In 2024, cyber-specialists working as part of theMain Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and theSecurity Service of Ukraine (SBU) initiated severalcyberattacks on Russian technology and infrastructure, including attacks onRussia's banking sector, Russian internet providers, regional and municipal administration web resources, Russian airports, several Russian state institutions, and private companies. The operations were conducted as means to impedeRussian military operations and uncover classified documents that could be taken into account by the Armed Forces of Ukraine during theRussian invasion of Ukraine, as well as to destabilize Russia's institutions. Cyberattacks began to intensify in scope in June and July 2024.[1][2]
Russian–Ukrainiancyberwarfare is a component of the confrontation between Russia and Ukraine since theRevolution of Dignity in 2013–2014. Russian cyberweaponUroburos had been around since 2005.[3] However, the first attacks on information systems of private enterprises and state institutions of Ukraine were recorded during mass protests in 2013. In 2013, Operation Armageddon, a Russian campaign of systematic cyber espionage on the information systems of government agencies, law enforcement, and defense agencies, began, thought to help Russia on the battlefield.[4]Between 2013 and 2014, some information systems of Ukrainian government agencies were affected by a computer virus known asSnake / Uroborus / Turla.[4] In February–March 2014, as Russian troopsentered Crimea communication centers were raided and Ukraine's fibre optic cables were tampered with, cutting connection between the peninsula and mainland Ukraine. Additionally Ukrainian Government websites, news and social media were shut down or targeted in DDoS attacks, while cell phones of many Ukrainian parliamentarians were hacked or jammed.[4][5] Ukrainian experts also stated the beginning of a cyberwar with Russia.[6]
Cybersecurity companies began to register an increase in the number of cyberattacks on information systems in Ukraine. The victims of Russian cyberattacks were government agencies of Ukraine, the EU, the United States, defense agencies, international and regional defense and political organizations, think tanks, the media, and dissidents.[4] As of 2015, researchers had identified two groups of Russian hackers who have been active in the Russian-Ukrainian cyber war: the so-calledAPT29 (also known as Cozy Bear, Cozy Duke) andAPT28 (also known as Sofacy Group, Tsar Team, Pawn Storm, Fancy Bear).[4]In mid-January, the Ukrainian HUR reported that volunteer BO Team hackers employed by the ministry deleted 280 servers and 2 petabytes of data from Planet, a state spacehydrometeorologyresearch center in theFar East that aided the Russian military and fifty other state agencies with gathering and analyzingsatellite imaging and data. According to HUR, the cyberattack cost Russia approximately US$10 million in damages, which included a destroyedsupercomputer and its software, together costing US$350,000 with Western sanctions greatly complicating its replacement. The attack also impacted warehouses and the center building of the research center, including itshumidification,air conditioning, servers, and emergency power supply. Further attacks on a Russian Arctic station onBolshevik Island "completely cut off" its connection with Russian networks.[7]
On February 4, HUR's officialTelegram channel reported that they accessed an electronic document management system called "bureaucrats", and exposed detailed information about high-ranking Russian military personnel and specialists. The ministry also said that they found a wide array ofclassified documents, specifically mentioning documents belonging to Russian Deputy Defense MinisterTimur Ivanov. The hack resulted in the HUR recovering sensitive information that included Russian army orders, reports, and instructions that were circulating among over 2,000 military units within Russia's defense ministry that could be analyzed by theArmed Forces of Ukraine. The hackers sarcastically thankedRussian Defense MinisterSergei Shoigu's inadvertent role in facilitating the cyberattack's success.[8]
HUR hackers were also able to target Russian military software used to modify commercialDJI drones for military applications, shutting down servers responsible for Russia's "friend or foe" identification system, preventing troops from accessing the server for drone operations. The cyberattack also prevented troops from configuring control panels, transmitting video feeds to command posts, and operating drones usingcomputer interfaces, forcibly grounding several drone fleets and halting operations.[9]
In April, the HUR cooperated with the BO Team hacker group to target Interregional TransitTelecom (MTT), a subsidiary ofMTS, one of Russia's largest telecom companies, after gaining comprehensive access to MTT's network equipment. The HUR reported that the attack destroyed critical software andconfiguration files, leading to severe internet disruptions throughout Russia that affected major cities such asMoscow andSt. Petersburg, requiring workers to physically access and re-connect equipment to fix the outages.[10]
