Event 552

{
  "attack_type": "Cyberattack",
  "border_violation_countries": [
    "EE",
    "Air"
  ],
  "category": "Cyber",
  "confidence": "Low",
  "confidence_rationale": "Event is described on the official site of the Estonian Ministry of Foreign Affairs, with direct attributions, statements by officials, and links to supporting documentation.",
  "countries": [
    "Estonia",
    "Russia",
    "Unknown"
  ],
  "country": "Estonia",
  "defense_prep": {},
  "description": "On 5 September 2024, Estonia officially attributed the 2020 cyberattacks against its authorities to the Russian military intelligence service GRU, specifically Unit 29155. This is Estonia's first-ever public state attribution of a cyberattack. Estonian authorities sought the arrest of three GRU officers and issued international arrest warrants. The announcement marks a significant escalation in direct attribution of cyber aggression to Russia by Estonia.",
  "event_time_utc": "2024-09-05T12:00:00Z",
  "evidence": [
    "Official attribution statement from the Estonian Minister of Foreign Affairs.",
    "Estonian Prosecutor’s Office issued international arrest warrants for three GRU officers.",
    "Joint statements from the Prosecutor’s Office, Estonian Internal Security Service, and the Police and Border Guard Board."
  ],
  "evidence_quotes": [
    "Today 5 September, Estonia attributed the 2020 cyberattacks against Estonia to the members of Unit 29155 at Russia’s military intelligence (GRU).",
    "It is the first time in history that Estonia has attributed cyberattacks against the state to the perpetrator of the attacks.",
    "The Prosecutor’s Office sought the arrest of three GRU officers and they are wanted internationally based on the arrest warrant issued by the Harju County Court.",
    "\"Estonia condemns any malign activity, including cyberactivity that threatens our institutions, our citizens and our security... Today we can clearly show that we can do this and we will continue identifying the perpetrators of attacks against us in the future.\"",
    "BACKGROUND: In November 2020, three Estonian ministries were hit by cyberattacks and they were prosecuted by the Prosecutor’s Office and other relevant agencies. The Information System Authority of Estonia identified three criminal attacks against Estonian national IT infrastructure."
  ],
  "evidence_urls": [
    "https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks",
    "https://www.prokuratuur.ee/en/news/gru-military-unit-launched-cyberattacks-against-estonian-authorities",
    "https://www.justice.gov/opa/pr/five-russian-gru-officers-one-civilian-charged-conspiring-hack-ukrainian-government"
  ],
  "extra": {
    "category_raw": "Cyberattack",
    "extra": {
      "extra": {
        "extra": {
          "evidence": [
            "Official attribution statement from the Estonian Minister of Foreign Affairs.",
            "Estonian Prosecutor’s Office issued international arrest warrants for three GRU officers.",
            "Joint statements from the Prosecutor’s Office, Estonian Internal Security Service, and the Police and Border Guard Board."
          ]
        }
      }
    }
  },
  "follow_up_by_country": [],
  "follow_up_notes": "Cyberattacks against ??Estonia; ?? GRU officers charged. Estonia attributed the 2020 cyberattacks against Estonia to the members of Unit 29155 of Russia s military intelligence (GRU).",
  "headline": "Estonia names Russia’s military intelligence in a first-ever attribution of cyberattacks",
  "location_text": "Tallinn, Estonia",
  "media_assets": [
    {
      "description": "Screenshot capture",
      "type": "screenshot",
      "url": "/media/event_552_1763930682_c38af7e9.jpg"
    }
  ],
  "notes": "2020 Cyberattacks against ??Estonia; ?? GRU officers charged. Estonia attributed the 2020 cyberattacks to the members of Unit 29155 of Russia s military intelligence (GRU).",
  "schema_version": "v1",
  "screenshot_count": 1,
  "sources": [
    "https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks"
  ],
  "summary_short": "Estonia attributed the 2020 cyberattacks to Russian GRU Unit 29155, issuing international arrest warrants for three officers and making a first-ever direct public attribution.",
  "url": "https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks"
}

{
  "5th Column of Russians Inside (which countries)": "",
  "Attack Type": "Cyberattack",
  "Borders Including Sea, Air,  Violation or Sabotage (which countries)": " EE Air",
  "Continuous? (e.g. Jammers)": "",
  "Country (FI;EE;LV;LT;PL;BSR;Air)\nSeparated by Semicolon": "EE;Air",
  "Date": "5-Sep-24",
  "Defense Prep Event (FI-EE-LV-LT-PL)": "",
  "Defense Prep Event (FI-EE-LV-LT-PL) REF LINK": "",
  "Follow-Up Link?  (FI,EE,LV,LT,PL, BSR, Air)": "https://vm.ee/en/news/estonia-names-russias-military-intelligence-first-ever-attribution-cyberattacks",
  "Follow-Up NOTES": "",
  "Follow-Up incl. Investigation, Prosecution?  (FI,EE,LV,LT,PL, BSR, Air)": "Cyberattacks against ??Estonia; ?? GRU officers charged. Estonia attributed the 2020 cyberattacks against Estonia to the members of Unit 29155 of Russia s military intelligence (GRU).",
  "Latitude, Longitude (WGS84, Decimal Degrees)": "59.43, 24.75",
  "NOTES": "2020 Cyberattacks against ??Estonia; ?? GRU officers charged. Estonia attributed the 2020 cyberattacks to the members of Unit 29155 of Russia s military intelligence (GRU).",
  "Political Disruptions w/ Laws to Favor Kremlin (which countries)": "",
  "Russian-Belarus Terrorist Event (FI-EE-LV-LT-PL)": "",
  "Russian-Belarus Terrorist Event (FI-EE-LV-LT-PL) REF LINK": "",
  "Screen Snapshot": "",
  "Screen Snapshots": "",
  "Type Dropdown": "",
  "Where?\n(Air, Land, Sea)": ""
}