Disruption (Page 25)

This is part four of a series, ‘Lessons from the first cyberwar.’ Read part one, part two and part three.

From the Estonian attack in 2007 to leveraging cyber operations and supporting military operations in Georgia in 2008, Russia already had some experience waging cyberwar. And before the Euromaidan Revolution in Ukraine in late November 2013, Russia had begun preparing for an actual war against Ukraine – both physical and digital.

Ukraine’s president at the time, Viktor Yanukovych, who had close ties with Russia, had backpedaled against closer ties with the European Union, refusing under the Kremlin’s pressure to sign an association agreement with the EU.

Russia offered Ukraine US$15 billion in economic aid, which was seen by some as a bribe to Yanukovych to turn away from the EU.

Activists started large protests against the president’s decision to try to bring the country deeper into Russia’s sphere of influence. Yanukovych tried to stop these protests with force, but that only made the protesters more determined and brought more people into the streets. The situation continued to escalate and eventually Yanukovych fled to Russia.

Putin exerted pressure on Yanukovych to pivot Ukraine toward joining the Eurasian Economic Union (EEU), mirroring Russia’s successful coercion of Armenia.

Compared with Armenia’s transition from the EU Association Agreement to the EEU, which occurred without significant public dissent, Ukraine’s situation was markedly different, culminating in mass protests.

Following the ascent of the Euromaidan activists to power, Russia executed an invasion of Crimea. This operation was characterized by the deployment of Russian special forces, who were notably disguised as “little green men” – soldiers without identifiable insignia.

However, during Russia’s invasion of Crimea and illegal referendum, the Kremlin also launched an eight-minute DDoS attack against Ukraine, which was 32 times more powerful than Russia’s largest attack against Georgia during its invasion in 2008.

Then, on the day of the referendum in Crimea, Russia also began conducting DDoS attacks against NATO websites for voicing support for Ukraine against Russia’s invasion. This set a precedent for Russia targeting Ukraine’s supporters with cyberattacks in subsequent confrontations.

In May 2014, the pro-Russian hacktivist group CyberBerkut tried to disrupt the Ukrainian presidential elections. Four days before the vote, they hacked into Ukraine’s main election computers and deleted important files, causing the system that counts the votes to stop working.

The next day, the hackers announced they had “destroyed the computer network infrastructure” used for the election, leaking emails and documents online to show what they had done.

Furthermore, they continued attacking the vote counting system with DDoS attacks, which overloaded the system with traffic. The next day, Ukrainian officials reported that they had fixed the system using backup files, which were ready to be used again. However, government cyber experts still had to remove – 40 minutes before the results were announced – a virus that would have resulted in false votes being released.

Russia’s aim was to discredit Ukraine’s elections. The attacks also revealed how Russian cyber operations are targeted to disrupt services and create instability.

In April 2014, after illegally annexing Crimea, Russia also sent militant groups into south-eastern Ukraine to create a violent uprising that ultimately led to war in Ukraine’s Eastern Donbas region between Ukraine and Russian-backed militants.

As Russian tanks invaded Ukraine in August 2014, Russian hackers were already working on conducting cyberattacks against Ukraine, with the country distracted by what was happening politically.

The war in eastern Ukraine also gave Russia-affiliated hackers the opportunity to begin launching extensive cyberattacks against Ukraine. As a result, Ukraine’s situation would end up being termed “Russia’s test lab” for cyberwar.

In 2015, Russia conducted an unprecedented hack of Ukraine’s power grid, which marked one of the first known instances of a cyberattack resulting in a major power outage, this affecting around 230,000 residents of Western Ukraine.

The hackers used a spear-phishing scheme with malicious Microsoft Office attachments to first gain access to the networks by obtaining the legitimate credentials of three regional electricity distribution companies, providing them with remote access.

They sent malicious emails to employees, which, when opened, infected their operating systems. The attackers deployed BlackEnergy malware on the companies’ computer networks, which was used to gather intelligence on infrastructure and networks to guide future cyberattacks.

The hackers took over the control systems of the power distribution stations and manually switched off the electricity. The power was only out for one to six hours in the affected areas, but even two months after the attack, the control centers were still not fully operational.

The attack was carefully planned and executed over many months with one of Russia’s political goals being to undermine public trust in the Ukrainian Government and private companies.

