Russo-Ukrainian cyberwarfare

Cyberwarfare is a component of the confrontation between Russia and Ukraine since the Revolution of Dignity in 2013-2014. While the first attacks on information systems of private enterprises and state institutions of Ukraine were recorded during mass protests in 2013, Russian cyberweapon Uroburos had been around since 2005. Russian cyberwarfare continued with the 2015 Ukraine power grid hack at Christmas 2015 and again in 2016, paralysis of the State Treasury of Ukraine in December 2016, a Mass hacker supply-chain attack in June 2017 and attacks on Ukrainian government websites in January 2022.

Pro-Russian bot farm in Ukraine.

History

Russian–Ukrainian cyberwarfare is a component of the confrontation between Russia and Ukraine since the Revolution of Dignity in 2013-2014. Russian cyberweapon Uroburos had been around since 2005.[1] However, the first attacks on information systems of private enterprises and state institutions of Ukraine were recorded during mass protests in 2013. In 2013, Operation Armageddon, a Russian campaign of systematic cyber espionage on the information systems of government agencies, law enforcement, and defense agencies, began, thought to help Russia on the battlefield.[2] Between 2013 and 2014, some information systems of Ukrainian government agencies were affected by a computer virus known as Snake / Uroborus / Turla.[2] In February–March 2014, as Russian troops entered Crimea communication centers were raided and Ukraine's fibre optic cables were tampered with, cutting connection between the peninsula and mainland Ukraine. Additionally Ukrainian Government websites, news and social media were shut down or targeted in DDoS attacks, while cell phones of many Ukrainian parliamentarians were hacked or jammed.[2][3] Ukrainian experts also stated the beginning of a cyberwar with Russia.[4] Cybersecurity companies began to register an increase in the number of cyberattacks on information systems in Ukraine. The victims of Russian cyberattacks were government agencies of Ukraine, the EU, the United States, defense agencies, international and regional defense and political organizations, think tanks, the media, and dissidents.[2] As of 2015, researchers had identified two groups of Russian hackers who have been active in the Russian-Ukrainian cyber war: the so-called APT29 (also known as Cozy Bear, Cozy Duke) and APT28 (also known as Sofacy Group, Tsar Team, Pawn Storm, Fancy Bear).[2]

Russia has conducted cyberattacks against Ukraine's wartime satellite internet service Starlink.[5]

Cyberattacks

Russian cyberattacks
  • Operation "Armageddon", 2013[2]
  • Operation "Snake", February 2014[6][7][8]
  • Attacks on the automated system "Elections", June 2014[9]
  • First Ukraine power grid hack, December 2015. Attacks using the Trojan virus BlackEnergy on energy companies in Ukraine which provide energy to Kyiv, Ivano-Frankivsk and Chernivtsi regions[10][11] This was the first successful cyber attack on a power grid.[10]
  • Second Ukraine power grid hack, December 2016.[12][13]
  • Paralysis of the State Treasury of Ukraine, December 2016[14][15]
  • 2017 cyberattacks on Ukraine, Mass hacker supply-chain attack, June 2017 using Petya virus[16] According to the US Presidential Administration, this attack became the largest known hacker attack.[17]
  • 2022 Ukraine cyberattack, attacks on Ukrainian government websites, January 2022, one day after US-Russian negotiations on Ukraine's future in NATO failed.[18][19]
  • Attacks in February 2022, after Russian troops invaded eastern regions of Ukraine, took down several major Ukrainian governmental and banking websites. U.S. intelligence attributed the attacks to Russian attackers, although the Russian government denied involvement.[20]
  • Russia has tried to block Starlink in Ukraine, which provides Internet access via satellite services. Starlink has countered those attacks by hardening the service's software.[21] Cyberattacks against Starlink appear to have been ineffective, in part because SpaceX quickly updates the system’s software, according to The Economist. The director of electronic warfare for the US Office of the Secretary of Defense has said the speed of the Starlink software response he witnessed to one attack was "eye-watering".[22] In August 2023, during Ukraine's counteroffensive, a Five Eyes report found that Russian hackers planted malwares designed to steal data to Starlink from the Android tablets of Ukrainian soldiers.[23] Ukrainian Security Services said to have blocked some of the hacking attempts and conceded Russians had captured tablets on the battlefield and planted malwares on them.

