The U.S. Department of Justice announced charges against five officers of Russia’s military intelligence agency, the GRU, and one civilian co-defendant over alleged destructive cyber operations and hack-and-leak activity. The indictment alleges that the group targeted Ukrainian government systems, deployed malware that imitated ransomware, stole and exposed sensitive information, and later probed or attacked systems beyond Ukraine. These are allegations, not findings of guilt.
What the U.S. case alleges
In a superseding indictment announced September 5, 2024, the Justice Department alleged a conspiracy involving intrusions into Ukrainian government systems, theft and disclosure of information, and destructive attacks ahead of Russia’s February 2022 invasion. Prosecutors said the alleged campaign was intended in part to undermine Ukrainians’ confidence in government systems and the safety of their personal data. Some targets, DOJ said, had no military or defense function. DOJ’s announcement
The indictment’s “hack-and-leak” dimension refers to alleged theft and exposure of information alongside destructive cyber activity. DOJ says attackers compromised some systems, extracted sensitive material—including patient health records—defaced websites with threats, and offered stolen information for sale online. Assistant Attorney General Matthew G. Olsen said the defendants “stole and leaked the personal data of thousands of Ukrainian civilians.” That is an official characterization; the announcement does not provide a more precise independently verified count.
What is WhisperGate?
WhisperGate was malware that DOJ says the defendants used on January 13, 2022, against dozens of Ukrainian government entities. According to the indictment, the attackers used services from a U.S.-based company to distribute it. DOJ alleges WhisperGate was designed to resemble ransomware but to destroy the infected computer and its data rather than restore access after a ransom payment. DOJ’s account of the alleged deployment
Recommended Free Tools
#1 Best Overall
That distinction matters: ransomware typically encrypts or otherwise locks data to pressure a victim to pay, while a destructive wiper aims to erase or disable data and systems. The government’s allegation is that WhisperGate used the appearance of ransomware as a disguise for destructive intent; the materials cited in the announcement do not establish a recoverable decryption process or a ransom demand as its purpose.
Ukrainian entities named by DOJ
The Justice Department named a broad set of alleged targets, including the ministries of Internal Affairs, Foreign Affairs, Finance, Education and Science, Agriculture, and Energy. Other entities listed were the State Treasury, judiciary administration, state digital-services portal, food-safety service, Accounting Chamber, State Emergency Service, Forestry Agency, and Motor Insurance Bureau.
Rank #2
Who was charged?
The five military defendants are identified by DOJ as officers of GRU Unit 29155. A civilian was charged separately. The title’s “five” refers to the military officers; six people are named in the case. DOJ defendant list
- Colonel Yuriy Denisov
- Lieutenant Vladislav Borovkov
- Lieutenant Denis Denisenko
- Lieutenant Dmitriy Goloshubov
- Lieutenant Nikolay Korchagin
- Civilian Amin Sitgal, whom the FBI wanted page lists as Amin Timovich Stigal
What charges and current status are reported?
DOJ announced charges of conspiracy to commit computer intrusion and conspiracy to commit wire fraud. The civilian had previously been indicted for computer-intrusion conspiracy in June 2024; the superseding indictment added a wire-fraud conspiracy charge against him and named the five officers. The public announcements describe charges and allegations, not convictions.
The FBI wanted page says federal arrest warrants were issued August 7, 2024, in the U.S. District Court for the District of Maryland. It lists all six as wanted for alleged activity from December 2020 through August 2024, and says the Rewards for Justice program offers up to $10 million for information leading to their location. That is an offered reward, not an estimate of damage. Wanted status and reward terms can change; consult the FBI wanted page for its latest listing.
How the alleged activity extended beyond Ukraine
DOJ says the defendants probed systems associated with 26 NATO member countries. It also alleges that in October 2022 they hacked transportation infrastructure in a Central European country that supported Ukraine. The announcement presents the case as part of international Operation Toy Soldier; the FBI and 12 other partners representing nine countries released a joint cyber advisory alongside it. DOJ’s announcement
The 26-country figure describes alleged probing activity, not 26 confirmed successful intrusions. The case is also distinct from the separate 2016 election-related GRU cases: the cited DOJ announcement describes attacks and probes connected to Ukraine and countries supporting Ukraine, not a U.S. election operation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the charges do—and do not—establish
An indictment states prosecutors’ allegations; it does not prove them. The DOJ and FBI materials cited here identify defendants, describe the alleged conduct, and report charges and warrants. They do not establish guilt or provide a quantified financial-loss estimate for the campaign. Matthew G. Olsen characterized the alleged targeting of Ukrainian infrastructure and government systems “of no military value” as showing Russia’s disregard for civilians; that is an official statement, not a judicial finding. Olsen’s prepared remarks
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