Viktor Yushchenko, who was Ukraine’s president from 2005 to 2010, highlighted that Russia’s tactics in the digital and physical realm were intended “to destabilize the situation in Ukraine, to make its government look incompetent and vulnerable.”

Russia also began using these attacks against Ukraine to learn about the impact and to perfect its craft for future attacks against both Ukraine and the West.

The attack on Ukraine’s critical infrastructure served as a wake-up call for the international community about the potential dangers of cyber warfare and the impact it could have on civilians.

In 2016, Russia conducted another cyberattack targeting Ukraine’s critical infrastructure. This attack specifically targeted the electrical grid of Kiev, the capital of Ukraine, and marked a continuation of the cyberwar tactics that were evident in the 2015 attack on Ukraine’s power grid in Western Ukraine.

The 2016 cyberattack used a more sophisticated approach by deploying a new type of malware known as “Industroyer.” Industroyer is highly sophisticated and dangerous because it is designed to directly target and control electricity substation switches and circuit breakers. This enables it to automate the process of controlling the electrical distribution network.

The blackout malware was similar to the Stuxnet attack in that the aim was not only to disrupt physical infrastructure but to destroy it. The attack was also designed to cause prolonged harm, potentially resulting in power outages that could have lasted for weeks, if not months.

This showed that hackers were developing more sophisticated tools specifically designed to disrupt critical infrastructure, foreshadowing future Russian cyberattacks. Ukraine had become a “battleground in a cyberwar arms race for global influence.”

In what would become one of the most devasting cyberattacks ever launched, Ukraine was hit with an attack involving the NotPetya ransomware, which took place on June 27, 2017, Ukraine’s Constitution Day.

This attack was particularly destructive and had a far-reaching impact, both on the country’s infrastructure and also internationally as the cyberattack resulted in a global financial impact of $10 billion worth of damage.

The primary objective of NotPetya was to disrupt Ukraine’s financial system but its effects extended well beyond that as it targeted a wide range of entities including banks, energy companies, government offices, airports and even some non-governmental organizations.

Within 24 hours, NotPetya managed to erase data from 10% of computers across Ukraine, causing widespread disruption across various sectors.

The malware initially spread through MeDoc, Ukraine’s most popular accounting software.

Researchers discovered that some of MeDoc’s software updates contained a hidden “back door.”

This was likely implemented by someone with access to the company’s source code and provided hackers with a stealthy way to infiltrate the systems of various companies without being detected.

As compared with typical ransomware, which encrypts data and demands payment for its release, NotPetya was more destructive as it masqueraded as ransomware but was designed primarily to wipe data and disrupt systems. NotPetya also spread on its own and was a much more effective malware attack than in previous cases.

Former US Department of Homeland Security advisor Tom Bossert stated that the use of NotPetya was like “using a nuclear bomb to achieve a small tactical victory.”

The attack also pointed out the interconnected nature of cyber vulnerabilities and how a cyberattack can rapidly spread around the globe from one piece of software. In essence, Ukraine’s vulnerabilities in the cyber war against Russia are also the West’s vulnerabilities.

The need to help Ukraine shore up its defenses was becoming more critical due to the fear of contagion in a globalized, interconnected world. In July 2018, Russia attempted a cyberattack against a Ukrainian chlorine plant, the Auly Chlorine Distillation, with the intent of causing damage to the country’s infrastructure.

The facility is involved in the treatment of chlorine, which is vital for water purification and other industrial processes. The attackers used a malware known as “VPNFilter” which can survive a reboot, making it particularly resilient. The malware can be used to spy, steal data, and disrupt industrial processes and render devices inoperable.

The malware targeted the chlorine station’s control systems, which could have interrupted how chlorine is treated and supplied. If the plant’s operations were badly affected, it might have caused major environmental and health problems for the civilian population.

This attack was planned to be Russia’s next big cyberattack on Ukraine. However, security companies found the botnet, which had 500,000 infected devices before it could fully launch.

Next: The Ukraine War

David Kirichenko is a Ukrainian-American security engineer and freelance journalist. Since Russia’s full-scale invasion of Ukraine in 2022 he has taken a civilian activist role.

These articles are excerpted, with kind permission, from a report he presented at the UK Parliament on February 20 on behalf of the Henry Jackson Society.

Continue Reading

This is part three of a series, ‘Lessons from the first cyberwar.’ Read part one and part two.

Over the past two decades, warfare has expanded beyond mere physical confrontations to encompass the digital realm.

