UKRAINE: 3 QUESTIONS - 3 ANSWERS, PART 12: CYBERWAR?

03/11/2022By Redaktion

Cyberwar Konflikte Krieg Russland

The war in Ukraine is not only fought with troops, tanks, and airplanes, but also in computer networks and the internet. Colonel Walter Unger heads the Cyber Defense & ICT Security Department at the Army Intelligence Office. Here he answers questions about the cyber conflict.

Statement from the Army Expert:

The current war in Ukraine is accompanied by cyber attacks. To which groups/organizations can these activities be attributed - and what motives do these individual groups pursue?

Since 2014, Ukraine has registered more than 5,000 cyber attacks on government institutions and critical infrastructures. According to Ukrainian authorities, these attacks are carried out by the group "Armageddon" of the Russian intelligence service FSB.

Since December 2021, the number of attacks has increased. These attacks are primarily directed against government agencies, including the Ministry of Interior, the police, and the electricity companies.

In so-called defacement attacks, propaganda messages were inserted into about 70 government websites. The supposedly Belarusian group "UNC1151" is accused by the Ukrainian side. The defacing of the websites was probably intended to unsettle the Ukrainian population.

In January, the malware "Whispergate" was discovered on IT systems of Ukrainian government agencies, non-profit organizations, and IT companies. This program prevents the affected device from starting up. Additionally, it injects a module on the computer that searches for files with specific extensions and then overwrites them. This sabotage program could be part of the preparation for further operations in the military conflict.

The cyber attacks are probably to be seen as part of the Russian strategy against Ukraine: espionage, sabotage, and influence operations are also carried out with cyber methods within the conflict framework.

How can a "Non-Technical" person imagine the course of such an attack?

In website manipulation, texts are overwritten or inserted, images are replaced, and fake news are spread. The hacker exploits vulnerabilities of a poorly programmed website.

In espionage and sabotage attacks, malware is introduced; mostly through infected email attachments or manipulated websites. Spyware hides on the computer, behaves inconspicuously, gathers information, and periodically sends it to the hacker's computer. There are spyware programs that record keystrokes, for example passwords, take screenshots, and copy files and address directories.

Sabotage programs aim to disrupt or even destroy computers, networks, or machines controlled by them. These programs delete or encrypt program parts that are essential for functioning.

Another sabotage method is the so-called "Distributed Denial-of-Service" attacks. The victim's computer, for example, is overloaded with requests from tens of thousands of computers simultaneously, leading to a prolonged crash.

What cyber activities could be crucial for the course of the conflict?

Cyber attacks to interrupt the leadership and communication capabilities of the government and the military could be very effective. Cyber attacks to restrict the enemy's military combat capabilities, such as disabling air attack weapons, radar systems, or supply logistics, could decisively support or restrict military actions.

Large-scale outages in Ukraine's critical infrastructure through cyber sabotage (such as in the energy network) could lead to domestic turmoil in Ukraine. Failures in transportation or communication infrastructures that are essential for the Ukrainian military could significantly limit combat power.

BUNDESHEER on the Internet