In addition to military operations in the air, sea, and land, there’s another dimension to the war. Cyber operations often remain largely unnoticed, even though they sometimes directly impact subsequent missile attacks, troop movements, or weapon production. Here, we explore what’s happening in the Russia-Ukraine cyberspace, the consequences of major attacks, and the targets selected by hackers affiliated with state governments.Cyberwarfare is a confrontation in the digital space aimed at gaining an advantage over the opponent or harming its economy, defense, and national security. The goals of cyberwarfare can vary, with popular targets including destabilizing enemy infrastructure, gathering intelligence, and destroying or damaging critical computer systems and networks.The difference between information attacks and cyberattacks is that the former focuses on spreading disinformation, propaganda, or influencing public opinion, while cyberattacks encompass a broader range of operations, including system hacks, espionage, malware infections, and data theft.
Experts Identify Several Directions in Cyberwarfare:EspionageThis involves infiltrating an opponent's closed systems to steal or monitor confidential information. Botnets or phishing attacks are used to compromise sensitive computer systems. Denial of Service Attacks (DoS, DDoS)DoS attacks prevent regular users from accessing a site by flooding it with fake access requests, forcing it to process them. Such cyberattacks are used to disrupt critical operations and systems and to block access to essential websites. These attacks on infrastructure can also disrupt communications and make services like telecommunications or power supply unavailable. Propaganda AttacksThese are attempts to gain control over information channels in another country to communicate a specific message. Such attacks may also respond to prior actions by the opponent. Operations Against Financial InstitutionsAttackers target computer networks of financial institutions, such as stock markets, payment systems, and banks, to steal money or block access to funds.The cyber confrontation didn’t start on February 24,
2022; it merely intensified. For instance, as early as 2013, Russians regularly attempted to spy on government portals and state enterprise sites. The Russian spy program Turla Snake was detected in government networks as early as 2005 (the program was active in systems in 50 countries, including the U.S.).During this period, the countries exchanged occasional strikes: for instance, Russia blocked Treasury payments in Ukraine for a day, while Ukraine hacked a site and retrieved data on First Channel employees.In 2015, the first Russian cyberattacks on Ukraine’s energy infrastructure began. In response, Ukraine began organizing official teams to counter cyber threats. The CERT-UA, initially operating on a volunteer basis, was formalized. Later, in 2016, Ukraine developed its Cybersecurity Strategy, and the National Cybersecurity Coordination Center was launched.According to the State Special Communications Service (the state agency responsible for cybersecurity), 10% of attacks originate from Russian special services' cyber units, while the rest come from affiliated criminal hacker groups.
The most active include Sofacy Group (GRU of the Russian General Staff), APT29 (FSB), Turla (FSB), Sandworm (GRU), Armageddon, and Solntsepek.Just before the physical invasion, Russian cyber groups intensified. The night of January 13-14, 2022, can be considered the first act of war in cyberspace. Hackers attacked dozens of government websites and banks, including the Ministry of Foreign Affairs, Ministry of Health, and the Diia portal.Following the January 2022 cyberattack, datasets containing Ukrainians’ personal information appeared online at least twice. The Ministry of Digital Transformation claims this data is unrelated to Diia. The information on 13.5 million Ukrainians supposedly comes from compilations of various private companies’ databases, leaked much earlier.Overall, events in cyberspace are often aligned with certain political or military developments. For example, on February 23-24, 2022, a cyberattack disrupted satellite internet access. Hackers disabled modems connected to the KA-SAT satellite operated by Viasat, which some Ukrainian military units used.
There were attacks on government and banking websites, as well as other critical infrastructure, caused by the HermeticWiper virus. These attacks were part of the preparation for a military invasion.At the same time, Ukraine not only defends its cyber systems but also strikes back. In cyberspace, both special services (mainly the Main Intelligence Directorate of the Ministry of Defense) and numbers of volunteer organizations operate on Ukraine’s behalf. Notably, the IT ARMY of Ukraine, Ukrainian Cyber Alliance, and various hacktivist groups.The IT ARMY of Ukraine comprises up to ten thousand hacktivists engaged in operations. These are typically a few operations per week, though this number may increase depending on circumstances and the need to respond to new challenges. The Ukrainian Cyber Alliance emerged in the spring of 2016 from a merger of two hacktivist groups, FalconsFlame and Trinity; later, RUH8 and individual activists from the CyberKhunta group joined. This group has claimed credit for dozens of successful cyberattacks, including hacking Russia’s First Channel,
the Russian Ministry of Defense, and the SurkovLeaks operation, which leaked the correspondence of Vladislav Surkov, an aide to the Russian president, in 2016.Several Successful Attacks by the Ukrainian Cyber ArmyJune 8, 2023. Attack on the infrastructure of Moscow-based internet provider Infotel, which supported the central bank and other Russian banks. August 7, 2023. Attack on the Moscow real estate database Mosgorsbt, which led to data deletion and subsequent transfer of information to Ukraine’s Defense Forces. October 30, 2023. Breach of the Mir payment system, with Ukrainian hackers offering Russians shells as currency instead of rubles. December 1, 2023. Hackers Hdr0 manipulated water meter readings at Sevastopolvodokanal for over two months and “forgave” all debts of users with Ukrainian emails. September 2024: GUR hackers launched massive attacks on over 800 servers, targeting military, financial, and administrative institutions directly involved in the war against Ukraine.
