2022 Ukraine cyberattacks

At the time of the attack, tensions between Russia and Ukraine were high, with over 100,000 Russian troops stationed near the border with Ukraine and talks between Russia and NATO ongoing.^[1] The US government alleged that Russia was preparing for an invasion of Ukraine, including "sabotage activities and information operations". The US also allegedly found evidence of "a false-flag operation" in Eastern Ukraine, which could be used as a pretext for invasion.^[2] Russia denies the accusations of an impending invasion, but has threatened "military-technical action" if its demands are not met, especially a request that NATO never admit Ukraine to the alliance. Russia has spoken strongly against the expansion of NATO to its borders.^[2]

The attacks on 14 January 2022 consisted of the hackers replacing the websites with text in Ukrainian, erroneous Polish, and Russian, which state "be afraid and wait for the worst" and allege that personal information has been leaked to the internet.^[7] About 70 government websites were affected, including the Ministry of Foreign Affairs, the Cabinet of Ministers, and the Security and Defense Council.^[8] The SBU has stated that no data was leaked. Soon after the message appeared, the sites were taken offline. The sites were mostly restored within a few hours.^[1] Deputy secretary of the NSDC Serhiy Demedyuk, stated that the Ukrainian investigation of the attack suspects that a third-party company's administration rights were used to carry out the attack. The unnamed company's software had been used since 2016 to develop government sites, most of which were affected in the attack.^[8] Demedyuk also blamed UNC1151, a hacker group allegedly linked to Belarusian intelligence, for the attack.^[9]

A separate destructive malware attack took place around the same time, first appearing on 13 January. First detected by the Microsoft Threat Intelligence Center (MSTIC), malware was installed on devices belonging to "multiple government, non-profit, and information technology organizations" in Ukraine.^[10] Later, this was reported to include the State Emergency Service and the Motor Transport Insurance Bureau.^[11] The software, designated DEV-0586 or WhisperGate, was designed to look like ransomware, but lacks a recovery feature, indicating an intent to simply destroy files instead of encrypting them for ransom.^[10] The MSTIC reported that the malware was programmed to execute when the targeted device was powered down. The malware would overwrite the master boot record (MBR) with a generic ransom note. Next, the malware downloads a second .exe file, which would overwrite all files with certain extensions from a predetermined list, deleting all data contained in the targeted files. The ransomware payload differs from a standard ransomware attack in several ways, indicating a solely destructive intent.^[12] However, later assessments indicate that damage was limited, likely a deliberate choice by the attackers.^[11]

On 19 January, the Russian advanced persistent threat (APT) Gamaredon (also known as Primitive Bear) attempted to compromise a Western government entity in Ukraine.^[13] Cyber espionage appears to be the main goal of the group,^[13] which has been active since 2013; unlike most APTs, Gamaredon broadly targets all users all over the globe (in addition to also focusing on certain victims, especially Ukrainian organizations^[14]) and appears to provide services for other APTs.^[15] For example, the InvisiMole threat group has attacked select systems that Gamaredon had earlier compromised and fingerprinted.^[14]

Reactions to January attack

Russia

Russia denied allegations by Ukraine that it was linked to the cyberattacks.^[16]

Ukraine

Ukrainian government institutions, such as the Center for Strategic Communications and Information Security and the Ministry of Foreign Affairs, suggested that the Russian Federation was the perpetrator of the attack, noting that this would not be the first time that Russia attacked Ukraine.^[7][17]

International organizations

European Union High Representative Josep Borrell said of the source of the attack: “One can very well imagine with a certain probability or with a margin of error, where it can come from.”^[18] The Secretary General of NATO Jens Stoltenberg announced that the organization would increase its coordination with Ukraine on cyberdefense in the face of potential additional cyberattacks. NATO later announced that it would sign an agreement granting Ukraine access to its malware information sharing platform.^[2][7]

Discover more about January attacks related topics

Polish language

Polish language

Polish is a West Slavic language of the Lechitic group written in the Latin script. It is spoken primarily in Poland and serves as the native language of the Poles. In addition to being the official language of Poland, it is also used by the Polish diaspora. There are over 50 million Polish speakers around the world. It ranks as the sixth most-spoken among languages of the European Union. Polish is subdivided into regional dialects and maintains strict T–V distinction pronouns, honorifics, and various forms of formalities when addressing individuals.

