Russia-born couple arrested in Australia on espionage charges

Avatar

An Australian Army private and her husband were arrested in Brisbane Thursday for allegedly trying to access information related to Australian national security interests and hand it over to Russia.

According to the Australian Federal Police (AFP), 40-year-old Kira Korolev and 62-year-old Igor Korolev, a self-employed laborer, were born in Russia but held Australian citizenship. They were arrested at their home and charged with preparing for an espionage offense. If found guilty, the couple could face up to 15 years in prison

“As the investigation is ongoing, further charges could be laid at a later date,” the AFP said. If a direct link to a foreign state is found, penalties could increase to 25 years to life in jail.

The suspects attracted the attention of authorities when Ms. Korolev — who was an information systems technician in the Australian Army — took trips to Russia and attempted to access her work laptop while on long-term leave. 

As an Australian Defense Force private, she was required to report any overseas travel. Some of Ms. Korolev’s declarations were “misleading,” including “where she was allegedly at and in what country,” ABC News reported, citing Australia’s police commissioner Reece Kershaw.

She also reportedly traveled to Russia after it invaded Ukraine — a time when Australia warned its citizens against doing so.

The AFP alleged that while Mr. Korolev remained in Australia, his wife instructed him on how to log into her official work account and guided him to access sensitive defense information to send directly to her private email account while she was in Russia, likely with the intent to provide it to Russian authorities.

“Whether that information was provided to Russian authorities remains under investigation as does the conduct of the pair while overseas,” the AFP said.

The police assured that the operation against the Korolev couple poses “no ongoing threat to the public.”

The Russian embassy in Canberra did not respond to a request for comment.

“Espionage is not a victimless crime. It has the potential to impact Australia’s sovereignty, safety, and way of life,” Kershaw said in a statement.

“Espionage damages our economy and degrades our strategic advantage. It can have catastrophic real-world consequences,” said Mike Burgess, director general at the Australian Security Intelligence Organisation.

“If you are spying in this country, we are looking for you; if you are being spied on in this country, we are looking out for you,” he added.

In 2023, Australia reportedly expelled a large Russian spy ring whose members were posing as diplomats. The spy ring consisted of purported embassy and consular staff as well as other operatives using deep-cover identities, local media reported, citing unnamed sources with knowledge of the operation.

Australia’s domestic spy agency removed the alleged spies from the country, “privately and professionally,” according to the report by the Associated Press.

CybercrimeGovernmentNewsNews Briefs
Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Daryna Antoniuk

is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

 

Total
0
Shares
Previous Post

Hackers stole ‘nearly all’ call logs over six months from AT&T

Next Post

AT&T reportedly paid ransom for deletion of stolen call logs after culprit allegedly detained

Related Posts

Fake Google Chrome Sites Distribute ValleyRAT Malware via DLL Hijacking

Bogus websites advertising Google Chrome have been used to distribute malicious installers for a remote access trojan called ValleyRAT. The malware, first detected in 2023, is attributed to a threat actor tracked as Silver Fox, with prior attack campaigns primarily targeting Chinese-speaking regions like Hong Kong, Taiwan, and Mainland China. "This actor has increasingly targeted key roles
Avatar
Read More

Critical Ivanti Flaw Actively Exploited to Deploy TRAILBLAZE and BRUSHFIRE Malware

Ivanti has disclosed details of a now-patched critical security vulnerability impacting its Connect Secure that has come under active exploitation in the wild. The vulnerability, tracked as CVE-2025-22457 (CVSS score: 9.0), concerns a case of a stack-based buffer overflow that could be exploited to execute arbitrary code on affected systems. "A stack-based buffer overflow in Ivanti Connect
Avatar
Read More

Initial Access Brokers Shift Tactics, Selling More for Less

What are IABs? Initial Access Brokers (IABs) specialize in gaining unauthorized entry into computer systems and networks, then selling that access to other cybercriminals. This division of labor allows IABs to concentrate on their core expertise: exploiting vulnerabilities through methods like social engineering and brute-force attacks.  By selling access, they significantly mitigate the
Avatar
Read More