Dutch intelligence arrested four Russian GRU agents in April 2018 while attempting to hack the OPCW chemical weapons watchdog in The Hague, seizing hacking equipment and evidence of broader espionage.

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

Aggressor

Summary

On 10 April 2018, four Russian GRU officers from unit 26165 traveled to Amsterdam's Schiphol airport using diplomatic passports and were met by a Russian embassy official. They conducted reconnaissance near the OPCW headquarters in The Hague from 11 to 13 April, attempting a cyber operation. Dutch intelligence (MIVD) tracked their movements and on 13 April apprehended them near OPCW headquarters, seizing specialized wifi hacking equipment and cash. The suspects had laptops containing material related to the MH17 investigation and planned to target a Swiss OPCW lab as well. Evidence included train tickets to Switzerland, Google Maps printouts of Russian consulates, and hacking devices. The incident exposed a Russian GRU cyber operation aimed at the international chemical weapons watchdog.

Classification

Confidence: High

Direct evidence of Russian GRU officers attempting cyber attack using specialized equipment against critical international chemical weapons infrastructure, apprehended by Dutch intelligence.

Source URL

https://theguardian.com/world/2018/oct/04/visual-guide-how-dutch-intelligence-thwarted-a-russian-hacking-operation

Open source

Provenance

Publisher: extension
Submitted: Aug 3, 2026, 11:26 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Apr 10, 2018, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "9c9b0824-7705-47c9-a753-7df7800b0819",
  "url": "https://theguardian.com/world/2018/oct/04/visual-guide-how-dutch-intelligence-thwarted-a-russian-hacking-operation",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Netherlands",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Russian GRU",
    "offensive cyber operations",
    "OPCW",
    "Dutch intelligence",
    "Hacking attempt",
    "Chemical weapons watchdog",
    "Espionage",
    "MH17",
    "Cyber attack",
    "2018"
  ],
  "nodes": [],
  "countries": [
    "Netherlands"
  ],
  "where_text": "Land",
  "headline": null,
  "description": "On 10 April 2018, four Russian GRU officers from unit 26165 traveled to Amsterdam's Schiphol airport using diplomatic passports and were met by a Russian embassy official. They conducted reconnaissance near the OPCW headquarters in The Hague from 11 to 13 April, attempting a cyber operation. Dutch intelligence (MIVD) tracked their movements and on 13 April apprehended them near OPCW headquarters, seizing specialized wifi hacking equipment and cash. The suspects had laptops containing material related to the MH17 investigation and planned to target a Swiss OPCW lab as well. Evidence included train tickets to Switzerland, Google Maps printouts of Russian consulates, and hacking devices. The incident exposed a Russian GRU cyber operation aimed at the international chemical weapons watchdog.",
  "summary_short": "Dutch intelligence arrested four Russian GRU agents in April 2018 while attempting to hack the OPCW chemical weapons watchdog in The Hague, seizing hacking equipment and evidence of broader espionage.",
  "summary_extended": null,
  "actor_primary": "Russian GRU unit 26165",
  "target_primary": null,
  "location_text": "Near the Organisation for the Prohibition of Chemical Weapons (OPCW) headquarters, Johan de Witlaan, The Hague, Netherlands",
  "location_region": "South Holland",
  "location_coordinates_lat": 52.092776,
  "location_coordinates_lon": 4.276868,
  "location_precision": "Exact",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Direct evidence of Russian GRU officers attempting cyber attack using specialized equipment against critical international chemical weapons infrastructure, apprehended by Dutch intelligence.",
  "event_time_utc": "2018-04-10T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-08-03T11:26:00.202Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "exact",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: UnknownLocation: Exact

Source reliability

Info credibility

Event time

Apr 10, 2018, 00:00 UTC

Event time confidence

unknown

Location

Near the Organisation for the Prohibition of Chemical Weapons (OPCW) headquarters, Johan de Witlaan, The Hague, Netherlands

Region

South Holland

Primary actor

Russian GRU unit 26165

Country

Netherlands

Countries

Netherlands

Tags

Russian GRU, offensive cyber operations, OPCW, Dutch intelligence, Hacking attempt, Chemical weapons watchdog, Espionage, MH17, Cyber attack, 2018

Loading signal...

{ "id": "9c9b0824-7705-47c9-a753-7df7800b0819", "url": "https://theguardian.com/world/2018/oct/04/visual-guide-how-dutch-intelligence-thwarted-a-russian-hacking-operation", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "Netherlands", "source_reliability": "C", "info_credibility": "3", "tags": [ "Russian GRU", "offensive cyber operations", "OPCW", "Dutch intelligence", "Hacking attempt", "Chemical weapons watchdog", "Espionage", "MH17", "Cyber attack", "2018" ], "nodes": [], "countries": [ "Netherlands" ], "where_text": "Land", "headline": null, "description": "On 10 April 2018, four Russian GRU officers from unit 26165 traveled to Amsterdam's Schiphol airport using diplomatic passports and were met by a Russian embassy official. They conducted reconnaissance near the OPCW headquarters in The Hague from 11 to 13 April, attempting a cyber operation. Dutch intelligence (MIVD) tracked their movements and on 13 April apprehended them near OPCW headquarters, seizing specialized wifi hacking equipment and cash. The suspects had laptops containing material related to the MH17 investigation and planned to target a Swiss OPCW lab as well. Evidence included train tickets to Switzerland, Google Maps printouts of Russian consulates, and hacking devices. The incident exposed a Russian GRU cyber operation aimed at the international chemical weapons watchdog.", "summary_short": "Dutch intelligence arrested four Russian GRU agents in April 2018 while attempting to hack the OPCW chemical weapons watchdog in The Hague, seizing hacking equipment and evidence of broader espionage.", "summary_extended": null, "actor_primary": "Russian GRU unit 26165", "target_primary": null, "location_text": "Near the Organisation for the Prohibition of Chemical Weapons (OPCW) headquarters, Johan de Witlaan, The Hague, Netherlands", "location_region": "South Holland", "location_coordinates_lat": 52.092776, "location_coordinates_lon": 4.276868, "location_precision": "Exact", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Direct evidence of Russian GRU officers attempting cyber attack using specialized equipment against critical international chemical weapons infrastructure, apprehended by Dutch intelligence.", "event_time_utc": "2018-04-10T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-08-03T11:26:00.202Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "exact", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }