Russian cyberattacks on Ukraine to have global long-term effect

Author Moonshot.news

Published on: 20/02/2023

The Russian invasion of Ukraine has triggered a notable shift in the Eastern European cybercriminal ecosystem that will likely have long term implications for the scale of cybercrime worldwide and coordination between criminal groups, Shane Huntley, senior director of Google’s Threat Analysis Group (TAG) writes in a report. “It is clear cyber will continue to play an integral role in future armed conflict, supplementing traditional forms of warfare.”.

He writes that there is  a trend towards specialization in the ransomware ecosystem that blends tactics across actors, making it more difficult to see which group is behind an attack. 

“The war in Ukraine has also been defined by what we expected but didn’t see. For example, we didn’t observe a surge of attacks against critical infrastructure outside of Ukraine.”

“Some cybercriminal groups have split over political allegiances and geopolitics, while others have lost prominent operators, which will impact the way we think about these groups and our traditional understanding of their capabilities.” 

TAG also sees tactics closely associated with financially motivated threat actors being deployed in campaigns with targets typically associated with government-backed attackers. 

He writes that Russian government-backed attackers have engaged in an aggressive, multi-pronged effort to gain a decisive wartime advantage in cyberspace, often with mixed results.

“This includes a significant shift in various groups’ focus towards Ukraine, a dramatic increase in the use of destructive attacks on Ukrainian government, military and civilian infrastructure, a spike in spear-phishing activity targeting NATO countries, and an uptick in cyber operations designed to further multiple Russian objectives.” 

“For example, we’ve observed threat actors hack-and-leak sensitive information to further a specific narrative.”

“Russian government-backed attackers ramped up cyber operations beginning in 2021 during the run up to the invasion. In 2022, Russia increased targeting of users in Ukraine by 250% compared to 2020. Targeting of users in NATO countries increased over 300% in the same period.”

“In 2022, Russian government-backed attackers targeted users in Ukraine more than any other country. While we see these attackers focus heavily on Ukrainian government and military entities, the campaigns we disrupted also show a strong focus on critical infrastructure, utilities and public services, and the media and information space.”

Russian platforms and accounts have had three goals: Undermine the Ukrainian government; Fracture international support for Ukraine and; Maintain domestic support in Russia for the war.

Looking ahead, the report says:

• We assess with high confidence that Russian government-backed attackers will continue to conduct cyber attacks against Ukraine and NATO partners to further Russian strategic objectives.
• We assess with high confidence that Moscow will increase disruptive and destructive attacks in response to developments on the battlefield that fundamentally shift the balance – real or perceived – towards Ukraine (e.g., troop losses, new foreign commitments to provide political or military support, etc.). These attacks will primarily target Ukraine, but increasingly expand to include NATO partners.
• We assess with moderate confidence that Russia will continue to increase the pace and scope of IO to achieve the objectives described above, particularly as we approach key moments like international funding, military aid, domestic referendums, and more. What’s less clear is whether these activities will achieve the desired impact, or simply harden opposition against Russian aggression over time.