Digital attacks in Ukraine: A Timeline

News item | 10-03-2022 | 11:55

There has been frequent news reporting of digital attacks in Ukraine over the past month. This article provides a chronological overview of the reported cyber attacks and the subsequent publications.

Timeline

November 2022
1. 23 November
2. 21 November
3. 18 November
4. 16 November
5. 10 November
6. 4 November
  
  The FBI published security recommendations warning about activist, pro-Russian DDoS attacks. This guidance was issued following various observed DDoS attacks on vital infrastructure in the US. Although these attacks often have a limited impact, the FBI nevertheless recommend taking mitigating measures to reduce the likelihood that such attacks can occur.
  
  The NCSC website contains more in-depth information (in Dutch) on how to ensure that online services are not rendered inaccessible by DDoS attack:
  
  - Factsheet on ensuring the continuity of online services
  
  - Factsheet on technical measures to ensure the continuity of online services
  
  - Anti-DDoS coalition
7. 1 November
October 2022
1. 21 October
  
  CERT-UA observed that there are fraudulent emails in circulation claiming to be from the press office of the General Staff of the Ukraine's armed forces. The email contains a link to an external website, which instructs the user to perform a software update. This user interaction then launches the download of an executable file. When the file is run, the system will become infected with RomCom malware. Partly on account of the use of this particular type of malware, CERT-UA believes it is possible to attribute the activity to the actor behind the Cuba ransomware.
2. 14 October
  
  Microsoft Threat Intelligence Center (MSTIC) flagged a new ransomware campaign which targets transport and logistics organisations in Ukraine and Poland. The type of ransomware being used was referred to as ‘Prestige’ ransomware.
  
  According to MSTIC there are a number of striking aspects to this campaign that distinguish it from other ransomware campaigns being monitored by Microsoft:
  
  - There is a certain degree of overlap with the victims of the HermeticWiper malware.
  
  - MSTIC could find no links between the characteristics of this new ransomware campaign and the 94 ransomware groups being actively monitored by Microsoft.
  
  - Company-wide deployment of ransomware is not common in Ukraine.
3. 11 October
4. 10 October
5. 6 October
6. 2 October
  
  According to Kyiv Post, a Ukrainian news platform, Russian hackers from the National Republican Army (NRA) carried out a ransomware attack on the Russian company Unisoftware. The platform claimed that customers’ personal data was stolen. The Kyiv Post writes that the Russian government is also a client of Unisoftware. The mobilisation of Russian citizens was allegedly the motivation for the digital attack.
September 2022
1. 29 September
  
  The Finnish security and intelligence service SUPO warned of a possible increase in Russian cyber espionage activities in the upcoming winter. This warning was presumably rooted in Russia’s lack of human intelligence (humint), due to the expulsion of many Russian diplomats from Western countries. Western sanctions may be another push factor, motivating Russia to gather intelligence about developments in the realm of high tech, the agency reports. In light of this, SUPO will be keeping an extra close eye on industrial espionage from Russia.
2. 26 September
3. 20 September
4. 19 September
5. 16 September
6. 9 September
  
  In a blog post Google stated that it was seeing an increasing number of financially motivated hackers groups specifically targeting organisations in Ukraine. One of these groups, UAC-0098, which previously specialised in ransomware attacks (as an initial access broker), is now targeting Ukrainian organisations, including government bodies, and European non-profits. This actor has carried out various phishing attacks, posing as the Ukrainian National Cyber Police, Microsoft and Starlink.
7. 2 September
August 2022
1. 16 August
2. 15 August
  
  Microsoft warns of phishing attacks by Russian hacker group SEABORGIUM. According to Microsoft, espionage is the likely motive behind the attacks. SEABORGIUM primarily targets NATO member states, Scandinavia and Eastern Europe, including Ukraine. This group is also using the war in Ukraine as a subject in its phishing emails.
  
  Symantec publishes a blog about the activities of the Russian APT Gamaredon group. According to Symantec, between 15 July and 8 August Gamaredon launched cyberattacks on Ukrainian organisations with 'info stealer' malware. The blog follows a warning from CERT-UA about phishing emails from Gamaredon (see update of 26 July).
3. 13 August
4. 11 August
5. 10 August
6. 9 August
  
  Finnish public broadcaster Yle reports that the website of the Finnish parliament was hit by a DDoS attack. A Russian hacker group calling itself NoName057(16) claimed on its Telegram channel to be behind the attack. The attack started around 14.30 on Thursday 9 August. The website was accessible again at 22.00.
  
