Russian hackers invaded the systems of Iranian cyber spies. They then struck disguised as Iranian hackers in the systems of at least twenty countries, including the United Kingdom, Reuters reports.

This is the Russian group Turla, who, according to Estonia and the Czech Republic, work for the Russian secret service. The group would have been active for at least a year and a half.

Turla mainly hit targets in the Middle East, but also attacked a number of British organizations. The group used software and server infrastructure that it had taken over from the Iranian hacking organization APT34 (also known as OilRig).

Turla tried to convince victims that they were hit by Iran. The group also gained access to the data of previous victims of APT34 in this way.

Turla was eventually exposed by the intelligence services of the United States and the United Kingdom.