Russian language

Russian language

Russian is an East Slavic language mainly spoken in Russia. It is the native language of the Russians and belongs to the Indo-European language family. It is one of four living East Slavic languages, and is also a part of the larger Balto-Slavic languages. Besides Russia itself, Russian is an official language in Belarus, Kazakhstan, and Kyrgyzstan, and is used widely as a lingua franca throughout Ukraine, the Caucasus, Central Asia, and to some extent in the Baltic states. It was the de facto language of the former Soviet Union.

Ministry of Foreign Affairs (Ukraine)

Ministry of Foreign Affairs (Ukraine)

The Ministry of Foreign Affairs of Ukraine is the ministry of the Ukrainian government that oversees the foreign relations of Ukraine. The head of the ministry is the Minister of Foreign Affairs.

National Security and Defense Council of Ukraine

National Security and Defense Council of Ukraine

The National Security and Defense Council of Ukraine is the coordinating state body of the executive power under the President of Ukraine on issues of national security and defense.

Microsoft

Microsoft

Microsoft Corporation is an American multinational technology corporation headquartered in Redmond, Washington. Microsoft's best-known software products are the Windows line of operating systems, the Microsoft Office suite, and the Internet Explorer and Edge web browsers. Its flagship hardware products are the Xbox video game consoles and the Microsoft Surface lineup of touchscreen personal computers. Microsoft ranked No. 14 in the 2022 Fortune 500 rankings of the largest United States corporations by total revenue; it was the world's largest software maker by revenue as of 2022. It is considered as one of the Big Five American information technology companies, alongside Alphabet, Amazon, Apple, and Meta.

Master boot record

Master boot record

A master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBRs was publicly introduced in 1983 with PC DOS 2.0.

.exe

.exe

.exe is a common filename extension denoting an executable file for Microsoft Windows, OS/2, and DOS.

Advanced persistent threat

Advanced persistent threat

An advanced persistent threat (APT) is a stealthy threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state-sponsored groups conducting large-scale targeted intrusions for specific goals.

Gamaredon

Gamaredon

Gamaredon, also known as Primitive Bear and Actinium is a Russian advanced persistent threat that has been active since at least 2013.

Russia–Ukraine relations

Russia–Ukraine relations

There are no diplomatic or bilateral relations between Ukraine and Russia. The two countries have been in a de facto state of war since 24 February 2022, although Russia has invaded Ukrainian Crimea and Donbas regions in February 2014. Following the Ukrainian Revolution of Dignity in 2014, Ukraine's Crimean Peninsula was occupied by unmarked Russian forces, and later illegally annexed by Russia, while pro-Russia separatists simultaneously engaged the Ukrainian military in an armed conflict for control over eastern Ukraine; these events marked the beginning of the Russo-Ukrainian War. In a major escalation of the conflict on 24 February 2022, Russia launched a full-scale invasion of the Ukrainian mainland across a broad front, causing Ukraine to sever all formal diplomatic ties with Russia.

Josep Borrell

Josep Borrell

Josep Borrell Fontelles is a Spanish politician serving as High Representative of the Union for Foreign Affairs and Security Policy since 1 December 2019. A member of the Spanish Socialist Workers' Party (PSOE), he served as President of the European Parliament from 2004 to 2007 and as Minister of Foreign Affairs, European Union and Cooperation in the Government of Spain from 2018 to 2019.

Jens Stoltenberg

Jens Stoltenberg

Jens Stoltenberg is a Norwegian politician who has been serving as the 13th Secretary General of NATO since 2014. A member of the Norwegian Labour Party, he previously served as the 34th Prime Minister of Norway from 2000 to 2001, and again from 2005 until 2013.