As a result, cyber capabilities have been growing, leading nation-states, notably Russia and Israel, to use cyberattacks increasingly in support of their political objectives as the following case studies illustrate.

Estonia 2007

In the spring of 2007, Estonia experienced what came to be known as the first cyberattack on a nation-state. This campaign was linked to a wider political dispute with Russia over the relocation of a Soviet-era monument in Tallinn. The cyberattacks, which began on 27 April, targeted Estonia’s internet infrastructure, including banks, media outlets and government services.

The cyberattacks were mostly Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. They overwhelmed servers with massive waves of network traffic sent from botnets and automated requests, disrupting online services at an unprecedented level.

Estonia’s experience was the first instance of a nation facing this modern form of hybrid warfare. The effectiveness of the Russian cyberattacks on Estonia was amplified due to the country’s extensive reliance on the internet. In 2000, Estonia’s parliament even declared internet access a human right and the country has invested heavily in digitization.

These attacks flagged the vulnerabilities in a highly digitized society, demonstrating the risks of embracing extensive digitalization. The attacks demonstrated that cyber warfare is a serious tool for societal disruption in military contexts as it can cause damage but also not be followed with any sort of military retaliation. Following the attack, Estonia established a voluntary Cyber Defense Unit – something that Ukraine is currently considering as well.

A notable aspect of these attacks was their ambiguity as a wide variety of actors including cyber gangs loyal to Moscow conducted the attacks. This practice can enable any state sponsor orchestrating the attacks to remain hidden and deny involvement, as attribution is difficult without proving who is responsible – which is incredibly difficult in cyberspace.

The 2007 attack on Estonia also helped to speed up the creation of the NATO CCDCOE in 2008. It became NATO’s cyber defense center, which today includes over 30 NATO members, with Ukraine having joined the center in 2023.

Russia–Georgia War of 2008

In August 2008, during its invasion of Georgia, Russia combined cyberattacks with military actions on the ground. This was the first time such a coordinated effort had been seen in warfare. This Russian-Georgian war stemmed from frozen Russian-controlled conflicts in Abkhazia and South Ossetia, which Georgian President Mikhail Saakashvili sought to end.

This early form of cyber warfare was characterized by its alignment with Russia’s military and political objectives, contrasting with the earlier 2007 Estonia cyber incident. Russia’s strategy focused on controlling Georgian military and government communication channels.

Before the physical invasion, Georgian government sites experienced a pre-emptive cyberattack that began on July 20, 2008; the website of the president was overwhelmed by traffic, including the phrase “Win+love+in+Russia”, and was inoperable for 24 hours.

The attacks intensified on August 8 with a series of DDOS attacks coinciding with Russia’s invasion of South Ossetia. These cyberattacks had effectively disabled most of Georgia’s governmental websites by August 10. Faced with a communication blackout, Georgia sought cyber refuge by relocating critical official internet assets to the United States, Estonia and Poland without prior US government approval.

The primary objective of the Russian cyberattacks on Georgia was to isolate and silence the country. This strategy also included disrupting Georgian banks, which faced a deluge of fraudulent transactions, prompting international banks to halt their operations in Georgia to limit damage.

Consequently, Georgia’s banking system was incapacitated for 10 days. This disruption extended to the shutdown of mobile phone services, further severing Georgia’s communication with the outside world.

Russian hackers also took aim at Georgian commercial websites, causing economic damage akin to the disruption experienced by the banking system. During the attacks, 35% of Georgia’s internet networks experienced reduced functionality. The damage peaked during the Russian invasion of South Ossetia between August 8 and 10.

In response to the cyber onslaught, Georgia initially tried filtering Russian IP addresses. However, Russian hackers quickly adapted, employing non-Russian servers and spoofed IP addresses to continue their attacks. This series of events demonstrated Russia’s ability to effectively integrate cyber warfare with conventional military operations, achieving its strategic goals and setting a precedent for future conflicts.

Russia’s cyber offensive also demonstrated the importance of protecting not only military networks but also civilian computer networks. The attacks catalyzed expert discussions about the concept of a “digital Pearl Harbor,” a scenario in which a nation’s infrastructure is overwhelmed and shut down through internet-based attacks.

Many also predicted that Russia’s 2022 invasion of Ukraine would unleash a “digital Pearl Harbor.”