Attacks on communication company Moskollector by the SBU shut down 87,000 alarm sensors used forsewage monitoring and control throughout theMoscow metropolitan area, destroying "70 servers and at least 90 terabytes of company data, emails, backup copies and contracts" in the process.[11]
In early June, HUR cyber operatives conducted a widespread attack on various Russian government websites, including those of key ministries such as the ministries ofJustice,Defense, Information Technology and Communications,Finance,Internal Affairs,Industry and Energy, andEmergency Situations.[12] The disruptions extended to civilian services, with local reports indicating severalwedding cancellations due to system outages. Attacks on the United Aircraft Company (UAC), Russia's primary advanced aircraft manufacturer, impacted its operations and caused its website to be rendered inaccessible for an extended period. HUR reported that its primary method of cyberattack was by usingdistributed denial-of-service (DDoS) attacks.[13][14]
On June 12, coinciding withRussia Day, Ukrainian hackers targeted the online systems of multiple Russian airports, causing flight disruptions.[12] Targeted airports includedYuzhno-Sakhalinsk'sairport,Moscow Domodedovo Airport, andSaratov's Gagarin Airport, delaying flights mainly destined forSochi,Bodrum, andMoscow. The attack also forced airplanes to divert toSamara andUlyanovsk. Prior to the attack, cyber-specialists accessed the official website server of theStavropol Region's State Duma, adding a banner containing the phrase "Hold on, we will liberate you!" and depictedRed Square bearingUkrainian flags, shortly before targeting the airports.[15]
Shortly after on June 14, the HUR cooperated with the BO Team hacker group to attack Russian municipal web resources, primarily targeting the Ulyanovsk regional administration's digital infrastructure. The attack resulted in considerable damage to the administration's IT systems, where twohypervisors and communication devices were reportedly disabled, while tenvirtual machines and onepersonal computer were destroyed. Additionally, the operation led to the erasure of approximately 20 terabytes of data. Prior to the main assault, the hackers engaged in aphishing campaign that targeted other local government bodies, courts, and members of the public.[16]
As part of the operation, the attackers published a fabricated order on the Ulyanovsk administration's website. This false directive, attributed to Mayor A.E. Boldakin, called for public demonstrations. The infiltration also provided the BO Team access to sensitive documents, including reports on military recruitment practices. These documents reportedly referred to Ulyanovsk residents reported for "bypassing of candidates for military service" as "targeted individuals".[16]
On June 26, Russian-occupiedCrimea's largest internet providers were targeted by intense cyberattacks.[12]
In July 2024, Ukrainian intelligence services reportedly launched a major cyberattack against several Russian technology-based sectors. The attacks started on July 15, when HUR cyber-specialists worked with a community of hackers to target roughly one hundred Russian web resources to erase their internal data, picked based on their involvement with Russian agencies involved with Russia's invasion of Ukraine.[2] Affected webpages were shut down and replaced with a picture of a bloody, decapitated pig head colored withRussia's flag next to an axe bearing the flag of Ukraine, with the phrase "404 Russia not found" listed.[17]
A larger operation was initiated on July 23 by the Main Intelligence Directorate of Ukraine's Ministry of Defense, which targeted financial institutions it stated were involved in funding military activities against Ukraine. By July 27, the attack's impact became severe and widespread. Customers of several major Russian banks were unable to withdraw cash from ATMs, with credit and debit cards being blocked upon use. The cyberattack affected various aspects of Russia's virtual banking infrastructure, which included freezing ofpayment systems andmobile banking applications, banking portal outages, and breaches into the databases of several major banks which included Dom.RF,Alfa-Bank,Raiffeisen Bank,VTB Bank,Rosbank,Gazprombank, RSHB Bank,Sberbank, iBank, andTinkoff Bank. The attacks also targetedpublic transportation systems, popular Russian social networks and internet platforms, and caused service interruptions for multiple large Russian telecom and internet providers includingMegaFon,Tele2,Beeline, andRostelecom.[1][2][18]
A source from the Ukrainian intelligence stated that the attack was "gaining momentum" and implied escalations in attacks.[1][2]
Russia acknowledged the cyberattacks as being initiated by "politically motivated hackers".[2]
| Diplomatic posts | |
|---|---|
| Diplomacy |
|
| Russo-Ukrainian War |
|
| Incidents | |
| Related |
|