On 15 February, a large DDoS attack brought down the websites of the defense ministry, army, and Ukraine's two largest banks, PrivatBank and Oschadbank.^[3][19][4] Cybersecurity monitor NetBlocks reported that the attack intensified over the course of the day, also affecting the mobile apps and ATMs of the banks.^[3] The New York Times described it as "the largest assault of its kind in the country's history". Ukrainian government officials stated that the attack was likely carried out by a foreign government, and suggested that Russia was behind it.^[20] Although there were fears that the denial-of-service attack could be cover for more serious attacks, a Ukrainian official said that no such attack had been discovered.^[11]

According to UK government^[21] and National Security Council of the US, the attack was performed by Russian Main Intelligence Directorate (GRU). American cybersecurity official Anne Neuberger stated that known GRU infrastructure has been noted transmitting high volumes of communications to Ukraine-based IP addresses and domains.^[22] Kremlin spokesperson Dmitry Peskov denied that the attack originated from Russia.^[23]

On 23 February, a third DDoS attack took down multiple Ukrainian government, military, and bank websites. Although military and banking websites were described as having “a more rapid recovery”, the SBU website was offline for an extended period.^[24] Just before 5 pm, data wiping malware was detected on hundreds of computers belonging to multiple Ukrainian organizations, including in the financial, defense, aviation, and IT services sectors. ESET Research dubbed the malware HermeticWiper, named for its genuine code signing certificate from Cyprus-based company Hermetica Digital Ltd. The wiper was reportedly compiled on 28 December 2021, while Symantec reported malicious activity as early as November 2021, implying that the attack was planned months ahead of time. Symantec also reported wiper attacks against devices in Lithuania, and that some organizations were compromised months before the wiper attack. Similar to the January WhisperGate attack, ransomware is often deployed simultaneously with the wiper as a decoy, and the wiper damages the master boot record.^[25][26]

A day prior to the attack, the EU had deployed a cyber rapid-response team consisting of about ten cybersecurity experts from Lithuania, Croatia, Poland, Estonia, Romania, and the Netherlands. It is unknown if this team helped mitigate the effects of the cyberattack.^[27]

The attack coincided with the Russian recognition of separatist regions in eastern Ukraine and the authorization of Russian troop deployments there. The US and UK blamed the attack on Russia. Russia denied the accusations and called them “Russophobic”.^[24]

On February 26, the Minister of Digital Transformation of Ukraine Mykhailo Fedorov announced the creation of an IT army, which will include cyber specialists, copywriters, designers, marketers and targetologists. As a result, numerous Russian government websites and banks were attacked.^[28] Dozens of issues of Russian stars and officials have been made public, and Ukrainian songs have been broadcast on some television channels, including Prayer for Ukraine.^[29][30]

Discover more about February attacks related topics

Denial-of-service attack

Denial-of-service attack

In computing, a denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to a network. Denial of service is typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.

PrivatBank

PrivatBank

PrivatBank is the largest Ukrainian bank in terms of assets and the leader of Ukrainian retail banking market. It was registered on 19 March 1992. PrivatBank was one of the first to introduce modern digital banking and unique technological solutions in Ukraine, allowing customers to use most services remotely by means of Privat24.

NetBlocks

NetBlocks

NetBlocks is a watchdog organization that monitors cybersecurity and the governance of the Internet. The service was launched in 2017 to monitor Internet freedom.

Mobile banking

Mobile banking

Mobile banking is a service provided by a bank or other financial institution that allows its customers to conduct financial transactions remotely using a mobile device such as a smartphone or tablet. Unlike the related internet banking it uses software, usually called an app, provided by the financial institution for the purpose. Mobile banking is usually available on a 24-hour basis. Some financial institutions have restrictions on which accounts may be accessed through mobile banking, as well as a limit on the amount that can be transacted. Mobile banking is dependent on the availability of an internet or data connection to the mobile device.

Automated teller machine

Automated teller machine

An automated teller machine (ATM) is an electronic telecommunications device that enables customers of financial institutions to perform financial transactions, such as cash withdrawals, deposits, funds transfers, balance inquiries or account information inquiries, at any time and without the need for direct interaction with bank staff.

GRU

GRU

The Main Directorate of the General Staff of the Armed Forces of the Russian Federation, formerly the Main Intelligence Directorate, and still commonly known by its previous abbreviation GRU, is the foreign military intelligence agency of the General Staff of the Armed Forces of the Russian Federation. The GRU controls the military intelligence service and maintains its own special forces units.

