Treading on the Boundaries: How Pro-Russian Threat Actors are Exacerbating NATO Geopolitical Tensions

Product Serial: B-2022-06-23a

TLP: WHITE

In this briefing, ZeroFox Intelligence provides insight into heightened tensions between NATO, Russia, and pro-Russian threat actors due to the European Union’s ban on the rail transport of EU-sanctioned goods passing through Lithuania from Russia.

Standing Intelligence Requirements

GEO

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

View the full brief here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00PM (EDT) on June 22, 2022 ; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

On June 18, 2022, Lithuanian officials announced their intent to implement the European Union’s (EU) ban on the rail transport of EU-sanctioned goods that pass through Lithuania en route from Russia to the Kaliningrad enclave. Russia has threatened to forcefully respond to the move, though the Lithuanian government has said that they are simply following EU sanctions requirements. On June 21, 2022, pro-Russia cyber threat actor Killnet announced that it had attacked two Lithuanian telecommunications companies and encouraged other pro-Russia groups to target Lithuania in response to the rail transport ban. This issue has also provoked fear among Western observers that Russia could target Lithuania with military action, though this remains highly unlikely given Russia’s reluctance to provoke a collective defense response from NATO enshrined in Article 5 of the Washington Treaty.

Poland has a similar logistical relationship with Kaliningrad; although the country has not yet announced a policy of enforcing Western sanctions on the enclave, the option to do so remains viable as Russian provocations by its proxy Belarus continue along Poland’s border. If Poland pursues a similar policy to Lithuania, it will be seen by Russia as an escalation and risks exposing Polish business and government entities to similar retaliation. Russia has been escalating its retaliatory response against NATO and EU members in recent weeks including cutting off energy supplies and continuing with confrontational military exercises. There have also been similar low-scale cyber actions likely carried out by pro-Russian threat actors against government websites of other EU and NATO members.