{
  "id": "1c8c4d47-8584-4ba0-9753-60c49f190279",
  "url": "https://notesfrompoland.com/2024/05/09/russian-hackers-target-polish-government-bodies",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Poland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Fancy Bear",
    "APT28",
    "Russian cyber espionage",
    "Polish government",
    "malware campaign",
    "phishing",
    "GRU",
    "cyber cold war",
    "NASK",
    "Krzysztof Gawkowski"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Poland"
  ],
  "where_text": "Cyberspace",
  "headline": "Russian hackers Fancy Bear target Polish government bodies with malware campaign",
  "description": "In early May 2024, Polish government institutions were targeted by a large-scale malware campaign attributed to Fancy Bear (APT28), a Russian cyber espionage group linked to the GRU. The attackers sent phishing emails referencing a purported 'mysterious Ukrainian woman in Warsaw' connected to high-level Polish and Ukrainian authorities, tricking recipients into clicking links that downloaded malware. NASK, a Polish state research institute, and the defense ministry's cyber teams publicly confirmed these cyber espionage attempts. The identity of the targeted institutions and extent of compromise remain undisclosed. Poland's digital affairs minister, Krzysztof Gawkowski, likened these attacks to those directed at Ukraine, stating Poland is in a 'cyber cold war' with Russia. Fancy Bear has a history of targeting Western governmental entities, including the White House, NATO, and the German parliament.",
  "summary_short": "In May 2024, Russian hacker group Fancy Bear (APT28) launched a large-scale malware campaign targeting Polish government bodies, confirmed by Polish cyber authorities.",
  "summary_extended": "The Russian hacking group Fancy Bear, linked to the GRU, targeted Polish government institutions in May 2024 with a sophisticated malware campaign delivered via phishing emails that centered on a fabricated story of a Ukrainian woman connected to high-ranking officials. The campaign was detected and publicly confirmed by NASK and the Polish defence ministry's cyber response teams. Polish digital affairs minister Krzysztof Gawkowski highlighted the similarity of these attacks to those faced by Ukraine, underscoring an ongoing cyber cold war between Russia and Poland. While specific targeted entities and breach results remain undisclosed, this operation fits a pattern of Russian cyber espionage activities against Western governmental targets, exacerbating cybersecurity challenges for Poland amid regional tensions.",
  "actor_primary": "Fancy Bear (APT28)",
  "target_primary": null,
  "location_text": "Warsaw",
  "location_region": null,
  "location_coordinates_lat": 52.2297,
  "location_coordinates_lon": 21.0122,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes a hostile cyber espionage campaign attributed to Russian actors (Fancy Bear/APT28 linked to the GRU) targeting Polish government bodies, confirmed by Polish cyber authorities.",
  "event_time_utc": "2024-05-08T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-13T19:25:09.356Z",
  "updated_at": "2026-11-08T20:42:24.790Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

{
  "id": "1c8c4d47-8584-4ba0-9753-60c49f190279",
  "url": "https://notesfrompoland.com/2024/05/09/russian-hackers-target-polish-government-bodies",
  "source": "csv-import",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Poland",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Fancy Bear",
    "APT28",
    "Russian cyber espionage",
    "Polish government",
    "malware campaign",
    "phishing",
    "GRU",
    "cyber cold war",
    "NASK",
    "Krzysztof Gawkowski"
  ],
  "nodes": [
    "Node 1: Borders"
  ],
  "countries": [
    "Poland"
  ],
  "where_text": "Cyberspace",
  "headline": "Russian hackers Fancy Bear target Polish government bodies with malware campaign",
  "description": "In early May 2024, Polish government institutions were targeted by a large-scale malware campaign attributed to Fancy Bear (APT28), a Russian cyber espionage group linked to the GRU. The attackers sent phishing emails referencing a purported 'mysterious Ukrainian woman in Warsaw' connected to high-level Polish and Ukrainian authorities, tricking recipients into clicking links that downloaded malware. NASK, a Polish state research institute, and the defense ministry's cyber teams publicly confirmed these cyber espionage attempts. The identity of the targeted institutions and extent of compromise remain undisclosed. Poland's digital affairs minister, Krzysztof Gawkowski, likened these attacks to those directed at Ukraine, stating Poland is in a 'cyber cold war' with Russia. Fancy Bear has a history of targeting Western governmental entities, including the White House, NATO, and the German parliament.",
  "summary_short": "In May 2024, Russian hacker group Fancy Bear (APT28) launched a large-scale malware campaign targeting Polish government bodies, confirmed by Polish cyber authorities.",
  "summary_extended": "The Russian hacking group Fancy Bear, linked to the GRU, targeted Polish government institutions in May 2024 with a sophisticated malware campaign delivered via phishing emails that centered on a fabricated story of a Ukrainian woman connected to high-ranking officials. The campaign was detected and publicly confirmed by NASK and the Polish defence ministry's cyber response teams. Polish digital affairs minister Krzysztof Gawkowski highlighted the similarity of these attacks to those faced by Ukraine, underscoring an ongoing cyber cold war between Russia and Poland. While specific targeted entities and breach results remain undisclosed, this operation fits a pattern of Russian cyber espionage activities against Western governmental targets, exacerbating cybersecurity challenges for Poland amid regional tensions.",
  "actor_primary": "Fancy Bear (APT28)",
  "target_primary": null,
  "location_text": "Warsaw",
  "location_region": null,
  "location_coordinates_lat": 52.2297,
  "location_coordinates_lon": 21.0122,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The article clearly describes a hostile cyber espionage campaign attributed to Russian actors (Fancy Bear/APT28 linked to the GRU) targeting Polish government bodies, confirmed by Polish cyber authorities.",
  "event_time_utc": "2024-05-08T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-02-13T19:25:09.356Z",
  "updated_at": "2026-11-08T20:42:24.790Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "moderate",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}