Russian hackers target US engineering firm because of work done for Ukrainian sister city

Russian Hackers Target U.S. Engineering Firm with Ukraine Ties

Russian intelligence-backed hackers attacked an American engineering company this fall, according to findings released Tuesday by U.S. cybersecurity firm Arctic Wolf. The apparent motivation behind the attack was the company’s business relationship with a U.S. municipality that maintains a sister city partnership in Ukraine.

The attack highlights Russia’s expanding cyber warfare tactics and demonstrates Moscow’s willingness to target a growing array of organizations that have supported Ukraine, even when those connections are indirect or tenuous.

Arctic Wolf, which identified the campaign, declined to name its customer or the specific municipality involved to protect their security. The company emphasized that the engineering firm had no direct connection to Russia’s invasion of Ukraine.

The hackers responsible for the attack belong to a group known as RomCom, which has consistently targeted organizations with links to Ukraine since Russia launched its full-scale invasion in February 2022.

“They routinely go after organizations that support Ukrainian institutions directly, provide services to Ukrainian municipalities, and assist organizations tied to Ukrainian civil society, defense, or government functions,” explained Ismael Valenzuela, Arctic Wolf’s vice president of labs, threat research and intelligence.

Arctic Wolf detected and neutralized the attack in September before it could disrupt the engineering company’s operations or spread further through its systems. The Russian Embassy in Washington did not immediately respond to requests for comment on the findings.

Sister city relationships, which many U.S. cities maintain with communities worldwide, are designed to foster social and economic exchanges between different cultures. Several American cities, including Chicago, Baltimore, Albany, and Cincinnati, maintain such partnerships with Ukrainian communities. These previously benign cultural connections now appear to make American entities targets in Russia’s digital warfare strategy.

The September attack came shortly after the FBI warned that Russia-linked hackers were attempting to infiltrate U.S. networks to access critical systems or disrupt infrastructure. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), these Russia-aligned threat actors have multiple objectives: disrupting aid to Ukraine, punishing businesses with Ukrainian connections, and stealing military or technical intelligence.

This campaign represents part of a broader pattern of Russian cyber aggression that has intensified alongside the physical conflict in Ukraine. Last month, the Digital Security Lab of Ukraine and investigators at SentinelOne, another U.S. cybersecurity firm, exposed a sophisticated cyberattack targeting humanitarian organizations supporting Ukraine, including the International Red Cross and UNICEF.

That operation employed fake emails impersonating Ukrainian officials, attempting to trick recipients into clicking malicious links that would compromise their computer systems. While SentinelOne stopped short of directly attributing the attack to the Russian government, they noted that it targeted Ukraine-supporting groups and required extensive planning, describing the perpetrators as a “highly capable adversary” skilled in both offensive tactics and evading detection.

The engineering firm attack demonstrates how Russia’s cyber warfare is evolving to include targets with increasingly distant connections to the Ukraine conflict. This expansion poses new challenges for organizations that may not consider themselves directly involved in geopolitical tensions but nevertheless maintain business relationships with entities that have Ukrainian connections.

Cybersecurity experts warn that organizations with even minimal ties to Ukraine should strengthen their digital defenses and implement robust security protocols to protect against similar intrusions. As Russia’s list of potential targets grows, previously overlooked connections to Ukraine now represent potential vulnerabilities that sophisticated state-backed hackers are actively seeking to exploit.