Ukrainian Agency Managing Seized Russian Assets Reports Cyberattack

Cyberattack on Ukrainian Asset Agency

Ukraine's Asset Recovery and Management Agency (ARMA), responsible for managing assets seized from criminals and sanctioned individuals, announced it was targeted by a cyberattack. This incident occurred as the agency was preparing to select a manager for the seized corporate rights in IDS Ukraine, a major producer of bottled mineral water and beverages.

Context of the Attack

ARMA manages assets, including those linked to sanctioned Russians and alleged collaborators with Moscow. The agency stated that the attack happened during a critical phase of transferring control of IDS Ukraine, whose Russian shareholders' corporate rights were seized in late 2022. Mikhail Fridman, a Russian billionaire sanctioned by Ukraine and Western governments, is among the shareholders.

Suspected Coordinated Disruption

Yaroslava Maksymenko, ARMA's acting head, suggested that Russian oligarchic capital has established networks within Ukraine to serve its interests. ARMA is investigating whether the cyberattack and other signs of unlawful interference, such as unauthorized access to an internal database, are part of a coordinated effort to undermine the competition for the IDS Ukraine assets. Ukraine's security service, the SBU, is investigating the attack.

Previous Incidents and Agency Response

This is not the first cyber threat ARMA has faced; in April, employees were targeted in a cyberespionage campaign attributed to APT28, a Russian state-linked hacking group. Despite the attack, ARMA confirmed that the competition to select a manager for the IDS Ukraine assets will proceed as planned, emphasizing that sanctioned Russian capital should not retain control over seized assets.