Ukraine hacks add to Russian conlfict worry
Ukrainian officials say a cyberattack has left a number of government websites unavailable.
Hackers on Friday temporarily shut down dozens of Ukrainian government websites, causing no major damage but adding to simmering tensions while Russia amasses troops on the Ukrainian border. Separately, in a rare gesture to the U.S. at a time of chilly relations, Russia said it had arrested members of a major ransomware gang that targeted U.S. entities.
The events, though seemingly unrelated, came during a frenetic period of activity as the U.S. publicly accused Moscow of preparing a further invasion of Ukraine and of creating a pretext to do so. They underscored how cybersecurity remains a pivotal concern — that the escalating animosity risks not only actual violence but also damaging digital attacks that could affect Ukraine or even the U.S.
The White House said Friday that President Joe Biden had been briefed on the disruptions, which targeted about 70 websites of national and regional government bodies, but it did not indicate who might be responsible.
But even without any attribution of responsibility, suspicions were cast on Russia, with its history of peppering Ukraine with damaging cyberattacks. Ukraine’s Security Service, the SBU, said preliminary results of an investigation indicated involvement of “hacker groups linked to Russia’s intelligence services.” It said most of the websites had resumed operations, and that content was not altered and personal data not leaked. The SBU said the culprits “hacked the infrastructure of a commercial company that had access, with administrator privileges, to websites affected by the attack.”
The White House said it was still assessing the impact of the defacements but described it as “limited” so far. A senior administration official, meanwhile, said the White House welcomed news of the arrests in Russia of alleged ransomware gang members, an operation Moscow said was done at the request of U.S. authorities.
The official, who briefed reporters on condition of anonymity, said one of those arrested was linked to the hack of Colonial Pipeline that resulted in days of gas shortages in parts of the U.S. last year. The arrests are thought by the White House to be unrelated to the Russia-Ukraine tension, according to the official.
Russia’s past cyber operations against Ukraine include a hack of its voting system before 2014 national elections and of its power grid in 2015 and 2016. In 2017, Russia unleashed one of the most damaging cyberattacks on record with the NotPetya virus, which targeted Ukrainian businesses and caused more than $10 billion in damage globally. Moscow has previously denied involvement in cyberattacks against Ukraine.
Ukrainian cybersecurity professionals, aided by the U.S., have been fortifying the defenses of critical infrastructure ever since. NATO Secretary-General Jens Stoltenberg said Friday the alliance will continue to provide “strong political and practical support” to Ukraine in light of the cyberattacks.
Experts say Russian President Vladimir Putin could use cyberattacks to destabilize Ukraine and other exSoviet countries that wish to join NATO without having to commit troops. Tensions between Ukraine and Russia are high, with Moscow amassing an estimated 100,000 troops near its extensive border with Ukraine.
“If you’re trying to use it as a stage and a deterrent to stop people from moving forward with NATO consideration or other things, cyber is perfect,” Tim Conway, a cybersecurity instructor at the SANS Institute, told the AP last week.
The main question for the website defacements is whether they’re the work of Russian freelancers or part of a larger state-backed operation, said Oleh Derevianko, a leading private sector expert and founder of the ISSP cybersecurity firm.
A message posted by the hackers in Russian, Ukrainian and Polish claimed Ukrainians’ personal data had been placed online and destroyed. It told Ukrainians to “be afraid and expect the worst.” In response, Poland’s government noted Russia has a long history of disinformation campaigns and that the Polish in the message was error-ridden and clearly not from a native speaker.
Researchers from the global risk think tank Eurasia Group said the Ukraine defacements don’t “necessarily point to an imminent escalation of hostilities by Russia” — they rank low on its ladder of cyber options. They said Friday’s attack amounts “to trolling, sending a message that Ukraine could see worse to come.”