Russia Using Ukraine As A Cyberwar Testing Ground

Russia's aim was to discredit Ukraine's elections. The attacks also revealed how Russian cyber operations are targeted to disrupt services and create instabilit .

In April 2014, after illegally annexing Crimea, Russia also sent militant groups into south-eastern Ukraine to create a violent uprising that ultimately led to war in Ukraine's Eastern Donbas region between Ukraine and Russian-backed militants.

As Russian tanks invaded Ukraine in August 2014, Russian hackers were already working on conducting cyberattacks against Ukraine, with the country distracted by what was happening politically.

The war in eastern Ukraine also gave Russia-affiliated hackers the opportunity to begin launching extensive cyberattacks against Ukraine. As a result, Ukraine's situation would end up being termed “Russia's test lab” for cyberwar.

In 2015, Russia conducted an unprecedented hack of Ukraine's power grid , which marked one of the first known instances of a cyberattack resulting in a major power outage, this affecting around 230,000 residents of Western Ukraine.

The hackers used a spear-phishing scheme with malicious Microsoft Office attachments to first gain access to the networks by obtaining the legitimate credentials of three regional electricity distribution companies, providing them with remote access.

They sent malicious emails to employees, which, when opened, infected their operating systems. The attackers deployed BlackEnergy malware on the companies' computer networks , which was used to gather intelligence on infrastructure and networks to guide future cyberattacks.

The hackers took over the control systems of the power distribution stations and manually switched off the electricity. The power was only out for one to six hours in the affected areas, but even two months after the attack, the control centers were still not fully operational.

The attack was carefully planned and executed over many months with one of Russia's political goals being to undermine public trust in the Ukrainian Government and private companies.

Viktor Yushchenko, who was Ukraine's president from 2005 to 2010, highlighted that Russia's tactics in the digital and physical realm were intended“to destabilize the situation in Ukraine, to make its government look incompetent and vulnerable.”

Russia also began using these attacks against Ukraine to learn about the impact and to perfect its craft for future attacks against both Ukraine and the West.

The attack on Ukraine's critical infrastructure served as a wake-up call for the international community about the potential dangers of cyber warfare and the impact it could have on civilians.

In 2016 , Russia conducted another cyberattack targeting Ukraine's critical infrastructure. This attack specifically targeted the electrical grid of Kiev, the capital of Ukraine, and marked a continuation of the cyberwar tactics that were evident in the 2015 attack on Ukraine's power grid in Western Ukraine.

The 2016 cyberattack used a more sophisticated approach by deploying a new type of malware known as“
Anton Cherepanov and Robert Lipovsky,“Industroyer: Biggest threat to industrial control systems since Stuxnet”, We Live Security, 12 June 2017, ">Industroyer .” Industroyer is highly sophisticated and dangerous because it is designed to directly target and control electricity substation switches and circuit breakers. This enables it to automate the process of controlling the electrical distribution network.

The blackout malware was similar to the Stuxnet attack in that the aim was not only to disrupt physical infrastructure but to destroy it. The attack was also designed to cause prolonged harm, potentially resulting in power outages that could have lasted for weeks, if not months.

This showed that hackers were developing more sophisticated tools specifically designed to disrupt critical infrastructure, foreshadowing future Russian cyberattacks. Ukraine had become a“battleground in a cyberwar arms race for global influence.”

In what would become one of the most devasting cyberattacks ever launched, Ukraine was hit with an attack involving the NotPetya ransomware , which took place on June 27, 2017, Ukraine's Constitution Day.

This attack was particularly destructive and had a far-reaching impact, both on the country's infrastructure and also internationally as the cyberattack resulted in a global financial impact of $10 billion worth of damage .

The primary objective of NotPetya was to disrupt Ukraine's financial system but its effects extended well beyond that as it targeted a wide range of entities including banks, energy companies, government offices, airports and even some non-governmental organizations.

Within 24 hours, NotPetya managed to erase data from 10% of computers across Ukrain e, causing widespread disruption across various sectors.

The malware initially spread through MeDoc , Ukraine's most popular accounting software.

Researchers discovered that some of MeDoc's software updates contained a hidden“back door.”

This was likely implemented by someone with access to the company's source code and provided hackers with a stealthy way to infiltrate the systems of various companies without being detected.

As compared with typical ransomware, which encrypts data and demands payment for its release, NotPetya was more destructive as it masqueraded as ransomware but was designed primarily to wipe data and disrupt systems. NotPetya also spread on its own and was a much more effective malware attack than in previous cases.

Sign up for one of our free newsletters

• The Daily Report Start your day right with Asia Times' top stories
• AT Weekly Report A weekly roundup of Asia Times' most-read stories

Former US Department of Homeland Security advisor Tom Bossert stated that the use of NotPetya was like“using a nuclear bomb to achieve a small tactical victory.”

In what would become one of the most devasting cyberattacks ever launched, Ukraine was hit with an attack involving the NotPetya ransomware, which took place on June 27, 2017. Former US Department of Homeland Security advisor Tom Bossert stated that the use of NotPetya was like 'using a nuclear bomb to achieve a small tactical victory.' Image: Bleeping Computer

The attack also pointed out the interconnected nature of cyber vulnerabilities and how a cyberattack can rapidly spread around the globe from one piece of software. In essence, Ukraine's vulnerabilities in the cyber war against Russia are also the West's vulnerabilities.

The need to help Ukraine shore up its defenses was becoming more critical due to the fear of contagion in a globalized, interconnected world. In July 2018, Russia attempted a cyberattack against a Ukrainian chlorine plan t, the Auly Chlorine Distillation, with the intent of causing damage to the country's infrastructure.

The facility is involved in the treatment of chlorine, which is vital for water purification and other industrial processes. The attackers used a malware known as“VPNFilter” which can survive a reboot, making it particularly resilient. The malware can be used to spy, steal data, and disrupt industrial processes and render devices inoperable.

The malware targeted the chlorine station's control systems, which could have interrupted how chlorine is treated and supplied. If the plant's operations were badly affected, it might have caused major environmental and health problems for the civilian population.

This attack was planned to be Russia's next big cyberattack on Ukraine. However, security companies found the botnet, which had 500,000 infected devices before it could fully launch.

Next: The Ukraine War

David Kirichenko
is a Ukrainian-American security engineer and freelance journalist. Since Russia's full-scale invasion of Ukraine in 2022 he has taken a civilian
activist role .

These articles are excerpted, with kind permission, from
a report he presented at the UK Parliament
on February 20 on behalf of the Henry Jackson Society.

Already have an account? Sign i Sign up here to comment on Asia Times stories OR

Thank you for registering!

An account was already registered with this email. Please check your inbox for an authentication link.