Russian spies pose as UK Telegraph journalists in attack on Skripal Novichok investigation

They were sent a month after the GRU, Russian military intelligence, had tried to murder Skripal and his daughter Yulia on March 4, 2018.

The GRU agents first sent emails to the Organisation for the Prohibition of Chemical Weapons in The Hague, which was working with UK authorities to determine what substance was used and coordinate the response. A total of 39 emails were sent to the organisation on April 5 and April 6 and a further three to Porton Down and the Foreign Office.

In one of the emails sent to the OPCW, with the subject heading “SALISBURY SPY POISONING INVESTIGATION”, it states: “Greetings! My name is Katie Morley, I represent the Telegraph newspaper. Our team has carried out an independent investigation into Salisbury spy poisoning case.

“We have interviewed one of the witnesses and ascertained previously unknown facts that may help the investigation. Before the materials are published, we would like to consult and discuss the option of cooperation with you.” The email concludes with the sign off: “Kind regards, Katie Morley, The Telegraph Journalist.”

The email contained an attachment and invited the OPCW recipient to click on it. Intelligence agencies said the attack was low in sophistication but designed to catch an official off guard.

Loading

The cyber attack failed and no attempt was made to compromise the Telegraph‘s systems.

Writing in the Telegraph, Morley spoke of the shock she felt learning her identity had been used.

“Quite honestly, knowing I have been used as a pawn in this monstrous crime has been difficult to digest. Since this newspaper was informed about the phoney emails, I have had assurances from UK intelligence services that my security has not been compromised.”

Noting that the two journalists whose identities were used had never covered foreign interference, she noted that “the one thing we do have in common, however, is that we are both women of a similar age with blue eyes and long blonde hair. In fact, we look strikingly similar. This has led to speculation that perhaps we were selected based not on our credentials, but our looks. I find it laughable to think I might have been part of a honey trap, but it appears to be a distinct possibility.”

Intelligence services believe the hack was ordered on the command of Vladimir Putin, who was alarmed at the international response to the GRU’s deployment of Novichok, a Soviet manufactured nerve agent, in an attempt to kill Skripal, a former GRU officer who had sold information to MI6.

The cyber attack was carried out by GRU unit 74455. The unit had many other targets: the 2018 Winter Olympics in South Korea; this year’s Tokyo Olympics until it was postponed; the 2017 French presidential elections; institutions in Ukraine and Georgia; and a US pharmaceutical company and American hospitals. The malware attacks caused about $1,339 billion in losses.

Intelligence agencies suspect a GRU officer named in a US indictment as Anatoliy Sergeyevich Kovalev was behind the impersonation of the Telegraph journalists. Kovalev, 29, is wanted by the FBI for wire fraud, intentional damage to protected computers and aggravated identity theft. He is accused of impersonating a German journalist in a similar attempt to hack systems at the time of the Skripal attack.

The so-called spearphishing attacks on the OPCW and UK agencies are detailed in an indictment released by the Department of Justice in Washington in October. According to the indictment, the GRU conspirators began sending the emails on April 5, two days after the Defence Science and Technology Laboratory at Porton Down said it had identified the poison used against Skripal as Novichok.

The Telegraph, London