Russia did use cyberattacks to help military operations

WASHINGTON » For weeks after the outbreak of the war in Ukraine, U.S. officials wondered about the weapon that seemed to be missing: Russia’s cyberarsenal, which most experts expected would be used in the opening hours of an invasion to bring down Ukraine’s power grid, fry its cellphone system and cut off President Volodymyr Zelenskyy from the world.

None of that happened. But in a study released Wednesday by Microsoft, it is now clear that Russia conducted hundreds of far more subtle attacks, many timed to coincide with incoming missile or ground attacks. And it turned out that, just as in the ground war, the Russians were less skillful, and the Ukrainians were better defenders, than most experts expected.

“They brought destructive efforts, they brought espionage efforts, they brought all their best actors to focus on this,” said Tom Burt, who oversees Microsoft’s investigations into the biggest and most complex cyberattacks that are visible through its global networks.”

He also noted that while “they had some success,” the Russians were met with a robust defense from the Ukrainians that blocked some of the online attacks.

Russia used hacking campaigns to support its ground campaign in Ukraine, pairing malware with missiles in several attacks, including on TV stations and government agencies, according to Microsoft’s research. The report demonstrates Russia’s persistent use of cyberweapons, upending early analysis that suggested they did not play a prominent role in the conflict.

Microsoft could not determine whether Russia’s hackers and its troops had merely been given similar targets to pursue or had actively coordinated their efforts. But Russian cyberattacks often struck within days — and sometimes within hours — of on-theground activity.

From the weeks leading up to the invasion through March, at least six Russian nation-state hacking groups launched more than 237 operations against Ukrainian businesses and government agencies, Microsoft said in its report. The attacks were often intended to destroy computer systems, but some also aimed to gather intelligence or spread misinformation.