In a significant escalation of cyber warfare, a joint report by Google’s Threat Analysis Group (TAG) and Mandiant reveals that Russian cyber attacks against Ukraine surged by 250% in 2022 compared to two years prior. This dramatic increase coincided with Russia’s military invasion of Ukraine in February 2022, focusing on Ukrainian government and military networks, as well as critical infrastructure sectors such as utilities, public services, and media outlets.
Mandiant noted an unprecedented number of destructive cyber attacks during the early months of 2022, stating they observed more malicious activity in the first four months than in the previous eight years combined, with incidences peaking around the start of the invasion. The deployment of various wiper malware strains like WhisperGate, HermeticWiper, and Industroyer2 suggests a strategy prioritizing disruption over maintaining long-term access to targeted networks.
Furthermore, phishing attacks targeting NATO allies saw a staggering 300% rise during the same period, primarily driven by a group linked to the Belarusian government, known as PUSHCHA (also referred to as Ghostwriter or UNC1151). Shane Huntley from TAG emphasized the aggressive, multi-pronged tactics utilized by Russian state-sponsored attackers to gain a strategic advantage in the cyber domain, often resulting in varied outcomes.
Key adversary actors in these operations include well-known groups like FROZENBARENTS (Sandworm), FROZENLAKE (APT28), and COLDRIVER (Callisto Group). These actors are leveraging sophisticated methodologies, mirroring various MITRE ATT&CK tactics such as initial access through phishing or exploiting software vulnerabilities, and executing operational plans that prioritize damaging attacks and information disruption.
In addition to physical incursions, the Kremlin has been engaging in information warfare aimed at undermining support for Ukraine, manipulating both domestic and international narratives. This includes stealing sensitive information for public release and conducting campaigns designed to destabilize opponents while fostering support for Russia.
The ramifications of this conflict extend beyond Russian actors, as Chinese government-backed groups like CURIOUS GORGE and BASIN have redirected their focus toward Ukrainian and Western European targets. This shift highlights a broader trend, indicating a notable change in the cybercriminal landscape across Eastern Europe, where divisions between financially driven hackers and state-sponsored attackers are increasingly blurred.
Attacks from groups such as UAC-0098 demonstrate how even previously unassociated threat actors are adapting their tactics in alignment with geopolitical objectives. Members of UAC-0098 have reportedly employed techniques historically associated with ransomware to target Ukrainian systems, underscoring the fluidity of allegiances and operational techniques within the cyber realm.
The ongoing conflict has made clear that cyber warfare will remain a crucial element of contemporary military strategy, supplementing traditional combat methods. Concurrently, Ukraine’s Computer Emergency Response Team (CERT-UA) reported a wave of phishing attempts designed to masquerade as critical security updates, which could lead to malicious software being deployed on targeted systems. This tactic, tracked under the UAC-0096 moniker, echoes methodologies observed prior to the war and underscores the continuous evolution of cyber threats.
As the war persists, assessments reveal that Russia is grappling with strategic setbacks, despite its attempts to exert control over Ukraine through both conventional and cyber means. The resilience of Ukraine, coupled with evolving international dynamics, suggests that the battleground is shifting, not only in physical terms but also within the cyber domain.
Moving forward, the necessity for businesses to adopt robust security measures has never been clearer, as the interplay between geopolitical tensions and cybersecurity risks intensifies. The rapid evolution of tactics employed by various threat actors propels the need for an informed, proactive approach to mitigate potential cyber threats.
