War in Ukraine: Russian cyberattacks grow, but with less offensive power

April 5, 2022

Robert

This is the War in Ukraine newsletter. Do you want to receive it in your email? Sign up below.

As a “hybrid war”, the conflict in Ukraine has been fought on several fronts and with an arsenal that includes conventional weapons, narrative dispute, disinformation campaigns and cyber attacks. It is the latter that we will talk about in today’s newsletter.

The beginning of the conflict between two countries with great experience in cyberattacks raised the fear of the outbreak of an unprecedented battle in cyberspace:

Russia is considered one of the countries with the greatest cyber offensive power, alongside the US and China;
Ukraine is a hotbed of hackers and is supported by famous cyber activist groups such as Anonymous.

In fact, with the intensification of tension between the two countries, the virtual attacks increased. In the first month of the war alone, Ukraine’s State Service for Special Communication and Information Protection claims to have detected three times more hacking attacks to Ukrainian sites than in the same period last year. Among the targets are government institutions, authorities, telecom operators and the media.

But the onslaughts known so far are considered by experts to be less sophisticated and dangerous than one might expect from the history of nations — particularly Russia. The news is not a reason for relief, but an indication that perhaps the worst is yet to come.

We invite the special reporter from sheet Raphael Hernandes (@hernandesraph), specializing in technology and cybersecurity, to explain what the cyberwar between Russia and Ukraine has been like so far.

A month after the conflict, how did the cyber threat take shape? So far, the attacks seen by Russia have mostly been either less technically capable or less impactful.

One hypothesis for this is that Russia has limited some of this power to prevent an attack from leaving Ukrainian environments – as happened in 2017, when malware [conhecido como NotPetya] directed at Ukraine spiraled out of control, spread to companies around the world and caused damage estimated in the billions by the White House.

It could also be that the Russians are too busy trying to defend their cyberspace from attacks by volunteers in support of Ukraine. Or, they may not have seen as much efficiency in this type of attack for this conflict.

What would be the biggest risk of these attacks? For Ukrainians, it is the risk of attacks capable of disrupting energy supplies, for example, as Russia has done in the past. These are the so-called attacks against critical infrastructure, which have become a trend in recent years and are part of the Russian arsenal.

As for the rest of the world, there is a risk of attacks spiraling out of control — as in the 2017 example of NotPetya. But experts point out that cyberattacks would not be a winning factor in a war, any more than air combat alone is. They are a part of the arsenal used in a broader context.

Do not get lost

We cite three types of cyberattacks that were seen throughout the conflict:

Block: On February 24, the day of the invasion of Ukraine, an attack attributed to Russian hackers hit satellites of the telecommunications company Viasat and left part of the Ukrainians without access to the internet. The impact was also felt in other countries, such as Germany.
Denial: Denial of service (or “DDoS”) attacks attempt to overwhelm systems by having too many simultaneous accesses to slow them down or even down—which is a major concern for essential services. Ukraine has reported recurring attacks of this type
“Wipers”: Malware that enters a computer or system and spreads across a corporate or government network to erase information. Ukraine has recorded targeted attacks with these viruses — data indicates that the programs were ready to run even before the conflict began.