Ukrainian cyberattacks

Russian-Ukrainian cyberwarfare amidst Russian invasion of Ukraine in 2022

In June 2022, Microsoft published the report on Russian cyber attacks, and concluded that state-backed Russian hackers "have engaged in "strategic espionage" against governments, think tanks, businesses and aid groups" in 42 countries supporting Kyiv.[35]

In April 2022, Microsoft report shared new details on Russian cyberwarfare against Ukraine, for instance Microsoft has reported that in some cases, hacking and military operations worked in tandem against Ukraine related target.[36][37]

See also

References
  1. "Invisible Russian cyberweapon stalked US and Ukraine since 2005, new research reveals". CSO. 10 March 2014. Archived from the original on 2022-01-18. Retrieved 2022-01-17.
  2. Jen Weedon, FireEye (2015). "Beyond 'Cyber War': Russia's Use of Strategic Cyber Espionage and Information Operations in Ukraine". In Kenneth Geers (ed.). Cyber War in Perspective: Russian Aggression against Ukraine. Tallinn: NATO CCD COE Publications. ISBN 978-9949-9544-5-2. Archived from the original on 2016-08-16. Retrieved 2016-05-10.
  3. Gertz, Bill. "Inside the Ring: Cybercom's Michael Rogers confirms Russia conducted cyberattacks against Ukraine". The Washington Times. Archived from the original on 2021-06-02. Retrieved 2020-07-21.
  4. "Russian Electronic Warfare in Ukraine: Between Real and Imaginable - Jamestown". Jamestown. Archived from the original on 2017-05-26. Retrieved 2017-05-27.
  5. "How Elon Musk's satellites have saved Ukraine and changed warfare". The Economist. ISSN 0013-0613. Retrieved 2023-06-06.
  6. Dunn, John E (7 March 2014). "Invisible Russian cyberweapon stalked US and Ukraine since 2005, new research reveals". Techworld. Archived from the original on 13 April 2016. Retrieved 10 May 2016.
  7. "The Snake Campaign". BAE Systems. 2014. Archived from the original on 2020-07-22. Retrieved 2020-07-21.
  8. "Uroburos. Highly complex espionage software with Russian roots" (PDF). G Data SecurityLabs. February 2014. Archived (PDF) from the original on 2020-10-07. Retrieved 2020-07-21.
  9. Прес-служба Держспецзв’язку (23 May 2014). "Коментар Держспецзв'язку щодо інциденту в ЦВК". Archived from the original on 23 September 2015. Retrieved 26 May 2014.
  10. Кім Зеттер, Wired (17 March 2016). "Хакерська атака Росії на українську енергосистему: як це було". Texty.org. Retrieved 18 March 2016.
  11. "Міненерговугілля має намір утворити групу за участю представників усіх енергетичних компаній, що входять до сфери управління Міністерства, для вивчення можливостей щодо запобігання несанкціонованому втручанню в роботу енергомереж". Міністерство енергетики та вугільної промисловості України. 12 February 2016. Archived from the original on 22 July 2020. Retrieved 21 July 2020.
  12. Kim Zetter (January 10, 2017). "The Ukrainian Power Grid Was Hacked Again". Vice Motherboard. Archived from the original on January 18, 2017. Retrieved July 21, 2020.
  13. "Основной версией недавнего отключения электричества в Киеве названа кибератака хакеров". ITC.ua. 19 December 2016. Archived from the original on 21 July 2020. Retrieved 21 July 2020.
  14. "Щодо роботи інформаційно-телекомунікаційної системи Казначейства". Урядовий портал. 6 December 2016. Archived from the original on 10 December 2016. Retrieved 11 December 2016.
  15. "Україна програє кібервійну. Хакери атакують державні фінанси". Економічна правда. 9 December 2016. Archived from the original on 10 December 2016. Retrieved 11 December 2016.
  16. Anton Cherepanov, ESET (30 June 2017). "TeleBots are back: Supply-chain attacks against Ukraine". We Live Security. Archived from the original on 21 July 2020. Retrieved 21 July 2020.