  The Telegraph reports that the British authorities are investigating cyberattacks against the British cryptocurrency platform Currency.com. According to The Telegraph, since April hackers have been conducting daily cyberattacks on the company following its withdrawal from Russia because of the war.
7. 8 August
8. 4 August
9. 2 August
  
  On its website the Security Service of Ukraine (SSU), reports that it has dismantled a bot farm. The bot farm was distributing disinformation in order to destabilise the sociopolitical situation in Ukraine. The disinformation related to activities of Ukraine’s most senior military and political leaders. According to the SSU, the bot farm operators used more than a million fake online accounts and social media groups with more than 400,000 users.
July 2022
1. 27 July
2. 26 July
3. 21 July
4. 20 July
  
  Following a rise in cyberattacks connected to the war between Russia and Ukraine, the European Council warns about unacceptable risks of spillover effects, misinterpretation and possible escalation. The most recent DDoS attacks on various EU member states and EU partners (responsibility for which was claimed by pro-Russian hacker groups) are an example of the heightened and tense cyber threat landscape. The EU calls on member states to raise awareness of cyber threats and take preventive measures to protect critical infrastructure.
  
  In conjunction with the Ukrainian security service, the U.S. Cyber Command shared indicators (IOCs) on malware observed in Ukraine. Mandiant also published a blog post on this topic, with additional details.
5. 19 July
  
  Following Microsoft and Mandiant , Palo Alto Networks’ Unit 42 also warns of spear phishing attacks by APT29, a Russian-based threat actor. The phishing emails are sent in the name of an organisation and contain a malicious HTML file or a link to an HTML file in a cloud storage service such as Dropbox or Google Drive. Interacting with this HTML file executes a JavaScript code that installs an ISO file or IMG file on the system. A shortcut is visible in the IMG or ISO file. Other files, such as EXE and DLL files, are rendered invisible. Opening the shortcut ultimately infects the system with Cobalt Strike Beacon malware.
  
  In a blog post Google reports that it has observed cyber activity by various threat actors in relation to the war in Ukraine.
  
  According to Google, the Russian-based threat actors APT28 and Sandworm carried out several phishing attacks, exploiting vulnerability CVE-2022-30190 (Follina). In a security advisory, the National Cyber Security Centre, NCSC, warned about this vulnerability.
  
  The organisation observed activity from the Russian-based threat actor COLDRIVER. According to Google, the actor had allegedly made phishing attempts against various targets, including government staff, politicians, NGOs and journalists.
  
  The Russian-based actor TURLA temporarily offered a fake ‘anti-ddos’ app, posing as the Ukrainian Azov Regiment.
  
  Finally, Google reports that the Belarusian threat actor Ghostwriter actively launched phishing attacks aimed at Polish nationals.
6. 11 July
7. 6 July
8. 5 July
June 2022
1. 30 June
  
  A disinformation campaign was used to spread a rumour that male Ukrainian refugees in Poland would be identified and sent back to Ukraine for military service. Researchers from cybersecurity firm Mandiant have attributed this to the Belarusian-linked threat actor GhostWriter.
  
  According to the Ukrainian state service SSSCIP the intensity of cyberattacks on Ukrainian targets continues unabated. There have been almost 800 cyberattacks since the beginning of the war on 24 February 2022.
2. 24 June
  
  CERT-UA warned of cyberattacks using emails with a malicious attachment targeting telecom companies in Ukraine. The emails contain a password-protected RAR file as an attachment with an Excel file and macro. When the file is opened, a PowerShell command is launched, resulting in the download and execution of an EXE file. The system is then infected with DarkCrystal malware.
3. 22 June
  
  After Lithuania banned the rail transportation of Russian goods (with the exception of foodstuffs and people) to Kaliningrad, various activist groups used platforms such as Telegram to urge cyberattacks on Lithuania’s critical infrastructure.
  
  Cert-UA warned of cyberattacks against Russian research institutions, technical organisations and government bodies by Chinese-linked actors. The attackers use phishing emails with malicious attachments, which, if opened by the user, will eventually result in infection by Bisonal malware.
  