Kyrgyzstan 2009

In January 2009, Kyrgyzstan was hosting an American military base, the Manas Air Base, which played a strategic role in US military operations in Afghanistan. Russia, seeking to expand its sphere of influence in Central Asia, wanted to reduce the American presence in the region and was negotiating with the Kyrgyz government over the air base.

While negotiations were underway, Russian hackers carried out a DDoS attack against Kyrgyzstan. The attack took out two of Kyrgyzstan’s four main internet service providers.

The cyberattack was part of a broader strategy by Russia to pressure the Kyrgyz government as it coincided with negotiations and discussions regarding the American military base. Following the cyberattack and amidst ongoing negotiations, Kyrgyzstan announced its decision to shut down the American military base.

Russia’s 2009 cyberattack on Kyrgyzstan continued to demonstrate to the Russian leadership the growing role of cyber capabilities as tools of statecraft and how they could be used to threaten or strong-arm countries.

Israel–Iran cyberwar

Since the 1979 Islamic Revolution in Iran, there has been a four-decade conflict between Iran and Israel. The revolution ushered in a new Islamic regime in Iran, which adopted the Palestinian cause and severed diplomatic ties with Israel.

The rivalry has extended beyond direct confrontation to a proxy war, with Iran supporting terrorist groups including Hezbollah in Lebanon and Hamas in Gaza, both of which border Israel.

However, the proxy war would eventually extend into a direct conflict between Iran and Israel in cyberspace. Cyber warfare had become a new front in this conflict by 2010, although the extent remains largely undisclosed as neither nation openly admits to launching cyberattacks against the other.

Israel, often in collaboration with the United States, is suspected of conducting several sophisticated cyber operations targeting Iran’s nuclear program. The most notable attack in the cyber war was the discovery of the Stuxnet virus in Iran’s Bushehr nuclear power plant computers in 2010.

Believed to be a joint creation of Israel and the United States through Operation Olympic Games, Stuxnet was engineered to cause physical damage by speeding up and destroying the IR-1 centrifuges, leading to the destruction of about 1,000 out of 9,000 centrifuges at Natanz.

Stuxnet effectively disrupted production at Natanz by damaging the facility’s equipment. Iran attributed this attack to Israel and the United States.

In response to the Stuxnet incident, Iran significantly bolstered its cyber capabilities, enhancing both defensive and offensive measures. Between 2012 and 2015, Iran’s cyber security budget increased by around 1200% and, after Stuxnet, Iran began focusing the majority of its cyber espionage against Israel.

At a 2019 tech conference, Israeli Prime Minister Benjamin Netanyahu claimed that Iran was constantly conducting cyberattacks that targeted Israel’s critical infrastructure.

In April 2020, Israel experienced a cyberattack on its water and sewer facilities, leading to temporary disruptions in local water systems. Initially attributed to a technical malfunction by the Israeli government, it was later identified as an attack by Iran.

In response, Israel launched a retaliatory cyberattack the following month against the Shahid Rajee Port, targeting the operating systems of private shipping companies. The consequences were widespread, causing prolonged road and waterway congestion.

The Iranian attack on Israel was believed to have been targeting the water supply by increasing chlorine in the water that is delivered to residential areas.

Yigal Unna, the head of Israel’s National Cyber Directorate, believed that if the attack had not been detected in time, chlorine or other chemicals could have been mixed into the water supply, poisoning many civilians.

In 2021, Israel was accused by Iran of conducting a cyberattack that took down many of the country’s gasoline stations by sabotaging a payment system, leaving many people unable to buy fuel for their vehicles.

While nations routinely engage in probing each other’s public utilities to identify vulnerabilities and establish a persistent presence, the escalation to actual attacks is a rarity. But if nation-states want to execute large-scale cyberattacks against civilian infrastructure, the consequences could be deadly for the civilian populations.

A comparison of the cases, starting with the cyberattacks on Estonia in 2007, with the complex cyber operations against Ukraine up to 2022 (see the next installment for those) provides insight into how Russia has conducted its cyber campaigns in the past, how its capabilities have evolved and how cyber strategies support political goals.

David Kirichenko is a Ukrainian-American security engineer and freelance journalist. Since Russia’s full-scale invasion of Ukraine in 2022 he has taken a civilian activist role.

These articles are excerpted, with kind permission, from a report he presented at the UK Parliament on February 20 on behalf of the Henry Jackson Society.

Continue Reading