Ukraine War Reshaped Cyber Operations and Criminal Communities, DarkOwl Reports
Summary
DarkOwl’s year-in-review describes cyber campaigns, hacktivism, ransomware, ICS targeting and increased Telegram use linked to the Ukraine war, while noting uncertainty around some group claims and alleged weapons listings.
Key points
- The report says Russia-aligned actors conducted website defacements, DDoS attacks, data leaks and wiper deployments around the invasion; attacks on KA-SAT disrupted satellite connectivity.
- Ukraine’s IT Army and international hacktivists, including Anonymous, carried out or claimed campaigns against Russian services and organizations; some reported impacts were attributed to official or group statements.
- DarkOwl reports a fourfold increase in its collected Telegram content since the war began, with channels used to share battlefield updates, disinformation and malware.
- The report describes fractures in criminal groups, including Conti’s alignment with Russia, leaked internal materials, and members shifting to other ransomware operations.
- ICS and critical infrastructure remained a concern. The article recounts warnings about vulnerable PLCs and SCADA devices and says some hacktivist claims of ICS attacks could not be verified.
- DarkOwl argues ransomware activity may be increasingly shaped by geopolitical objectives, while noting 2022 ransomware payments were reported to have fallen by more than 40% compared with the prior two years.
Article Details
- Publisher
- DarkOwl
- Report Period
- 2022-02-24 to 2023-02-24
- Scope
- Review of the Ukraine conflict’s effects on cyber activity and the global criminal digital ecosystem, including ransomware, hacktivism, communications, ICS threats, and darknet weapons listings.
- Key Statistics
- DarkOwl's collected Telegram content volume quadrupled since the war began; the article gives no absolute volume.
- DarkOwl reports observing multiple darknet advertisements for Javelin ATGMs at $15,000–$30,000 USD, NLAWs at $8,000 USD, and AT-4s and RPGs for under $1,000 USD.
- The article says Switchblade 300 and 6000 drones appeared in stock quantities consistent with battlefield theft; this is an assessment, not a verified count.
- The article cites Chainalysis as reporting that total ransomware payments in 2022 were over 40% lower than in the previous two years.
People
Threat Actors
BlackBastaRansomware group described as rising following the decline of Conti.BlackByteRansomware group described as rising following the decline of Conti.ContiRansomware group described as aligning with Russia; the article says its source code, private chats, and botnet infrastructure details were released.GhostSecCyber cell described as conducting attacks against targets in Russia and Belarus; the article notes researchers questioned the legitimacy of some claims.IT Army of RussiaRussia-aligned threat actor described as conducting offensive activity and spreading Kremlin propaganda in support of cyberattacks against Ukraine and NATO targets.KarakurtThe article describes its extortion-as-a-service operations as rising after Conti's decline.KillnetRussia-aligned threat actor described as announcing plans to target hospitals and medical institutions across NATO countries.MontiRansomware group that the article says uses Conti-like TTPs and encryption; researchers debate whether it is a Conti doppelganger or an evolution.StormousRansomware group described as aligning with Russia and as having its servers attacked and services taken offline.Trickbot GroupRansomware gang whose software-development collaboration with Conti was confirmed, according to the article.
