Russian hackers have hacked over 170 mailboxes of Ukrainian prosecutors and investigators in recent months

Russian hackers have compromised more than 170 email accounts of Ukrainian prosecutors and investigators in recent months. Officials from NATO countries and the Balkans have also been targeted.

Reuters reports this with a reference to the American-British cyber researchers Ctrl-Alt-Intel, who discovered the files.

On one of the servers, cyber experts found attack logs and thousands of stolen emails. In total, hackers were able to access at least 284 mailboxes between September 2024 and March 2026.

Experts have linked the attack to Russian intelligence services. In particular, they suspect hackers known as Fancy Bear, although there is no definitive confirmation.

Among the targets were the Specialized Prosecutorʼs Office for Defense, the Assets Tracing and Management Agency (ARMA), and the prosecutorsʼ training center in Kyiv, where about 44 boxes were broken into.

In particular, hackers gained access to the emails of dozens of employees of these institutions. For example, the former head of ARMA Yaroslava Maksymenko, as well as the deputy director of the Prosecutorsʼ Training Center, Oleh Duka, were under attack.

In addition, hackers broke into the mailboxes of the Central City Hospital in Pokrovsk and a mailbox belonging to the cityʼs finance committee.

The attackers also hacked at least one account at the Specialized Anti-Corruption Prosecutorʼs Office (SAPO). Cyber experts believe that the Russiansʼ goal was either to get ahead of the investigation into Russian spies or to collect compromising material on high-ranking officials.

The Ukrainian governmentʼs computer emergency response team CERT-UA said it was aware of some of the incidents and had already conducted inspections.

The attack has also affected other countries. In Romania, at least 67 email accounts associated with the Air Force, including those at NATO bases, were hacked.

In Greece, 27 mailboxes of the General Staff were attacked, including those of defense attaches abroad. Hacks were also recorded in Bulgaria and Serbia, where local officials, military personnel, and academics were affected.

• Fancy Bear is a group that has been active since the mid-2000s and is engaged in cyber espionage against government and military structures. The group is linked to Russian intelligence and is suspected of a number of international crimes. In particular, in the cyberattack on the German parliament in 2015, during which large amounts of data were stolen.

For more news and in-depth stories from Ukraine, please follow us on X.