● OVERVIEW OF 2024 RUSSIAN INTELLIGENCE ramps up cyber pressure on the West A thorough investigation linked several cyberattacks against Estonian government agencies in 2020 to Unit 29 155 of Russia’s military intelligence (GRU). T he case began to unfold four years ago when an employee of the Estonian Ministry of Economic Affairs and Communications noticed unusual anomalies on their computer. Initially, they suspected malware that was widespread in Estonia at the time. However, when cleaning the computer failed to resolve the issue, the employee reported it to CERT-EE, the incident handling unit of the Information System Authority. THE PROBLEM WAS BIGGER THAN IT SEEMED It quickly became clear that the issue was far more extensive. A backdoor had been built into the ministry’s systems, allowing the exfiltration of large amounts of data – 350 gigabytes in total. While classified state secrets were not compromised, the 20 Yuri Denisov Nikolay Korchagin Vitaly Shevchenko attackers gained access to a significant amount of sensitive internal information, including strategic documents and working papers, personnel details, and correspondence with businesses. Tracing the cyber footprint revealed that attacks with a similar modus operandi had targeted other government institutions and companies, including the Ministry of Foreign Affairs and the Health and Welfare Information Systems Centre (TEHIK). While hackers extracted only public data from the ministry’s web servers, in TEHIK’s systems, they accessed the personal information of around 10,000 individuals infected with COVID-19. The investigation, conducted by the Estonian Internal Security Service and the National Criminal Police, identified three suspects who were serving in the GRU at the time of the CYBER SECURITY IN ESTONIA 2025