Microsoft Reports Russian Cyberattacks Link to Military Operations In Ukraine

Russia appears to be attempting to employ 'hybrid war' tactics, linking its military attacks on physical installations with cyberattacks on technology associated with those locations. 

While this has not yielded many positive results to date, the Ukrainians report an increase in both the number and intensity of such efforts which often target essential files on hard drives so the machines using them cannot boot up. JL 

Dan Goodin reports in ars technica, image, The Strategy Bridge:

There are many examples of the “hybrid war” Russia has waged against Ukraine over the past year, according to Microsoft. Since shortly before the invasion began, the company said, hackers in six groups aligned with the Kremlin have launched 237 operations in concert with the physical attacks on the battlefield. Almost 40 of them targeting hundreds of systems used wiper malware, which deletes essential files stored on hard drives so the machines can’t boot. Since the Russian invasion of Ukraine began, Russian cyberattacks have been deployed to support the military’s strategic and tactical objectives.

On March 1, Russian forces invading Ukraine took out a TV tower in Kyiv after the Kremlin declared its intention to destroy “disinformation” in the neighboring country. That public act of kinetic destruction accompanied a much more hidden but no less damaging action: targeting a prominent Ukrainian broadcaster with malware to render its computers inoperable.

The dual action is one of many examples of the “hybrid war” Russia has waged against Ukraine over the past year, according to a report published Wednesday by Microsoft. Since shortly before the invasion began, the company said, hackers in six groups aligned with the Kremlin have launched no fewer than 237 operations in concert with the physical attacks on the battlefield. Almost 40 of them targeting hundreds of systems used wiper malware, which deletes essential files stored on hard drives so the machines can’t boot.

Enter your email to get the Ars Technica newsletter

Join Ars Technica and

Get Our Best Tech Stories

DELIVERED STRAIGHT TO YOUR INBOX.

By signing up, you agree to our user agreement (including the class action waiver and arbitration provisions), our privacy policy and cookie statement, and to receive marketing and account-related emails from Ars Technica. You can unsubscribe at any time.

“As today’s report details, Russia’s use of cyberattacks appears to be strongly correlated and sometimes directly timed with its kinetic military operations targeting services and institutions crucial for civilians,” Tom Burt, Microsoft corporate vice president for customer security, wrote. He said the “relentless and destructive Russian cyberattacks” were particularly concerning because many of them targeted critical infrastructure that could have cascading negative effects on the country.

It’s not clear if the Kremlin is coordinating cyber operations with kinetic attacks or if they’re the result of independent bodies pursuing a common goal of disrupting or degrading Ukraine’s military and government while undermining citizens' trust in those institutions. What’s undeniable is that the two components in this hybrid war have complemented each other.

Examples of Russian cyber actions correlating to political or diplomatic development taken against Ukraine before the invasion began include:

• The deployment of wiper malware dubbed WhisperGate on a “limited number” of Ukrainian government and IT sector networks on January 3 and the defacement and DDoSing of Ukrainian websites a day later. Those actions came as diplomatic talks between Russia and Ukrainian allies broke down.
• DDoS attacks waged on Ukrainian financial institutions on February 15 and February 16. On February 17, the Kremlin said it would be “forced to respond” with military-technical measures if the US didn’t capitulate to Kremlin demands.
• The deployment on February 23 of wiper malware by another Russian state group on hundreds of Ukrainian systems in the government, IT, energy, and financial sectors. Two days earlier, Putin recognized the independence of Ukrainian separatists aligned with Russia.

Enlarge

Microsoft

Russia stepped up its cyber offensive once the invasion began. Highlights include:

• The February 14 and February 17 compromises of critical infrastructure in the Ukrainian cities of Odesa and Sumy. These actions appeared to have set the stage for February 24, when Russian tanks advanced into Sumy.
• On March 2, Russian hackers burrowed into the network of a Ukrainian nuclear power company. A day later, Russian forces occupied Ukraine’s biggest nuclear power station.
• On March 11, a government agency in Dnipro was targeted with a destructive implant. The same day, Russian forces launched strikes into Dnipro government buildings.

Enlarge

Microsoft

Wednesday’s report said that as early as March 2021, hackers aligned with Russia prepared for conflict with its neighboring country by escalating actions against organizations inside or aligned with Ukraine.

The actions haven’t stopped since. Burt wrote:

When Russian troops first started to move toward the border with Ukraine, we saw efforts to gain initial access to targets that could provide intelligence on Ukraine’s military and foreign partnerships. By mid-2021, Russian actors were targeting supply chain vendors in Ukraine and abroad to secure further access not only to systems in Ukraine but also NATO member states. In early 2022, when diplomatic efforts failed to de-escalate mounting tensions around Russia’s military build-up along Ukraine’s borders, Russian actors launched destructive wiper malware attacks against Ukrainian organizations with increasing intensity. Since the Russian invasion of Ukraine began, Russian cyberattacks have been deployed to support the military’s strategic and tactical objectives. It’s likely the attacks we’ve observed are only a fraction of activity targeting Ukraine.

The report includes a variety of security measures that can be implemented by likely targets of Russian cyberattacks to protect themselves. One measure includes turning on a feature called controlled folders. The feature, which isn’t enabled by default, is designed to protect data in specific folders from destruction from ransomware, wipers, and other types of destructive malware.