Cyber Crime Weaponised: What Business Can Learn From Ukraine

Since Russia began its  attempted invasion of Ukraine attention has focused on the conflict on land, sea and in the air. The less visible but nonetheless a critical element of the conflict is the battle being waged in cyberspace and like the military conflict, the war in cyberspace has an impact beyond the borders of Ukraine and Russia. 

While no one can predict how long this war will last, we can say for certain that the cyber aspects of the conflict in Ukraine will continue to resonate long after the guns have been silenced.

So, what does the conflict teach us about cyber warfare and how can organisations prepare themselves for this new world order? 

A New Era of Cyber Warfare 

One thing we can take away from what’s happening in Ukraine is that cyberwarfare has become an established component of global conflict both in the propaganda battle as well as in the actual conduct of military operations.  
From Distributed Denial of Service (DDoS) attacks and website defacements to critical infrastructure attacks activity on both sides has escalated dramatically since the initial invasion in February.

Just three days into the conflict in late February, Check Point Research (CPR) noted a 196% increase in cyber attacks on Ukraine’s government and military sector. And these attacks have shown no signs of slowing down in the months since. New figures from CPR reports that between February and August of this year, cyber attacks on Ukraine’s government and military sector more than doubled, increasing by a staggering 112%, while Russia’s same sector decreased by 8%.  

While Russia has not completely disconnected from the Internet, government and military networks and websites have implemented different measures to limit access to their resources from outside of Russia, which make the execution of some of the attacks more difficult. Indeed, Ukraine has been under constant attack, throughout the conflict, corporate networks have experienced over 1,500 cyber attacks a week on average. This is 25% higher than before the conflict, versus 1,434 weekly cyberattacks on Russia corporate networks. 

Russian operations have focused on a campaign of disruption and destruction, with government and state-sponsored APT groups conducting sophisticated operations that have ranged from critical infrastructure attacks to espionage missions. For the first time, we have seen co-ordinated cyber attacks and kinetic military assaults. 
One notable example took place on 1st March when a Russian missile assault on Kyiv’s TV tower coincided with a simultaneous cyber attack designed to knock out the city’s broadcasting capabilities. 

  • The most attacked industry in Russia during the conflict was the Finance sector, with an average of more than 2,600 attacks per organisation every week, an increase of 24% compared to before the conflict. This could possibly be due to a heavier focus on the finance industry having greater activity, due to global sanctions implemented on Russia from government and business organisations outside of Russia. Disrupting this sector will also severely disturb the day-to-day normal activities of its citizens.
  • The second most attacked industry during the conflict was Communications, with an average of 1928 weekly attacks per organisation. These attacks are intended to disrupt online services including telephony and Internet services  pushing normal activities into disarray.  
  • Manufacturing was the third heavily attacked sector, with over 400 attacks per organization every week. Manufacturing is one of Ukraine's key critical industries, with its global wheat exports contributing heavily to Ukraine’s economy.

Such disruptions would now not only impact inflows of funds into Ukraine, but negatively impact their exports.  
Perhaps the defining aspect of these attacks, however, has been the strength and relative successes of Ukraine's cyber defences, something that highlights the importance of ongoing operational security. But continued vigilance is just one of the factors at play here. The other notable impact has come from the army of volunteers who have flocked to support Ukraine, and whose involvement might change the face of cybersecurity as we know it.

A Battleground Without Borders

The cyber battle that’s raged in Ukraine has silently swept up thousands of “volunteer troops” ranging from hacktivists to cyber criminals. One of the most interesting aspects of the cyber warfare that has raged in Eastern Europe has been Ukraine’s willingness to recruit keyboard warriors from both sides of the law to join its ranks. 
During the first few days of the war the Ukrainian Minister of Digital Transformation, Mykhailo Fedorov, posted on Twitter a call for “digital talents” to join the country’s newly created IT army, with operational tasks being allocated to them via a designated Telegram channel that attracted hundreds of thousands of members.  

The formation of a state-affiliated cyber force is unprecedented and, while the birth of Ukraine’s IT army is an extraordinary achievement, looking forward it could prove to be problematic. 

Recruiting and engaging members via Telegram is far from secure. How do you vet the people that are coming forward and stop other parties from infiltrating them or using them for their own recruitment? The fact that just about anybody could be serving within Ukraine’s cyber army is a major concern. There are equal concerns on the Russian side where state-backing has given cybercriminal groups both the means and opportunities to step up their activity.  