  Microsoft published a report entitled ‘Defending Ukraine: Early Lessons from the Cyber War’, offering five conclusions after the first four months of the conflict between Russia and Ukraine.
4. 20 June
  
  Cert-UA warned of two types of attack. One involves delivery of a malicious xxx.doc file, the other an xxx.rtf file. Both attacks prompt t hedownload of an HTML file and exploitation of the CVE-2022-30190 vulnerability. In the case of the .doc file, Cobalt Strike malware is used, and in the case of the .rtf file, CredoMap malware is deployed. The NCSC recently published an advisory warning about the CVE-2022-30190 vulnerability.
5. 17 June
6. 14 June
7. 10 June
8. 9 June
  
  Following a cyberattack, the web address for the Ministry of Construction, Housing and Utilities of the Russian Federation was redirected to a pro-Ukrainian message: ‘Glory to Ukraine’. The hackers also demanded a ransom in order to prevent the leaking of site users’ personal data. According to RIA, a Russian state news outlet, a ministry representative confirmed that the site was offline but that user data had not been compromised.
9. 5 June
  
  The broadcasting of the World Cup qualifier between Wales and Ukraine was interrupted by a cyberattack in Ukraine directed at OLL.TV. According to the State Service of Special Communications and Information Protection of Ukraine (SSSCIP), hackers had gained access to a content delivery network (CDN) and had then managed to reroute traffic. As a result, various Ukrainian broadcasters displayed Russian propaganda. OLL.TV confirmed the attack on Facebook.
10. 2 June
  
  CERT-UA warned of cyberattacks using malicious email attachments targeting various Ukrainian government organisations. The emails deliver a document containing a malicious URL redirecting unsuspecting victims to the HTML file with a JavaScript code embedded. If executed, CVE-2021-40444 and CVE-2022-30190 vulnerabilities are exploited to launch a PowerShell command, download an EXE file and infect the targeted system with Cobalt Strike Beacon malware. The National Cybersecurity Centre (NCSC) has published an advisory regarding the CVE-2022-30190 vulnerability.
11. 1 June
May 2022
1. 29 May
2. 23 May
  
  Researchers at security company SEKOIA.IO have observed cyber reconnaissance activities by Russian threat actor Turla. This observation is based on previous findings by Google’s Threat Analysis Group (TAG) (see also the entry for 3 May 2022 on this timeline). The activities targeted the Baltic Defence College, the Austrian Economic Chamber and NATO’s e-Learning platform known as JADL. The Austrian Economic Chamber was involved in the imposition of sanctions against Russia.
3. 20 May
4. 16 May
  
  The Italian authorities managed to thwart DDoS attacks by the actor Killnet. These attacks were launched during the Eurovision Song Festival’s live performances and voting rounds. In response to this failed attack, the actor declared its intention to launch cyberattacks on websites of organisations in the United States, the United Kingdom, Germany, Latvia, Romania, Estonia, Poland, Ukraine, Lithuania and Italy.
5. 12 May
  
  Threat actor Killnet directed DDoS attacks against various Italian government and commercial websites.
  
  The same day, CERT-UA warned about emails with the subject ‘Щодо проведення акції помсти у Херсоні!’ (‘Re: retaliatory action in Kherson!’) which contain an HTM file. Once the file is clicked on, GammaLoad.PS1_v2 malware is downloaded and executed on the victim’s computer. CERT-UA has attributed this attack to the Russian threat actor UAC-0010 (Gamaredon).
6. 10 May
  
  The European Union and its international partners strongly condemned the cyberattack on the satellite KA-SAT network. The attack was attributed to the Russian Federation. It took place shortly before the Russian invasion of Ukraine on 24 February 2022 and had a significant impact on various public authorities, businesses and citizens in Ukraine. Spill-over effects were also felt by several members of the European Union.
7. 9 May
8. 7 May
  
  CERT-UA warned of emails with the subject ‘хімічної атаки’ (chemical attack). The emails contain a link to an XLS document with a macro. When the macro is activated, it downloads and executes a piece of malware. The victim’s computer is then infected with the malicious programme JesterStealer, which steals sensitive information and transmits it to the attacker.
9. 3 may
  Google reported in a blog post that it had observed cyber activities by various actors in relation to the war in Ukraine:
  - The Russian-based actor APT28 (aka Fancy Bear) has been targeting users in Ukraine with a new malware variant, which is distributed via email attachments inside password-protected zip files.
  - The organisation has again observed activity by the Russian-based threat actor COLDRIVER (see update of 31 March in this timeline). According to Google, phishing emails have been sent to targets including government officials, politicians, NGOs and journalists.
  - The Chinese-based actor Curious Gorge is continuing its long-running campaigns against multiple government, manufacturing, military and logistics organisations in Russia and Ukraine.
  - Google has observed cyberattacks by the Russian-linked actor Turla, which targets the Baltic states and attempts to compromise defence and cybersecurity organisations in the region.
  - Lastly, Google reported that the Belarusian threat actor GhostWriter was still active and was targeting Ukrainian citizens with its phishing attacks.
10. 1 May
  
