working to independently verify the UK’s analysis of the chemical weapons used in the poisoning of the Skripals in Salisbury.

Two of the Russian spies were planning to travel on to Switzerland where the OPCW - which was at the time also investigating a suspected chemical weapons attack in Syria - has laboratories.

The Dutch authorities released CCTV imagery of the four men arriving at Schipol Airport as well photographs of their passports.

They were named in them as Alekski Morenets and Evgenii Serebriakov, described as cyber-operators, and Oleg Soktnikov and Alexey Minin, described as humint[human intelligence] support staff.

The attempt on the OPCW headquarters followed unsuccessful "spearfishing" attacks by the GRU on the Foreign Office and on the defence laboratories at Porton Down, which was also investigating the Salisbury.

Mr Wilson said: "The OPCW was also due to conduct analysis of the chemical weapons attack in Douma on April 7.

"This was not an isolated act. The unit involved, known in the Russian military as unit 26165, has sent officers around the world to conduct brazen close access cyber operations."

The Netherlands' General Onno Eichelsheim told the press conference: "It's not always clear why they did the operation towards the OPCW because that does not show on their equipment.

"What I know is they were trying to target the OPCW networks in the period that they were investigating on the Skripals and on the Douma case."

Mr Wilson named one of the GRU officers escorted out of the Netherlands and said he had also carried out "malign activity" in Malaysia, stating: "This GRU operation was trying to collect information about the MH17 investigation.

"And targeted Malaysian government institutions, including the Attorney General's office and the Royal Malaysian Police."

In a joint statement Theresa May and her Dutch counterpart Mark Rutte said: "We have, with the operations exposed today, further shone a light on the unacceptable cyber activities of the Russian military intelligence service, the GRU.

"This attempt to access the secure systems of an international organisation working to rid the world of chemical weapons, demonstrates the GRU's disregard for the global values and rules that keep us safe.

"Our action today reinforces the clear message from the international community: we will uphold the rules-based international system and defend international institutions from those that seek to do them harm."

Mr Wilson said the GRU officers stopped in the Netherlands were planning to travel to the OPCW's laboratory in Switzerland.

The ambassador said that intelligence collected from a laptop belonging to one of the Russian officers showed it had connected to wifi at a Swiss hotel in September 2017 where a World Anti-Doping Agency conference was taking place.

The hotel was subject to a hacking attack during the conference, Mr Wilson said.

He explained: "Another of the cyber actors identified as the GRU was Sandworm, which was active in the wake of the Salisbury attacks.

"I can reveal that they were behind the following attempted intrusions: in March, straight after the Salisbury attack, the GRU attempted to compromise UK Foreign and Commonwealth Office computer systems via a spearfishing attack.

"In April GRU intrusions targeted both the computers of the UK Defence and Science Technology Laboratory as well as the Organisation for the Prohibition of Chemical Weapons.

"And in May, GRU hackers sent spear fishing emails which impersonated Swiss federal authorities to target OPCW employees directly and thus OPCW computer systems."

Jens Stoltenberg, Nato’s Secretary General , said on Twitter: "NATO stands in solidarity with the Dutch & UK governments in calling out #Russia on its cyber-attacks against @OPCW & others. Russia must stop its reckless pattern of behaviour to undermine international law & institutions. NATO Allies work together to bolster our cyber defences."

Referring to the attacks against UK targets in the wake of the Salisbury incident, Mr Wilson said: "These cyber-attacks were carried out remotely by GRU teams based within Russia."

The ambassador added: "The GRU has interfered in free elections and pursued a hostile campaign of cyber-attacks against state and civilian targets. It is an aggressive, well-funded official body of the Russian state.

"It can no longer be allowed to act aggressively across the world against vital international organisations with apparent impunity."

Asked about accusations from the Foreign Office of Russia being involved in worldwide cyber-attacks, a spokesman for the Russian embassy said: "This statement is reckless. It has become a tradition for such claims to lack any evidence.

"It is yet another element of the anti-Russian campaign by the UK Government.

"In December 2017 during the then-Foreign Secretary Boris Johnson's visit to Moscow, Russia's Foreign Minister Sergei Lavrov proposed to launch expert consultations on cybersecurity in order to address UK's concerns, if any. The offer was turned down. The only reasonable explanation is that the UK has no facts for a substantive discussion.

"Thus, such statements by the Foreign Office are nothing but crude disinformation, aimed at confusing the British and world public opinion. By the way, it is hardly a coincidence that these accusations appear exactly at the time of Nato defence ministers meeting in Brussels and announcements of creating special cyber-attack military units in several western countries."

Sir Alan Duncan, the Foreign Office Minister, who was meant to be in the Hague for a joint UK-Netherlands press conference, said on Twitter: "Massive congratulations to Dutch intelligence for so brilliantly uncovering cyber-attacks by Russian #GRU Intelligence agents. So sorry airport fog stopped me from getting to our planned UK-Dutch Press Conference."