Russia–Ukraine Cyberwar Highlights Hacktivist Mobilization and Attribution Risks
Summary
In an August 2022 webinar, DarkOwl examined hacktivist participation, destructive malware, criminal-group divisions and attribution risks in the Russia–Ukraine conflict, reporting limited sustained disruption from cyberattacks.
Key points
- DarkOwl described Ukraine’s IT Army as using Telegram to recruit international volunteers and distribute Russian targeting information, expanding participation beyond state cyber forces.
- The presentation cited Microsoft research identifying six wiper malware strains deployed against Ukraine before the invasion; wipers destroy data rather than merely restricting access.
- According to the speaker, attacks affected government services, banks, telecommunications and critical infrastructure, but observed disruptions generally lasted hours or days rather than producing sustained shutdowns.
- DarkOwl reported divisions between Russian and Ukrainian cybercriminals, with rival participants leaking internal information about ransomware operations, tools and tactics.
- The speaker warned that loosely controlled civilian hackers complicate attribution, escalation and any eventual ceasefire because governments may not control their continued attacks.
- For organizations exposed through regional subsidiaries, vendors or contractors, the webinar recommended reassessing risk and reinforcing MFA, patching, traffic filtering and log monitoring.
Article Details
- Topic
- Cyberwarfare and hacktivist mobilization during the Russia-Ukraine war, including critical-infrastructure disruption, attribution challenges, and civilian participation.
MITRE ATT&CK
T1485 · Data DestructionWiper malware deployed against Ukrainian systems before the invasion destroyed data and prevented its retrieval.T1498 · Network Denial of ServiceHacktivists conducted repeated DDoS attacks against Russian targets; a DDoS attack also shut down the Joint Institute for Nuclear Research for several days.T1566 · PhishingGhostRider reportedly sent phishing emails appearing to originate from Ukrainian government addresses, directing civilians toward gathering locations subsequently hit by shelling.
People
Threat Actors
AnonymousLaunched a campaign attacking Russia and Belarus on the third day of the war, according to the presenter.GhostRiderDescribed as Russia-aligned and as retaliating against GhostSec with a phishing campaign targeting civilians in Ukrainian combat zones.GhostSecReportedly compromised Russian government printer networks to print pro-Ukrainian propaganda and attacked the Russia-aligned group GhostRider.IT Army of the UkraineUkrainian-government-organized hacktivist mobilization using Telegram to publish Russian targeting information and coordinate volunteer cyberattacks.
Vendors
Products
Countries
BelarusDay three of the war, Anonymous launched a campaign to attack Russia and the Belarus.ChinaChina from 2009 onwards had a very significant global espionage effort underway.RussiaOn the 24th of February, after months of failed diplomacy, war broke out between Ukraine and Russia.UkraineOn the 24th of February, after months of failed diplomacy, war broke out between Ukraine and Russia.
Industries
ElectricityExploited water and electricity facilities have been targeted.Oil and gasWe’re going to talk about some explosions that have occurred in Russian oil and gas facilities that have in fact caused civilian loss of life.TelecommunicationsAnd then we’ve seen ISPs and other telecommunications providers.TransportationThere were a number of attacks against banks, transportation, legal, military contractors.waterExploited water and electricity facilities have been targeted.