Ukraine Confirms Russian Cyber Espionage Operation Targeting Prosecutors and Anti-Corruption Agencies

APT28, also known as Fancy Bear, is believed to be behind this large-scale campaign.

Taras Dzyuba, a senior Ukrainian cybersecurity official, confirmed to Recorded Future News on April 17, 2026, that a Russian cyber espionage campaign had targeted prosecutors, investigators, and government agencies. This statement follows a report by Ctrl-Alt-Intel published on April 16, 2026, as well as a Reuters investigation on the matter. Most of the victims were Ukrainian, though some were based in Romania, Bulgaria, Greece, and Serbia. The majority are involved in anti-corruption efforts.

Taras Dzyuba heads the Department of Communications and Information at the State Service of Special Communications and Information Protection of Ukraine (SSSCIP). The cyber espionage operation is believed to have been carried out by APT28, also known as “Fancy Bear,” a group affiliated with the GRU, the Russian Federation’s military intelligence service.

According to Reuters, the campaign exploited vulnerabilities in the open-source webmail platform Roundcube over several months, compromising 170 accounts. Among the affected Ukrainian institutions are the Specialized Anti-Corruption Prosecutor’s Office (SAP) and the Asset Recovery and Management Agency (ARMA), which oversees assets seized from Russian entities and individuals.

Taras Dzyuba believes these activities are part of a broader cyber espionage operation launched by Russia in 2023.