The hybrid war in Ukraine – Microsoft On the Issues – Microsoft

Today, we released a report detailing the relentless and destructive Russian cyberattacks weve observed in a hybrid war against Ukraine, and what weve done to help protect Ukrainian people and organizations. We believe its important to share this information so that policymakers and the public around the world know whats occurring, and so others in the security community can continue to identify and defend against this activity. All of this work is ultimately focused on protecting civilians from attacks that can directly impact their lives and their access to critical services.

Starting just before the invasion, we have seen at least six separate Russia-aligned nation-state actors launch more than 237 operations against Ukraine including destructive attacks that are ongoing and threaten civilian welfare. The destructive attacks have also been accompanied by broad espionage and intelligence activities. The attacks have not only degraded the systems of institutions in Ukraine but have also sought to disrupt peoples access to reliable information and critical life services on which civilians depend, and have attempted to shake confidence in the countrys leadership. We have also observed limited espionage attack activity involving NATO member states, and some disinformation activity.

As todays report details, Russias use of cyberattacks appears to be strongly correlated and sometimes directly timed with its kinetic military operations targeting services and institutions crucial for civilians. For example, a Russian actor launched cyberattacks against a major broadcasting company on March 1st, the same day the Russian military announced its intention to destroy Ukrainian disinformation targets and directed a missile strike against a TV tower in Kyiv. On March 13th, during the third week of the invasion, a separate Russian actor stole data from a nuclear safety organization weeks after Russian military units began capturing nuclear power plants sparking concerns about radiation exposure and catastrophic accidents. While Russian forces besieged the city of Mariupol, Ukrainians began receiving an email from a Russian actor masquerading as a Mariupol resident, falsely accusing Ukraines government of abandoning Ukrainian citizens.

The destructive attacks weve observed numbering close to 40, targeting hundreds of systems have been especially concerning: 32% of destructive attacks directly targeted Ukrainian government organizations at the national, regional and city levels. More than 40% of destructive attacks were aimed at organizations in critical infrastructure sectors that could have negative second-order effects on the Ukrainian government, military, economy and civilians. Actors engaging in these attacks are using a variety of techniques to gain initial access to their targets including phishing, use of unpatched vulnerabilities and compromising upstream IT service providers. These actors often modify their malware with each deployment to evade detection. Notably, our report attributes wiper malware attacks we previously disclosed to a Russian nation-state actor we call Iridium.

Todays report also includes a detailed timeline of the Russian cyber-operations weve observed. Russia-aligned actors began pre-positioning for conflict as early as March 2021, escalating actions against organizations inside or allied with Ukraine to gain a larger foothold into Ukrainian systems. When Russian troops first started to move toward the border with Ukraine, we saw efforts to gain initial access to targets that could provide intelligence on Ukraines military and foreign partnerships. By mid-2021, Russian actors were targeting supply chain vendors in Ukraine and abroad to secure further access not only to systems in Ukraine but also NATO member states. In early 2022, when diplomatic efforts failed to de-escalate mounting tensions around Russias military build-up along Ukraines borders, Russian actors launched destructive wiper malware attacks against Ukrainian organizations with increasing intensity. Since the Russian invasion of Ukraine began, Russian cyberattacks have been deployed to support the militarys strategic and tactical objectives. Its likely the attacks weve observed are only a fraction of activity targeting Ukraine.

Microsoft security teams have worked closely with Ukrainian government officials and cybersecurity staff at government organizations and private enterprises to identify and remediate threat activity against Ukrainian networks. In January of this year, when the Microsoft Threat Intelligence Center (MSTIC) discovered wiper malware in more than a dozen networks in Ukraine, we alerted the Ukrainian government and published our findings. Following that incident, we established a secure line of communication with key cyber officials in Ukraine to be sure that we could act rapidly with trusted partners to help Ukrainian government agencies, enterprisesand organizations defend against attacks. This has included 24/7 sharing of threat intelligence and deployment of technical countermeasures to defeat the observed malware.

Given Russian threat actors have been mirroring and augmenting military actions, we believe cyberattacks will continue to escalate as the conflict rages. Russian nation-state threat actors may be tasked to expand their destructive actions outside of Ukraine to retaliate against those countries that decide to provide more military assistance to Ukraine and take more punitive measures against the Russian government in response to the continued aggression. Weve observed Russian-aligned actors active in Ukraine show interest in or conduct operations against organizations in the Baltics and Turkey all NATO member states actively providing political, humanitarianor military support to Ukraine. The alerts published by CISA and other U.S. government agencies, and cyber-officials in other countries, should be taken seriously and the recommended defensive and resilience measures should be taken especially by government agencies and critical infrastructure enterprises.Our report includes specific recommendations for organizations that may be targeted by Russian actors as well as technical information for the cybersecurity community. We will continue to provide updates as we observe activity and believe we can safely disclose new developments.

Tags: cyberattacks, cybersecurity, Microsoft Threat Intelligence Center, Russia, Ukraine

Read more here:

The hybrid war in Ukraine - Microsoft On the Issues - Microsoft