2022 Ukraine Cyberattacks

During the prelude to the 2022 Russian invasion of Ukraine and the 2022 Russian invasion of Ukraine, multiple cyberattacks against Ukraine were recorded, as well as some attacks on Russia. The first major cyberattack took place on 14 January 2022, and took down more than a dozen of Ukraine's government websites. According to Ukrainian officials, around 70 government websites, including the Ministry of Foreign Affairs, the Cabinet of Ministers, and the Security and Defense Council, were attacked. Most of the sites were restored within hours of the attack. On 15 February, another cyberattack took down multiple government and bank services.

On 24 February, Russia launched a full-scale invasion of Ukraine. Western intelligence officials believed that this would be accompanied by a major cyberattack against Ukrainian infrastructure, but this threat did not materialize. Cyberattacks on Ukraine have continued during the invasion, but with limited success. Independent hacker groups, such as Anonymous, have launched cyberattacks on Russia in retaliation for the invasion.

Background

At the time of the attack, tensions between Russia and Ukraine were high, with over 100,000 Russian troops stationed near the border with Ukraine and talks between Russia and NATO ongoing. The US government alleged that Russia was preparing for an invasion of Ukraine, including "sabotage activities and information operations". The US also allegedly found evidence of "a false-flag operation" in Eastern Ukraine, which could be used as a pretext for invasion. Russia denies the accusations of an impending invasion, but has threatened "military-technical action" if its demands are not met, especially a request that NATO never admit Ukraine to the alliance. Russia has spoken strongly against the expansion of NATO to its borders.

January attacks

The attacks on 14 January 2022 consisted of the hackers replacing the websites with text in Ukrainian, erroneous Polish, and Russian, which state "be afraid and wait for the worst" and allege that personal information has been leaked to the internet. About 70 government websites were affected, including the Ministry of Foreign Affairs, the Cabinet of Ministers, and the Security and Defense Council. The SBU has stated that no data was leaked. Soon after the message appeared, the sites were taken offline. The sites were mostly restored within a few hours. Deputy secretary of the NSDC Serhiy Demedyuk, stated that the Ukrainian investigation of the attack suspects that a third-party company's administration rights were used to carry out the attack. The unnamed company's software had been used since 2016 to develop government sites, most of which were affected in the attack. Demedyuk also blamed UNC1151, a hacker group allegedly linked to Belarusian intelligence, for the attack.

A separate destructive malware attack took place around the same time, first appearing on 13 January. First detected by the Microsoft Threat Intelligence Center (MSTIC), malware was installed on devices belonging to "multiple government, non-profit, and information technology organizations" in Ukraine. Later, this was reported to include the State Emergency Service and the Motor Transport Insurance Bureau. The software, designated DEV-0586 or WhisperGate, was designed to look like ransomware, but lacks a recovery feature, indicating an intent to simply destroy files instead of encrypting them for ransom. The MSTIC reported that the malware was programmed to execute when the targeted device was powered down. The malware would overwrite the master boot record (MBR) with a generic ransom note. Next, the malware downloads a second .exe file, which would overwrite all files with certain extensions from a predetermined list, deleting all data contained in the targeted files. The ransomware payload differs from a standard ransomware attack in several ways, indicating a solely destructive intent. However, later assessments indicate that damage was limited, likely a deliberate choice by the attackers.

On 19 January, the Russian advanced persistent threat (APT) Gamaredon (also known as Primitive Bear) attempted to compromise a Western government entity in Ukraine. Cyber espionage appears to be the main goal of the group, which has been active since 2013; unlike most APTs, Gamaredon broadly targets all users all over the globe (in addition to also focusing on certain victims, especially Ukrainian organizations) and appears to provide services for other APTs. For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted.

Reactions to January attack

Russia

Russia denied allegations by Ukraine that it was linked to the cyberattacks.

Ukraine

Ukrainian government institutions, such as the Center for Strategic Communications and Information Security and the Ministry of Foreign Affairs, suggested that the Russian Federation was the perpetrator of the attack, noting that this would not be the first time that Russia attacked Ukraine.

International organizations

European Union High Representative Josep Borrell said of the source of the attack: “One can very well imagine with a certain probability or with a margin of error, where it can come from.” The Secretary General of NATO Jens Stoltenberg announced that the organization would increase its coordination with Ukraine on cyberdefense in the face of potential additional cyberattacks. NATO later announced that it would sign an agreement granting Ukraine access to its malware information sharing platform.

February attacks

On 15 February, a large DDoS attack brought down the websites of the defense ministry, army, and Ukraine's two largest banks, PrivatBank and Oschadbank. Cybersecurity monitor NetBlocks reported that the attack intensified over the course of the day, also affecting the mobile apps and ATMs of the banks. ''The'' ''New York Times'' described it as "the largest assault of its kind in the country's history". Ukrainian government officials stated that the attack was likely carried out by a foreign government, and suggested that Russia was behind it. Although there were fears that the denial-of-service attack could be cover for more serious attacks, a Ukrainian official said that no such attack had been discovered.

According to UK government and National Security Council of the US, the attack was performed by Russian Main Intelligence Directorate (GRU). American cybersecurity official Anne Neuberger stated that known GRU infrastructure has been noted transmitting high volumes of communications to Ukraine-based IP addresses and domains. Kremlin spokesperson Dmitry Peskov

HOME


Content is Copyleft
Website design, code, and AI is Copyrighted (c) 2014-2017 by Stephen Payne


Consider donating to Wikimedia



As an Amazon Associate I earn from qualifying purchases