How Ukraine's Global "IT Army" Foils Russian Malware Attacks

The Ukraine-Russia cyberwar remains an evolving game of wits with strikes and counterstrikes offsetting each other. 

So far Ukraine has held its own and Russia has not dominated as was expected, but they continue to try new approaches to test each others defenses. Ukraine, fortunately, has a lot of support from the global tech community. JL 

Lorenzo Franceschi-Bicchierai reports in Motherboard, image Brookings Institution:

Russian hackers tried to trick Ukrainian and international volunteers into using a malicious Android app disguised as an app to launch DDoS attacks against Russian sites, according to new research by Google. The app actually didn't DDoS anything, but was designed to map out and figure out who would want to use such an app to attack Russian websites. “Creating it makes perfect sense. Everybody knows the IT Cyber Army does DDoS on predestined IPs, so many would believe. But it smells fake from miles away.”

Russian government hackers tried to trick Ukrainian and international volunteers into using a malicious Android app disguised as an app to launch Distributed Denial of Service (DDoS) attacks against Russian sites, according to new research published by Google on Tuesday. 

Since the beginning of the Russian invasion, Ukraine has resisted not only on the ground, but also online. A loose collective of technologists and hackers has organized under an umbrella quasi-hacktivist organization called the IT Army, and they have launched constant and persistent cyberattacks against Russian websites.

The Russian government tried to turn this volunteer effort around to unmask Ukrainian hackers, in a smart, but ultimately failed attempt. 

“This is interesting and new, and [Russian government hackers] sort of testing the boundaries again, and trying to explore different things. The Russian groups definitely keep us on our toes,” Shane Huntley, the head of the Google research team Threat Analysis Group, told Motherboard in a phone call. 

Huntley said that in recent years, Russian hackers have done hack and leaks, supply chain hacks, and now fake apps. “There's this constant evolving of them not sitting on one particular attack path, but actually trying different things and evolving their techniques and seeing what works. Not all of their attempts work and not all their approaches do, but there's considerable innovation in the ways and things they're trying and it looks almost like an experimental mindset to me.”

Do you have information about the activities of Ukrainian or Russian hacking groups? We’d love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, Wickr/Telegram/Wire @lorenzofb, or email lorenzofb@vice.com

Google researchers wrote in the report that the app was created by the hacking group known as Turla, which several cybersecurity companies believe works for the Kremlin. Huntley said that they were able to attribute this operation to Turla because they have tracked the group for a long time and have good visibility into their infrastructure and link it to this app.

The Russian embassy in Washington D.C. did not respond to a request for comment. 

The hackers pretended to be a “community of free people around the world who are fighting russia’s aggression”—much like the IT Army. But the app they developed was actually malware. The hackers called it CyberAzov, in reference to the Azov Regiment or Battalion, a far-right group that has become part of Ukraine’s national guard. To add more credibility to the ruse they hosted the app on a domain “spoofing” the Azov Regiment: cyberazov[.]com. 

Motherboard reached out to the email address that was displayed on the malicious website, but received no response.

The app actually didn't DDoS anything, but was designed to map out and figure out who would want to use such an app to attack Russian websites, according to Huntely.

“Now that they have an app that they control, and they see where it came from, they can actually work out what the infrastructure looks like, and work out where the people that are potentially doing these sorts of attacks are,” Huntley said. 

Google said the fake app wasn’t hosted on the Play Store, and that the number of installs “was miniscule.” 

Still, it was a smart attempt to trick unknowing Ukrainians or people interested in working with Ukrainians to fall into the trap.

“🤮 but smart. I sensed it could not be genuine,” Marina Krotofil, a cybersecurity professional of Ukrainian origin, told Motherboard. “Creating it makes perfect sense, it would be stupid not to do it. Everybody knows the IT Cyber Army does DDoS on predestined IPs, so many would believe. But it smells fake from miles away.”