Ukraine's Asset Recovery and Management Agency (ARMA), responsible for overseeing assets seized from criminals and sanctioned individuals, reported a cyberattack on Tuesday. The incident occurred as ARMA was preparing to select a manager for the corporate rights of IDS Ukraine, a major producer of bottled mineral water and beverages, which had been seized from Russian shareholders.
ARMA stated that it is investigating whether the cyberattack is part of a broader, coordinated effort to disrupt its operations. The agency has observed other indications of suspected unlawful interference in its work since spring, including unauthorized access to an internal database of ARMA officials. While ARMA has not publicly presented evidence linking these incidents to specific groups or individuals, it is examining a potential connection to the competition for the IDS Ukraine assets.
The agency's acting head, Yaroslava Maksymenko, commented on the long-standing presence of Russian oligarchic capital in Ukraine, suggesting a network of individuals willing to serve those interests within the country. ARMA did not disclose technical details of the recent cyberattack or identify who it believes was responsible. Ukraine's security service, the SBU, is currently investigating the incident.
Despite the attack, ARMA affirmed that the process to select a manager for the IDS Ukraine assets will proceed as planned. Ukraine seized the corporate rights of Russian shareholders in IDS Ukraine in late 2022, following Russia's full-scale invasion. Among the shareholders is Mikhail Fridman, a Russian billionaire and co-founder of Alfa-Bank, who has been sanctioned by Ukraine and several Western governments. ARMA emphasized that sanctioned Russian capital should not retain control over assets seized in Ukraine and noted encountering resistance to transferring IDS Ukraine to independent management, though it did not name those allegedly attempting to influence the process.
This is not the first time ARMA has faced suspected Russia-linked cyber threats. In April, Ukrainian officials reported that ARMA employees were targeted in a cyberespionage campaign attributed to APT28, a Russian state-linked hacking group also known as Fancy Bear, BlueDelta, and Forest Blizzard. Maksymenko confirmed at the time that those earlier attempts failed to penetrate ARMA's internal systems.