  17. "Statement from the Press Secretary". whitehouse.gov. 2018-02-15. Archived from the original on 2021-02-03. Retrieved 2021-03-03 – via National Archives.
  18. Kramer, Andrew E. (2022-01-14). "Hackers Bring Down Government Sites in Ukraine". The New York Times. ISSN 0362-4331. Archived from the original on 2022-01-15. Retrieved 2022-01-17.
  19. Alspach, Kyle (2022-02-04). "Microsoft discloses new details on Russian hacker group Gamaredon". VentureBeat. Archived from the original on 2022-02-06. Retrieved 2022-02-06.
  20. Lauren Feiner (2022-02-23). "Cyberattack hits Ukrainian banks and government websites". CBNC. Archived from the original on 2022-02-23. Retrieved 2022-02-23.
  21. Stone, Mike; Roulette, Joey (2023-06-01). "SpaceX's Starlink wins Pentagon contract for satellite services to Ukraine". Reuters. Retrieved 2023-06-01.
  22. "How Elon Musk's satellites have saved Ukraine and changed warfare". The Economist. ISSN 0013-0613. Retrieved 2023-06-06.
  23. Lyngaas, Sean (2023-08-31). "Russian military hackers take aim at Ukrainian soldiers' battle plans, US and allies say | CNN Politics". CNN. Retrieved 2023-09-09.
  24. Alexey Minakov (1 June 2016). "Антивірусна компанія ESET на службі терористів Донбасу". Інформнапалм. Archived from the original on 16 July 2020. Retrieved 21 July 2020.
  25. Антон Черепанов (18 May 2016). "Operation Groundbait ("Прикормка"): Аналіз інструментарію спостереження" (PDF). ESET. Archived (PDF) from the original on 1 June 2016. Retrieved 21 July 2020.
  26. Censor.NET. ""Operation May 9": Ukrainian hackers deface several terrorists' propaganda sites. VIDEO+PHOTO". Censor.NET. Archived from the original on 2020-07-21. Retrieved 2020-07-21.
  27. "9 hacks on MAY 9: successful operation of Ukrainian hackers #OpMay9 (VIDEO)". InformNapalm.org (English). 2016-05-11. Archived from the original on 2020-07-15. Retrieved 2020-07-21.
  28. "Хакери знищили сайт російських пропагандистів "Anna News" і розмістили відеозвернення". InformNapalm.org. InformNapalm. 29 April 2016. Archived from the original on 19 September 2016. Retrieved 11 May 2016.
  29. "Hackers In Ukraine Deface Separatist Websites To Mark Victory Day". RadioFreeEurope/RadioLiberty. Archived from the original on 2020-06-25. Retrieved 2020-07-21.
  30. "ЗС РФ використовували станцію Р-330Ж у боях за Дебальцеве. Знімки робочого терміналу". InformNapalm.org. InformNapalm. 2 May 2016. Archived from the original on 19 September 2016. Retrieved 11 May 2016.
  31. "Злом пропагандистів РФ. Частина 1. Зенін: сприяння терористам, офшори та відпочинок у Європі". Інформнапалм. 6 June 2016. Archived from the original on 15 July 2020. Retrieved 21 July 2020.
  32. "Взлом пропагандистов РФ. Часть 2: переписка о МН17". Інформнапалм. 14 June 2016. Archived from the original on 16 July 2020. Retrieved 21 July 2020.
  33. Christopher Miller (November 2, 2016). "Inside The Ukrainian 'Hacktivist' Network Cyberbattling The Kremlin". RadioFreeEurope/RadioLiberty. Archived from the original on 2022-01-03. Retrieved 2022-01-17.
  34. Pearson, James (2022-02-27). "Ukraine launches 'IT army,' takes aim at Russian cyberspace". Reuters. Retrieved 2022-02-27.
  35. "Microsoft: Russian Cyber Spying Targets 42 Ukraine Allies". VOA. Retrieved 2022-07-12.
  36. "Microsoft Report Details Relentless Russian Cyberattacks On Ukraine". RadioFreeEurope/RadioLiberty. Retrieved 2022-07-12.
  37. "Microsoft: Russian hacks often accompany Ukraine attacks". Associated Press. 27 April 2022. Retrieved 2022-09-18.
  • Inside The Ukrainian 'Hacktivist' Network Cyberbattling The Kremlin
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.