  The UK’s Foreign, Commonwealth & Development Office (FCDO) claimed on the basis of government-funded research that Russian disinformation about the war in Ukraine was being spread by means of a troll factory. According to the FCDO, the accounts of various politicians and specific audiences in the UK, India and South Africa are being targeted. According to the UK experts, the research shows how the Kremlin’s large-scale disinformation campaign is designed to manipulate international public opinion of the war in Ukraine.
April 2022
1. 28 april
  
  In collaboration with the Computer Security Incident Response Team of the National Bank of Ukraine (CSIRT-NBU), Ukraine’s Computer Emergency Response Team (Cert-UA) has observed distributed denial-of-service (DDoS) attacks on various Ukrainian government and other organisations. Compromised websites have been used for this purpose. The websites are compromised by inserting malicious JavaScript code (BrownFlood) into the site structure. As a result, website visitors generate large numbers of requests to specific targets, in this case various Ukrainian government and other organisations.
2. 27 april
  
  Microsoft issued a report containing details about Russian cyberattacks observed during the war between Russia and Ukraine. Since the Russian invasion, Microsoft has observed over 200 cyberattacks against Ukrainian organisations and individuals. A number of these attacks appeared to be coordinated with kinetic military operations, according to Microsoft. The report, which includes a detailed timeline of the Russian cyberattacks, was released in order to help boost the resilience of organisations including critical providers and central government.
3. 22 april
4. 21 april
  
  On the CISA website, the United States, Australia, New Zealand, Canada and the United Kingdom posted a joint warning regarding cyber activity by Russian criminal and state actors aimed at critical infrastructure. This activity may be a form of retaliation for the sanctions imposed on Russia and the material support provided to Ukraine by the Western allies and partners.
5. 20 april
6. 19 april
7. 17 april
8. 12 april
  
  Analysing an attack on a Ukrainian energy company, cybersecurity firm ESET and the Ukrainian CERT-UA discover new malware, Industroyer2, which targets industrial control systems (ICS). Other pieces of malware, including various wipers, were also used in the attack. For more details about this malware, you can visit the ESET and CERT-UA websites. According to ESET and CERT-UA, the attack was successfully averted.
9. 8 april
10. 7 april
  
  Microsoft announces that it has been able to disrupt cyberattacks targeting Ukraine. These attacks were launched by Strontium, a Russian state actor with ties to the intelligence service GRU. Strontium was attempting to compromise Ukrainian government institutions and media organisations and was also targeting EU and US government agencies and foreign policy think tanks. In order to gain access to the victims, Strontium used seven malicious internet domains.
11. 4 april
  
  CERT-UA reports the discovery of various malicious files that could be used in a spear-phishing attack. The files had English names and were targeting a government organisation in Latvia. CERT-UA has attributed this attack to UAC-0010 (Armageddon).
  
  The same day, CERT-UA also reports that Ukrainian government organisations have been targeted by Armageddon, once again via a spear-phishing attack. Targets received malicious files that purported to contain personal details of suspected war criminals.
March 2022
1. 31 march
2. 29 march
3. 28 march
4. 24 march
  
  Three Russian spies spent five years targeting energy infrastructure in 135 countries, in an effort to enable the Russian government to gain remote control of power plants, the US Department of Justice alleged in an indictment unsealed on Thursday.
  
  On Twitter hacking group Anonymous calls upon businesses to withdraw from Russia, giving them 48 hours to do so, otherwise they will be targeted by Anonymous. The group has previously published details of Russian companies.
5. 23 march
6. 22 march
7. 21 march
8. 20 march
9. 18 march
10. 15 march
  
  Ukraine’s Computer Emergency Response Team (CERT-UA) reports a phishing campaign in which mass mailings are sent out in the name of the Ukrainian government. The attacks are being launched with the use of Cobalt Strike, GrimPlant and GraphSteel.
  
  ESET researchers in Ukraine have also discovered new wiper malware with the name Caddywiper. Wiper malware presents itself as ransomware, but the affected systems or files cannot be recovered.
11. 11 march
12. 8 march
13. 3 march
14. 2 march
  
  The Ukrainian government urges tech companies to sever their business ties to Russia. Various tech companies stop providing some or all services to Russia. Cybersecurity firm Proofpoint reports a spear-phishing campaign by various state actors targeting European government organisations. The campaign appears to be an attempt by threat actors to obtain information regarding the reception and migration of Ukrainian refugees.
15. 1 march
February 2022
1. 28 february
  
  The Belarussian Cyber-Partisans claimed that they conducted a cyber attack on the railways in Belarus, to obstruct the Russian transfer of troops. A recent overview of cyber groups that have mingled in the war, including state actors such as Sandworm, can be found here.
  
  Taking the latest developments into consideration, the NCSC has published a perspective for action and threat-specific measures.
  
