A joint international security advisory published on 27 July 2026 has exposed a year-long cyber-espionage campaign run by hackers linked to the Russian state, targeting government agencies, defence contractors and nuclear scientists across the United States and other NATO member countries. The operation exploited a rare zero-click vulnerability in email software that let attackers hijack accounts the moment a target opened a message, with no link to click and no attachment to open. Once inside, the intruders harvested entire organisational contact lists and up to ninety days of email history per compromised account.
What Happened
The advisory describes an intrusion set that ran for approximately twelve months before being publicly documented. The targeting was not opportunistic. Operators went after a defined intelligence requirement: defence technology programmes and advanced nuclear fusion research held by government bodies, defence companies and research scientists in NATO states.
Attribution points to a well-known Russian espionage cell with a long history of probing Western defence and government networks. Analysts assess that the collected material was intended to feed Russia's military capability in the ongoing conflict with Ukraine, making this a wartime intelligence collection programme rather than generic state espionage.
UK Security Minister Dan Jarvis framed the campaign as part of an established pattern, noting that Moscow frequently refines its digital weapons in Ukraine before turning them on NATO targets. Brett Leatherman of the FBI's Cyber Division reports a renewed wave of Russian cyber operations against the US, following a brief lull at the start of the invasion of Ukraine.
Disruption work is under way. A 30-year-old Russian national suspected of participating in the operation was arrested in Thailand last year and subsequently transferred to Boston to stand trial.
What Was Taken
The confirmed collection from each compromised mailbox covers two categories, both of high intelligence value:
Full organisational contact lists. These are not just address books. In a defence or national laboratory environment, a complete directory maps programme structure, reveals which scientists work on which research areas, identifies cleared personnel and contractor relationships, and hands the attacker a ready-made target list for follow-on operations against partner organisations.
Up to ninety days of email history per account. Three months of correspondence from a defence programme office or a fusion research team can contain technical specifications, procurement and supply chain detail, meeting schedules, travel plans, unpublished research findings and internal deliberations. It also contains the raw material for highly convincing follow-on social engineering, because the attacker now knows exactly how colleagues write to each other.
The stated intelligence objective was defence technology and advanced nuclear fusion research. Sensitivity is high by definition: the victims include nuclear research organisations and defence firms in NATO countries during an active conflict.
Why It Matters
Zero-click email compromise breaks the single control most organisations lean on hardest. Security awareness training, phishing simulations and "do not click suspicious links" messaging all assume a user decision point. This campaign removed it. A trained, cautious, security-conscious nuclear scientist was compromised by the act of reading their inbox.
That has three consequences for defenders. First, user-behaviour metrics stop being a meaningful measure of email risk against this class of attack. Second, detection has to move to the post-exploitation side, because there is no click to log and no attachment to detonate in a sandbox. Third, mail infrastructure itself becomes the critical patch surface, on the same tier as internet-facing VPN and edge appliances.
The dwell time matters as much as the technique. A year of undetected access to defence and nuclear research mailboxes means the loss is not a snapshot but a continuous feed. Organisations that only now begin looking should assume the ninety-day window applies to accounts they have not yet identified as compromised.
The Jarvis observation about Ukraine as a proving ground carries a scheduling implication: capabilities seen against Ukrainian targets should be treated as a preview of what will arrive on NATO networks, not as a distant regional problem. The Dutch intelligence service's earlier finding that Russia hacked security cameras on NATO territory to track military supplies bound for Ukraine fits the same collection pattern across a different technical surface.
The Attack Technique
The initial access vector was exploitation of a rare vulnerability in email software that permitted account takeover on message rendering. The target had to open the message. Nothing else was required from them.
Vulnerabilities in this class typically live in the parsing and rendering path: the code that processes message headers, MIME structure, embedded content or remote resource references before a human has made any decision about the message. Exploitation happens inside the mail client or mail server as it handles attacker-controlled input, which is why the usual user-facing indicators are absent.
Post-exploitation, the operators pivoted to account control and bulk data collection: pulling the full contact directory and up to ninety days of stored mail. That pattern, harvesting directory plus recent correspondence, is consistent with an intelligence collection mission optimised for breadth and for enabling lateral targeting, rather than one focused on destructive impact or persistence-heavy implants.
Defenders should note what this means for evidence. Because there is no malicious attachment and no clicked URL, the surviving artefacts are on the server side: authentication and session anomalies, mass mailbox reads, directory or contact list enumeration, unusual mail sync clients, and outbound data volume from mail infrastructure.
What Organizations Should Do
Patch mail infrastructure on an emergency cycle. Treat mail servers and mail clients as internet-facing critical assets. Inventory every mail product in the estate, including legacy webmail, gateways and third-party client software, and bring them to current patch level. Follow the specific product guidance in the joint advisory as a priority action, not a scheduled one.
Hunt retroactively across at least a twelve-month window. This campaign ran roughly a year. Reviewing only the last thirty or ninety days of logs will miss the initial compromise. Prioritise mailbox audit logs, sign-in logs and mail sync events for accounts belonging to defence programme staff, researchers, executives and their administrative support.
Alert on bulk mailbox and directory access. Build detections for mass message reads, full-mailbox export or sync from an unusual client, and contact list or global address list enumeration. These are the loudest surviving signals when the intrusion leaves no click and no payload.
Assume contact lists are burned and prepare partners. If a directory was taken, downstream spearphishing against suppliers, partner labs and allied agencies is the expected next move. Notify partner organisations, and warn staff that follow-on messages may correctly reference real colleagues, real projects and real recent threads.
Reduce the value of a hijacked session. Enforce phishing-resistant MFA, shorten session and token lifetimes, revoke and reissue tokens for any account in scope, and restrict legacy authentication protocols that bypass modern conditional access. Account takeover via a rendering bug still needs a usable session to be worth anything.
Constrain what a single compromised mailbox exposes. Apply retention limits so that a ninety-day pull yields less, restrict global address list visibility for sensitive research groups, and segment high-value programme correspondence away from general-purpose mail where the classification of the work allows it.
Rehearse the no-user-action scenario. Update incident response playbooks and tabletop exercises to include compromise with no phishing click, no malware and no user error, so that triage does not stall while responders search for a click that never happened.
Sources: Russian hackers target US and NATO defence and nuclear research - TechCentral.ie