Destructive Malware Targeting Ukranian Organizations

Cyberattacks against Ukrainian government websites and affiliated organisations added to the confusion of Russia's military assault on Thursday, including data-wiping malware activated a day earlier that cybersecurity researchers said infected hundreds of computers including in neighbouring Latvia and Lithuania.

Highlights

• Measures to blunt the DDoS attacks were having some success.
• Russian websites also came under a denial-of-service attack.
• Ukraine's cybersecurity agency said cellular networks were saturated.
• New data-wiping malware used in destructive attacks on Ukraine

Outages Continuing

A distributed-denial-of-service attack that began last week and temporarily knocked government websites offline on Wednesday continued and there were sporadic internet outages across the country, said Doug Madory, director of internet analysis for the U.S. Network management firm Kentik Inc.

Distributed-denial-of-service attacks are among the least impactful because they don't entail network intrusion. Such attacks barrage websites with junk traffic so they become unreachable.

Measures to blunt the DDoS attacks were having some success, however, as major government websites including those of the defence and interior ministries and the banking sites of Sberbank and Alfabank were reachable on Thursday despite the onslaught.

U.S. And allied governments quickly blamed the denial-of-service attacks on Russia's GRU military intelligence agency after they began last week. Such attacks render websites unreachable by flooding them with junk data.

Major Russian websites also came under a denial-of-service attack on Thursday, Madory said, possibly in retaliation for the similar DDoS attacks on Ukrainian websites.

The sites of Russia's military (mil.Ru) and Kremlin (kremlin.Ru), hosted by the Russia State Internet Network, were unreachable or slow to load as a result. Madory said an entire block of internet domains that host kremlin.Ru sites was under attack.

Internet Shutdown

According to NetBlocks, "Significant Internet disruption registered in Ukraine controlled city of Kharkiv shortly after huge explosions heard and users report loss of fixed-line service on provider Triolan while cellphones continue to work.

According to Ukraine Agency

Ukraine's cybersecurity agency said cellular networks were saturated with voice calls, suggesting that people unable to complete them use text-messaging. The London-based Netblocks internet monitor said the eastern city of Kharkiv, near which Russians were reported attacking, appeared to be taking "the brunt of network and telecoms disruptions."

Some cybersecurity experts said prior to the assault that it might be in the Kremlin's intelligence - and information war - interests not to try to take down Ukraine's internet during a military attack.Ukraine's cybersecurity service also published a list on its Telegram channel of known "active disinformation" channels to avoid.

Years of Aggression

Cyberattacks have been a key tool of Russian aggression in Ukraine since before 2014, when the Kremlin annexed Crimea and hackers tried to thwart elections. They were also used against Estonia in 2007 and Georgia in 2008. Their intent can be to sow panic, confuse and distract.

Back Blogs