Belarusian “Cyber Partisans” claim large-scale cyberattack on major fertilizer producer Grodno Azot, demand release of political prisoners

In a message posted to the messenger app Telegram earlier today, the Belarusian hacktivist collective known as “Cyber Partisans” announced a large-scale cyberattack on Grodno Azot (“Hrodna Azot” in Belarusian), a state-run fertilizer producer. The group demanded the release of political prisoners arrested by the regime of sixth-term Belarusian president Alexander Lukashenko, who remains in power in Minsk despite the wave of massive nationwide protests that followed the country’s most recent falsified election in 2020.

Cyber Partisans reported that the attack encrypted internal mail, document flow, and hundreds of Grodno Azot computers. Backups of databases, servers, emails, and document flow have also been erased. Security systems and surveillance cameras were hacked, and the work of the boiler room has been disrupted, according to the group.

The Cyber Partisans also hacked into the company's website. The following screen is shown when one attempts to access the homepage:

To confirm their actions, Cyber Partisans published screenshots of hacked surveillance cameras, a video with the inscription “We control the boiler room,” and a letter to the chairman of Belneftekhim — Grodno Azot's state-owned parent company. The letter says that the hack has severely disrupted nitrogen fertilizer deliveries.

Cyber Partisans have offered to recover the data if their demands are met. The group is calling for the release of all political prisoners from Grodno Azot, in addition to 75 political prisoners who are in very poor health but have no connection to the company. The latter will be determined at the discretion of the group.

“Since 2020, the management of Grodno Azot has been involved in bullying, pressure, and political repression of the company's employees. We have not forgotten [the] punitive raids, reports [to the police] and mass layoffs. Now it's your turn to pay. The stakes are higher. [...] Now, we worked carefully and used only a small part of our capabilities. If you refuse, next time the stakes will be even higher. [...] 4 years of intimidation, repression and politically-motivated layoffs are on the conscience of Grodno Azot management. For this, they get our own cyber sanctions.”

The group also threatened the management of other enterprises, institutions, and organizations involved in political repression in Belarus with similar attacks.

In 2020, the management of Grodno Azot, Belarus’ largest nitrogen producer, greenlit mass layoffs of the company’s employees for their participation in anti-government protests. The Belarusian police also detained up to ten participants in a strike at Grodno Azot itself.

Grodno Azot is the only Belarusian facility to produce carbamide — a water-soluble nitrogen fertilizer. In 2006, the United States imposed sanctions against nine Belarusian companies — including Grodno Azot and its affiliate, Grodno Khimvolokno — for “undermining the democratic process.” The company has been under EU sanctions since December 2021 for firing and intimidating workers who participated in protests after the 2020 presidential election. As a result, Grodno Azot was prohibited from selling its products to the EU.

In 2023, reports by the Belarusian Investigative Center and the Lithuanian independent investigative center Siena confirmed that Grodno Azot used multiple shell companies to circumvent the sanctions and supply its products to the European Union.