Ukraine War Drives Global Hacktivist Cyberattacks and Data Leaks
Summary
DarkOwl’s review of the first 77 days of the Ukraine war describes volunteer-led cyberattacks, data leaks and information operations targeting Russia, while noting limited observed disruption to Russian critical infrastructure and ongoing Russian-linked attacks.
Key points
- Ukraine’s Ministry of Digital Transformation mobilized an IT Army of more than 275,000 volunteers to target Russian websites with DDoS attacks.
- DarkOwl says it observed hundreds of war-related data leaks; nearly 90% involved Russian targets, and recent releases included more than 3TB of archives.
- Anonymous said it leaked more than 900,000 emails and 360,000 files from Russian state media organizations.
- A group using leaked CONTI ransomware code reportedly attacked Russian targets; it shared a database purportedly containing over 7 million Qiwi users’ card numbers and associated personal data.
- DarkOwl reported no mass disruption of Russian critical infrastructure, but Cyber Partisans disrupted rail services in Belarus and GhostSec claimed it disrupted a Russian train system.
- The article says Russia’s GRU carried out an attack that knocked Viasat’s KA-SAT broadband offline before the invasion; it also reports ongoing Russian-linked attacks against Ukrainian infrastructure.
Article Details
- Event Type
- Cyber operations and information campaigns associated with the Russia-Ukraine war, including hacktivist attacks, data leaks, disinformation, and attacks on infrastructure.
- Impact
- The article reports DDoS attacks against Russian websites, leaks of government and commercial data, and disruptions to some transport systems. It says over 7 million unique credit card numbers and associated personal information were shared in a leak attributed to an attack on Qiwi, and that Anonymous released more than 3 TB of data archives. It also reports that Russia’s GRU carried out a cyberattack that disrupted Viasat’s KA-SAT service before the invasion, and that Ukrainian Starlink service faced targeted signal jamming. The article says it had not observed mass disruption of Russia’s gas, power, or water infrastructure; some reported explosions and fires had unclear causes.
MITRE ATT&CK
T1486 · Data Encrypted for ImpactThe article estimates ransomware gangs successfully encrypt about a dozen organizations per day.T1498 · Network Denial of ServiceThe article reports DDoS attacks against Russian websites by the IT Army of Ukraine.T1566 · PhishingThe article reports spear-phishing attacks against US and western European companies by state-sponsored and ransomware-linked actors.
People
Threat Actors
AgainstTheWestThe article says this group targeted technology, government, and financial targets in China during the campaign.AnonymousThe hacktivist collective is reported to have conducted information operations, compromised Russian state media, and released stolen data.ContiThe article describes CONTI as a ransomware gang whose leaked source code was later used by Network Battalion (nb65).Cyber PartisansThe group is reported to have used industrial control system attacks to shut down trainlines supplying the Russian military in Belarus.GhostSecThe article says the group claimed responsibility for compromising Russia’s Metrospetstekhnika ASOTP system and disrupting connected trains.GRUThe article attributes the cyberattack that disrupted Viasat’s KA-SAT service before the invasion to Russia’s GRU.IT Army of the UkraineThe article says this volunteer digital army, tasked by Ukraine’s Ministry of Digital Transformation, targets Russian websites with DDoS attacks.KelvinsecurityThe article says Kelvinsecurity exploited an IDOR vulnerability on DATABASE Market and leaked its database.Network Battalion (nb65)The group is reported to have used leaked CONTI ransomware source code in attacks against targets in Russia.Russian Internet Research Agency (IRA)The article attributes a pro-Russian troll operation, including bot accounts spreading disinformation, to the IRA.Trickbot GroupThe article describes the group as FSB-backed and reports that dossiers of its members were leaked.v0g3lsecThe article identifies v0g3lsec as an Anonymous member who hacked a Russian-linked darknet vendor shop and replaced its content.
Malware
Vendors
SpaceXThe Ministry also coordinated directly with SpaceX on acquiring thousands of Starlink terminals for redundant satellite Internet access and spearheaded public calls to international business leaders and retail suppliersViasatRecent reporting confirms Russia’s GRU also carried out a massive cyberattack against Viasat, knocking its customers’ KA-SAT satellite broadband offline an hour before the invasion.
Products
KA-SATRecent reporting confirms Russia’s GRU also carried out a massive cyberattack against Viasat, knocking its customers’ KA-SAT satellite broadband offline an hour before the invasion.Microsoft ExchangeEnerpred, Aerogas, and Technotec have all suffered cyberattacks resulting in thousands of internal Microsoft Exchange email data leaks in the deep web.Qiwi КошелекTheir most recent attack involved Qiwi Кошелек Russian payment system, with over 149,000 kiosks and terminals around the country.StarlinkThe Ministry also coordinated directly with SpaceX on acquiring thousands of Starlink terminals for redundant satellite Internet access and spearheaded public calls to international business leaders and retail suppliers
Countries
Belarusinstead promotes peace in Ukraine, and a united brotherhood across all nations in the region including Belarus, Russia, and Ukraine. ChinaOn the 24th of February, after months of failed diplomacy, the existing geopolitical landscape of Russia, Ukraine, NATO, the EU, China, and the myriad of complex international relationships drastically changed.RussiaOn the 24th of February, after months of failed diplomacy, the existing geopolitical landscape of Russia, Ukraine, NATO, the EU, China, and the myriad of complex international relationships drastically changed.UkraineOn the 24th of February, after months of failed diplomacy, the existing geopolitical landscape of Russia, Ukraine, NATO, the EU, China, and the myriad of complex international relationships drastically changed.
Industries
GovernmentWithin the first week of the war, we witnessed credentials for numerous critical Russian government ministries leaked on the deep web; the names, phone numbers and personal assets of Russian oligarchy released to theTechnologyThe threat actor group, AgainstTheWest (ATW) concentrated on technology, government, and financial targets across China in the weeks following the invasion.Telecommunicationswidespread propaganda dissemination, GRU-affiliated cyber actors have regularly attacked Ukrainian telecommunications and critical infrastructure alongside its ground-based offensives.TransportationAutomated ticketing stations were knocked offline and forced the transportation authorities to issue paper tickets causing delays.