Ukraine points finger at Russian security services in recent cyberattack
KIEV: Ukraine said on Saturday that Russian security services were involved in a recent cyberattack on the country, with the aim of destroying important data and spreading panic.
The Security Service of Ukraine (SBU), Ukraine’s state security service, said the attack, which started in Ukraine and spread around the world on Tuesday, was by the same hackers who attacked the Ukrainian power grid in December 2016. Ukrainian politicians were quick to blame Russia for Tuesday’s attack, but a Kremlin spokesman dismissed “unfounded blanket accusations.”
Cyber security firms are trying to piece together who was behind the computer worm, dubbed NotPetya by some experts, which shutdown computers, hit banks, disrupted shipping and shut down a chocolate factory in Australia.
The attack also hit major Russian firms, leading some cybersecurity researchers to suggest that Moscow was not behind it.
The malicious code in the virus encrypted data on computers, and demanded victims pay a $300 ransom, similar to the extortion tactic used in a global WannaCry ransomware attack in May. But Ukrainian officials and some security experts say the ransomware feature was likely a smokescreen.
Relations between Ukraine and Russia went into freefall after Moscow’s annexation of Crimea in 2014 and the subsequent outbreak of a Kremlin-backed separatist insurgency in eastern Ukraine that has killed more than 10,000 people.
Hacking Ukrainian state institutions is part of what Ukraine says is a “hybrid war” by Russia on Kiev. Russia denies sending troops or military equipment to eastern Ukraine.
“The available data, including those obtained in cooperation with international antivirus companies, give us reason to believe that the same hacking groups are involved in the attacks, which in December 2016 attacked the financial system, transport and energy facilities of Ukraine using TeleBots and BlackEnergy,” the SBU said.
“This testifies to the involvement of the special services of Russian Federation in this attack.”
The SBU in an earlier statement on Friday said it had seized equipment it said belonged to Russian agents in May and June to launch cyberattacks against Ukraine and other countries.
Referencing the $300 ransomware demand, the SBU said “the virus is cover for a large-scale attack on Ukraine. This is evidenced by a lack of a real mechanism for taking possession of the funds ... enrichment was not the aim of the attack.”
“The main purpose of the virus was the destruction of important data, disrupting the work of public and private institutions in Ukraine and spreading panic among the people.”
A cyberattack in December on a Ukrainian state energy computer caused a power cut in the northern part of the capital Kiev.
The Russian Foreign Ministry and Federal Security Service did not immediately respond to requests for comment on the latest allegations.