Uzbekistan's State Security Service Unit 02616

Profile narrative

Uzbekistan's State Security Service Unit 02616 is a governmental subunit operating under the country's State Security Service, with its headquarters located in Uzbekistan. The unit is tasked with conducting cyber‑enabled surveillance and intelligence gathering, employing both commercially acquired spyware tools and internally developed capabilities to support state security objectives. Its activities are directed at monitoring and collecting information on individuals and entities deemed relevant to national security interests.

In October 2019 the unit carried out a series of cyber attacks against domestic activists, journalists, and dissidents, utilizing surveillance software obtained from vendors such as FinFisher and the former Hacking Team infrastructure. Kaspersky researchers linked the operation to the unit through observable operational security lapses, including malware tests performed on systems running their own antivirus products and domain registration traces that pointed to an identified officer of the National Security Service. During this campaign the unit also deployed its proprietary hacking framework, Sharpa, which was designed to compromise devices and extract data, illustrating a tactic of blending purchased spyware with bespoke tools. The primary aim of the intrusions was to gather material that could be used to discredit targets, consistent with broader patterns of government surveillance aimed at critics and independent media outlets.

The unit’s distinguishing attributes include its hybrid approach to cyber capabilities, combining off‑the‑shelf surveillance products with an in‑house framework like Sharpa, which reflects a trend among state actors to augment commercial tools with custom development. Its attribution was facilitated by specific operational missteps, highlighting how even state‑sponsored groups can leave detectable traces when security practices are lax. As a constituent element of Uzbekistan's State Security Service, the unit operates under the direction of the national security apparatus, though no further details about its internal hierarchy, parent‑organization structure, or subsidiary relationships are publicly disclosed in the available sources.

Incidents

1 incident linked to this organisation.