Malware
AcidRainwith DDoS attacks followed by EL MIPS malware used to infect Viasat satellite modems and routers with AcidRain destructive wiper malware, knocking thousands of customers offline.EL MIPSbefore the invasion, Russia hit critical KA-SAT satellite infrastructure with DDoS attacks followed by EL MIPS malware used to infect Viasat satellite modems and routers with AcidRain destructive wiper malware,HermeticWiperThe invasion was also preceded with the Russia’s debut of WhisperGate and HermeticWiper malware variants that they deployed in ransomware-style attacks against key academic institutions, non-profit, and governmentINCONTROLLERThe ominous CISA advisory was drafted after Dragos published an in-depth report detailing the potential of CHERNOVITE’s PIPEDREAM ICS malware.LockBitNewer strains of ransomware like Royal and Lockbit 3.0, which have materialized since the invasion of Ukraine, directly target ESXi found in Linux and virtual machine servers.RoyalNewer strains of ransomware like Royal and Lockbit 3.0, which have materialized since the invasion of Ukraine, directly target ESXi found in Linux and virtual machine servers.WhisperGateThe invasion was also preceded with the Russia’s debut of WhisperGate and HermeticWiper malware variants that they deployed in ransomware-style attacks against key academic institutions, non-profit, and government
Vendors
CISACISA advised in April 2022 that threat actors – including Russian military operatives – could (and very possibly would) exploit vulnerable industrial control system (ICS) and critical supervisory control and dataDarkOwlDarkOwl confirmed Killnet likely collaborated with a new DDoS-as-a-service botnet called Passion, developed by a group with the same name, in their disruptive, malicious campaign.DragosThe ominous CISA advisory was drafted after Dragos published an in-depth report detailing the potential of CHERNOVITE’s PIPEDREAM ICS malware.Red BalloonMore recent analysis from Red Balloon adds Siemens SIMATIC and SIPLUS S7-1500 series PLCs to the list of potentially vulnerable ICS related devices.
Products
ESXiNewer strains of ransomware like Royal and Lockbit 3.0, which have materialized since the invasion of Ukraine, directly target ESXi found in Linux and virtual machine servers.KA-SATExactly one hour before the invasion, Russia hit critical KA-SAT satellite infrastructure with DDoS attacks followed by EL MIPS malware used to infect Viasat satellite modems and routers with AcidRain destructive wiperOMRON Sysmac NEX PLCsOMRON Sysmac NEX PLCs, andSiemens SIMATICMore recent analysis from Red Balloon adds Siemens SIMATIC and SIPLUS S7-1500 series PLCs to the list of potentially vulnerable ICS related devices.SIPLUS S7-1500 series PLCsMore recent analysis from Red Balloon adds Siemens SIMATIC and SIPLUS S7-1500 series PLCs to the list of potentially vulnerable ICS related devices.TelegramThe use of Telegram and non-Tor based peer to peer networks rose exponentially in use in the last year with threat actors relying on the instant messaging chat platforms for coordinating their cyber campaigns andTorThe use of Telegram and non-Tor based peer to peer networks rose exponentially in use in the last year with threat actors relying on the instant messaging chat platforms for coordinating their cyber campaigns andViasathit critical KA-SAT satellite infrastructure with DDoS attacks followed by EL MIPS malware used to infect Viasat satellite modems and routers with AcidRain destructive wiper malware, knocking thousands of customers
Countries
Belarustechnical significance and severity of their attacks they conducted against targets across Russia and Belarus with claims they successfully targeted and shutdown multiple ICS-related control panels.RussiaExactly 365 days after Russia invaded Ukraine in 2022, the Ukraine-Russia conflict shows no sign of ending and an adjacent global cyberwar continues to wage in underground corners of the internet.UkraineExactly 365 days after Russia invaded Ukraine in 2022, the Ukraine-Russia conflict shows no sign of ending and an adjacent global cyberwar continues to wage in underground corners of the internet.
Industries
food and agriculturecritical industrial market segments such as mining, oil, electrical and natural gas, water, food and agriculture, saw a remarkable increase in successful ransomware attacks by darknet threat actors.Industrial control systemsIn the last year, cybersecurity attacks against industrial control systems (ICS) skyrocketed in volume and sophistication, with infrastructure across Russia, Ukraine, and NATO countries directly targeted.MiningICS-specific attacks have been less severe than anticipated, critical industrial market segments such as mining, oil, electrical and natural gas, water, food and agriculture, saw a remarkable increase in successfulwaterthan anticipated, critical industrial market segments such as mining, oil, electrical and natural gas, water, food and agriculture, saw a remarkable increase in successful ransomware attacks by darknet threat actors.