  At this moment, there have been no observations of digital attacks on the Netherlands or its interests.
2. 27 february
3. 26 february
4. 25 february
5. 24 february
  
  After the invasion of Russian troops in Ukraine various non-state actors have mingled in the conflict. Already on the same evening, hackers-collective Anonymous declared the war on Russia. Volunteers connected to this collective then claimed to have taken down various Russian government- and media websites through DDoS-attacks. It was also claimed that sensitive data from the Russian Ministry of Defense was obtained. These claims cannot always be verified, which could cause uncertainty and confusion.
6. 23 february
  
  Various parties reported a new wiper malware that they had observed in Ukrainian systems. Among others, ESET, Symantec and SentielOne published their analyses. The malware has been called HermeticWiper. There are functional similarities with the earlier observed WhisperGate wiper campaign of January 13th and 14th. The goal of the new wiper is to corrupt new documents and to prevent the startup of computer systems. This new malware seems to operate more thoroughly than the wiper malware used in the previous campaign. Thus far, there have been no indications that this new wiper has any functionality that could lead to a worm through which the network-coupled systems could be infected.
7. 21 february
  
  The Ukrainian CERT-UA published a website report on malicious activities that they related to the actor Buhtrap. The malware campaigns would have been intended to acquire a position in the computer network of the victim. On February 23rd, severe DDoS-attacks were carried out on Ukrainian targets. Various government websites have been temporarily limited or fully unavailable. Among others, the websites of various ministries targeted. Simultaneously, multiple phishing campaigns were reported.
8. 15 february
  
  Various cyber-attacks were conducted on different targets in Ukraine. Among others, DDoS-attacks (Distributed Denial of Service) were reported that target the capacity of online services or the supporting servers and network equipment. The Ministry of Defense and two national banks in Ukraine were hit.
  
  Another texting-campaign took place, that reported that ATMs were having a technical malfunction. Official authorities in Ukraine reported that this was disinformation. There would have been no existence of such malfunctions. At this moment, the NSCS has no concrete clues that targeted attacks on organizations in the Netherlands are related to the current situation in Ukraine.
January 2022
1. 26 january
2. 15 january
  
  Microsoft published a blog on the Whisptergate-malware (also called Whisperkill) that had been deployed against various (governmental)organizations in Ukraine. Whispergate is a wiperware that pretends to be ransomware, but lacks any possibility to recover affected systems or documents, which means that documents are effectively erased or that the operating system becomes out of commission. In contrast to the NotPetya-wiper, that had a worldwide impact in 2017, the Whispergate-malware does not consist of the possibility to spread itself without a human intermediary. As a result, the observed Whispergate-malware forms a significantly lower risk for the Netherlands.
3. 14 january
  
  The Ukrainian security service SSU published a statement about an attack on the websites of various governmental actors. The messages that were published on the websites reported in threatening language in Polish, Ukrainian and Russian that personal data of Ukrainian citizens had been stolen and that citizens should “prepare for the worst”. These kind of attacks where a website is being daubed are also called ‘defacements’. In a subsequent statement by the SSU, it became evident that there had most likely been a supply chain attack on the supplier who maintained the websites, possibly in combination with a vulnerability in OctoberrCMS (CVE-2021-32648) and Log4j. The supplier had elevated permissions in the environment so that websites could be modified.
  
  After the large attacks the national CERT of Ukraine issued multiple warnings for other campaigns that target governmental agencies. Moreover, several cybersecurity companies published a research following the cyber-attacks in Ukraine. For instance, Palo Alto Networks Unit42, Symantec and Microsoft conducted a research on the activities of Gamaredon, also known as ACTINIUM. Thus far, the activities of Gamaredon have not been related to the cyber-attacks of January the 14th. Gamaredon is a well-known actor that thus far has focused on Ukrainian targets.

Perspective for action

The WhisperGate-attack or the other executed attacks in Ukraine have not led to so-called ‘spill-over effects’ in the Netherlands. However, it is recommended to act in accordance with the NCSC’s basis measures on cybersecurity, and to take note of the AIVD and MIVD publication, “Cyberattacks by statal actors, seven moments to stop an attack’’ [available in Dutch only]. In particular, the basic measure of ‘segmented networking’ can help to prevent that an attack on a coupled network could affect your organization.

The NCSC keeps monitoring the developments closely and shares relevant information wherever possible.

Digital attacks in Ukraine: A Timeline

Timeline

November 2022

October 2022

September 2022

August 2022

July 2022

June 2022

May 2022

April 2022

March 2022

February 2022

January 2022

Perspective for action

Share this page