Anne Neuberger

Anne Neuberger

Anne Neuberger is an American national security official who serves as the deputy national security advisor for cyber and emerging technology in the Biden administration. Prior to this role, she served for over a decade at the NSA, as director of cybersecurity, as assistant deputy director of operations and as the agency's first chief risk officer. She joined the federal government as a White House fellow, working at the Pentagon, and subsequently served as deputy chief management officer of the Navy, before joining NSA. Before entering government service, Neuberger was senior vice president of operations at American Stock Transfer & Trust Company.

Dmitry Peskov

Dmitry Peskov

Dmitry Sergeyevich Peskov is a Russian diplomat and the press secretary for Russian President Vladimir Putin.

Code signing

Code signing

Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted since it was signed. The process employs the use of a cryptographic hash to validate authenticity and integrity. Code signing was invented in 1995 by Michael Doyle, as part of the Eolas WebWish browser plug-in, which enabled the use of public-key cryptography to sign downloadable Web app program code using a secret key, so the plug-in code interpreter could then use the corresponding public key to authenticate the code before allowing it access to the code interpreter’s APIs.

Public key certificate

Public key certificate

In cryptography, a public key certificate, also known as a digital certificate or identity certificate, is an electronic document used to prove the validity of a public key. The certificate includes information about the key, information about the identity of its owner, and the digital signature of an entity that has verified the certificate's contents. If the signature is valid, and the software examining the certificate trusts the issuer, then it can use that key to communicate securely with the certificate's subject. In email encryption, code signing, and e-signature systems, a certificate's subject is typically a person or organization. However, in Transport Layer Security (TLS) a certificate's subject is typically a computer or other device, though TLS certificates may identify organizations or individuals in addition to their core role in identifying devices. TLS, sometimes called by its older name Secure Sockets Layer (SSL), is notable for being a part of HTTPS, a protocol for securely browsing the web.

IT Army of Ukraine

IT Army of Ukraine

The IT Army of Ukraine is a volunteer cyberwarfare organisation created at the end of February 2022 to fight against digital intrusion of Ukrainian information and cyberspace after the beginning of the Russian invasion of Ukraine on February 24, 2022. The group also conducts offensive cyberwarfare operations, and Chief of Head of State Special Communications Service of Ukraine Victor Zhora said its enlisted hackers would only attack military targets.

Prayer for Ukraine

Prayer for Ukraine

"Prayer for Ukraine" is a patriotic Ukrainian hymn published in 1885, which became a spiritual anthem of Ukraine. The text was written by Oleksandr Konysky, and the music was composed by Mykola Lysenko, first with a children's choir in mind. The song became the regular closing hymn in services of the Ukrainian Greek Catholic Church, the Orthodox Church of Ukraine and other churches. It gained national significance when it was performed by mass choirs during the Ukrainian War of Independence in 1917–1920. The hymn was intended to be an official spiritual anthem of Ukraine. It has closed sessions of oblast councils, and has been performed at major national functions.

Ratio of DNS queries defensively blocked by Quad9 in Ukraine and Poland, 7-9 March 2022.

Beginning on 6 March, Russia began to significantly increase the frequency of its cyber-attacks against Ukrainian civilians.^[31]

On 9 March alone, the Quad9 malware-blocking recursive resolver intercepted and mitigated 4.6 million attacks against computers and phones in Ukraine and Poland, at a rate more than ten times higher than the European average. Cybersecurity expert Bill Woodcock of Packet Clearing House noted that the blocked DNS queries coming from Ukraine clearly show an increase in phishing and malware attacks against Ukrainians, and noted that the Polish numbers were also higher than usual because 70%, or 1.4 million, of the Ukrainian refugees were in Poland at the time.^[32] Explaining the nature of the attack, Woodcock said "Ukrainians are being targeted by a huge amount of phishing, and a lot of the malware that is getting onto their machines is trying to contact malicious command-and-control infrastructure."^[31]

On March 28, RTComm.ru, a Russian Internet service provider, BGP hijacked Twitter's 104.244.42.0/24 IPv4 address block for a period of two hours fifteen minutes.^[33][34]