Opening The Floodgates For Future Attacks  

When the war in Ukraine does come to an end, it is likely that the cyber security space will find itself in a far worse situation than it is today. Whether it’s through the anonymous recruitment of Ukraine’s IT army or the cybercriminals in Russia to whom this conflict has given an opportunity to hone their craft.  Whatever the outcome, these APT groups, hacktivists and individuals are not just going to disappear.

Instead, they will turn their newfound expertise and tooling towards fresh targets unleashing a tsunami of cyber attacks across the globe. 

We have already started to see early warning signs of this with attacks on new NATO partners, as well as on those countries who have come to Ukraine’s aid, increasing in both frequency and intensity.  It’s not just government departments in those countries that should be concerned, businesses must also prepare themselves for what will follow in the wake of this war. 

Cyber criminals need a steady income stream in order to recruit new members and invest in technology, and they will turn their attention towards enterprises to boost their coffers when state support has run dry.  This conflict has seen cyber activity change the face of warfare forever. But it has also had the ‘collateral damage’ effect of raising the threat level for cyber-attacks on government and commercial organisations globally. While we were already in an era of sophisticated cyber attacks, threat actors have raised their game during the war and we know that even more integrated and sophisticated cyberattacks are coming down the line. 

Organisations need to ready themselves now. Mitigating attacks won't be enough, companies must adopt a prevent-first cyber security strategy. 

Check Point Research:  

You Might Also Read: 

A Cyber Attack On NATO Could Trigger Article 5:

 

« Russia Plans To Dominate Military AI
How To Outsmart Increasingly Complex Cyber Attacks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

IT Security Guru

IT Security Guru

IT Security Gurus publish daily breaking news. interviews with the key thinkers in IT security, videos and the top 10 stories as picked by our Editor.

CEPS

CEPS

CEPS is a leading think tank and forum for debate on EU affairs, ranking among the top think tanks in Europe. Topic areas include Innovation, Digital economy and Cyber-security.

EclecticIQ

EclecticIQ

EclecticIQ is a global provider of threat intelligence, hunting and response technology and services.

Military Cyber Professionals Association (MCPA)

Military Cyber Professionals Association (MCPA)

MCPA are a team of Soldiers, Sailors, Airmen, Marines, Veterans and others interested in the development of the American military cyber profession.

Sungard Availability Services (Sungard AS)

Sungard Availability Services (Sungard AS)

Sungard AS partners with customers around the globe to understand their unique business needs and provide production and recovery services tailored to their requirements.

SureVine

SureVine

Surevine builds secure, scalable collaboration solutions for the most security conscious organisations, enabling collaboration on their most sensitive information.

Infosec (T) Ltd

Infosec (T) Ltd

Infosec (T) Limited is an independent Tanzania based consultancy specializing in IT governance, information security and IT audit.

TROOPERS

TROOPERS

TROOPERS InfoSec event consists of two days of high-end training, followed by a two-day, three-track conference, culminating in Roundtables on the final day.

Secure Ideas

Secure Ideas

Secure Ideas is focused on penetration testing and application security including web applications, web services and mobile applications.

Research Institute in Verified Trustworthy Software Systems (VeTSS)

Research Institute in Verified Trustworthy Software Systems (VeTSS)

The main purpose of VeTSS is to support program analysis, testing and verification, to achieve guarantees of software correctness, safety, and security.

Cyturus Technologies

Cyturus Technologies

Cyturus Technologies delivers cybersecurity business risk quantification services using our proprietary Adaptive Risk Model (ARM).

ThreatNix

ThreatNix

ThreatNix is a tight knit group of experienced security professionals who are committed to providing competent cybersecurity solutions that adhere to international standards.

RapidSpike

RapidSpike

RapidSpike is the only website monitoring solution that focuses all three key aspects of website health: performance, reliability AND security.

Catalyst Campus For Technology & Innovation

Catalyst Campus For Technology & Innovation

Catalyst Campus is a collaborative ecosystem to create community, spark innovation and stimulate business growth.

Aegis Cyber Defense Systems

Aegis Cyber Defense Systems

AEGIS is a powerful cybersecurity tool that can help protect your devices and networks from cyber threats, and increase performance.

CERT.ar

CERT.ar

CERT.ar is the national Computer Emergency Response Team for the technical-administrative management of computer security incidents in the National Public Sector of Argentina.