Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year.

Dubbed "Cadet Blizzard," the hacking group carried out operations targeting Ukrainian infrastructure in the run-up to the Russian invasion.

Researches believe the destructive malware is the work of Sandworm, a Russian military unit suspected in a series of Ukrainian cyberattacks.

The material includes information on non-related people and phone records, and Russian businessmen possibly associated with the Trump administration, according to a court document.

Strontium — a group linked to Russian military intelligence — was using the domains to target Ukrainian institutions, Microsoft said.

The botnet was being assembled by Russia's foreign intelligence agency, the GRU, Attorney General Merrick Garland said at a news conference.

The Treasury Department sanctioned 26 Russia- and Ukraine-based individuals and seven entities.

The "large-scale modular malware framework" has largely replaced the "VPNFilter" tools that Sandworm used before they were disrupted in 2018.

Anne Neuberger says the Biden administration has technical details linking the Russian spy agency to disruptions of Ukrainian banking and government websites.

The targets of Fancy Bear's brute force attacks include both government agencies and the private sector, the advisory alleges.