Russia-Ukraine Conflict: Disinformation Campaigns and Cyber Attacks Likely in the Near Term

Russia-Ukraine Conflict: Disinformation Campaigns and Cyber Attacks Likely in the Near Term

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Executive Summary

As the conflict in Ukraine unfolds, businesses operating in Ukraine or with strategic interests in the region are concerned about cyber risks stemming from the geopolitical situation in Eastern Europe. Even if any military conflict remains confined within Ukraine's borders, cyber attacks waged by the Kremlin will have a spillover effect worldwide. ZeroFox assesses that Russia is likely to sponsor cyber attacks against the Ukrainian public sector and critical infrastructure that will enable Russia to operate under a veil of plausible deniability, avoiding direct repercussions for such attacks as observed in the past. Retaliatory cyber attacks against the United States and NATO allies are also possible. U.S. and British officials continue to warn large organizations, particularly utility companies, about the potential for cyber attacks launched by the Russian government. In tandem with cyber attacks, ZeroFox assesses that Russia will continue to wage its information operations campaign against Ukraine to destabilize its domestic policy, hinder business, worsen the investment climate, and scare off trading partners and foreign investors. Any ongoing disinformation efforts could provide the foundation for a physical invasion down the road and paint Ukraine as the aggressor in the border conflict. Similarly, Russia will likely focus its rhetoric on the United States or NATO in its continued efforts to sow confusion and division and weaken geopolitical influence on the ongoing conflict.

The security situation in Ukraine continues to be unpredictable due to the increased threat of Russian military action and can deteriorate with little notice. Daily life in Ukrainian cities, however, currently continues without signs of panic. No food shortages, utility interruptions, runs on banks, or mass exodus from the country have been reported. Nevertheless, organizations conducting business in Ukraine should exercise caution and consider the possibility of collateral damage from future cyber attacks via service providers or business partners in Ukraine.

Cyber Attacks Likely to Precede Large-Scale Military Actions

As evidenced in its previous efforts in Ukraine, Georgia, Belarus, and the Baltics, cyber aggression is as much a part of the Russian strategy as any possible military action. Russian state-sponsored Advanced Persistent Threat (APT) actors have continuously demonstrated sophisticated tradecraft and cyber capabilities by compromising third-party infrastructure and software, developing and deploying custom malware, and maintaining persistent, undetected, long-term access in compromised networks. Russian APT actors frequently utilize common but effective tactics—such as spear phishing, brute force, and exploiting known vulnerabilities—to gain initial access to target networks. While most of the cyber aggression efforts are likely to be focused on Ukraine, as the country has always been a cyberwar testing ground for Russia, U.S. agencies are advising organizations to be on alert for attacks from Russian state-sponsored hackers in light of the escalation of the Eastern European conflict.¹ In the same vein, Britain's National Cyber Security Centre has warned large organizations to bolster their cybersecurity resilience amid the deepening tensions over Ukraine.

In mid-January 2022, cyber criminals defaced more than 70 Ukrainian government websites and compromised at least 10 networks with destructive malware dubbed WhisperGate. WhisperGate is strategically similar to the NotPetya wiper used to attack Ukraine in 2017; both wipers masquerade as ransomware and target the master boot record instead of encrypting it. While the tactic of disguising wiper malware as ransomware is not a new one and was employed by actors linked to nation-states, the malware used in the 2022 attacks notably has more components designed to inflict additional damage.² The use of wiper malware indicates that attackers were motivated by destruction versus financial gain. Security researchers assess that the attackers used stolen credentials in the campaign and likely had access to the victims' networks months before the attack, consistent with sophisticated APT operations.³ The government of Ukraine has already formally accused Russia of masterminding these attacks.⁴ Fortunately, the attacks did not lead to any catastrophic disruptions or data leaks; however, given the spillover effect and multi-billion dollar losses associated with NotPetya in 2017, businesses with a connection to Ukraine should consider isolating and monitoring networks connected to Ukrainian entities. While it is unlikely that WhisperGate will directly target organizations outside of Ukraine, organizations should consider their possibility of collateral damage via service providers or business partners in Ukraine.

In addition, cyber espionage efforts by Russia-linked groups against organizations in Ukraine are likely. Since at least 2013, security researchers have been tracking a campaign organized by a collective known as Gamaredon, which is responsible for a number of malicious phishing campaigns that have been primarily aimed at Ukrainian institutions with the goal of harvesting classified information from compromised Windows systems for geopolitical gains.⁵ Ukrainian officials allege that Gamaredon is responsible for launching espionage and intelligence-gathering attacks on Ukrainian military forces.⁶ Some security researchers worry the attacks might signal a larger operation, and ZeroFox continues to monitor for any future campaigns.

Cyber Attacks Against Critical Infrastructure Are Likely

While ZeroFox is not aware of any planned attacks on the critical infrastructure or aviation networks in Ukraine, cyber attacks from Russia against the Ukrainian public sector and critical infrastructure are likely based on the history of Russia’s actions against Ukraine since 2014. Such attacks are particularly difficult to deter given the relative lack of consequences expected as compared to a traditional attack, which would be treated as an act of war. The Russian government maintains an array of offensive cyber tools ranging from low-level denial-of-service capabilities to destructive attacks that it could employ against the Ukrainian public sector and critical infrastructure networks. For example, Russia reportedly conducted cyber attacks on Ukrainian power grid operators in 2015 and 2016 that elicited little Western response.⁷ International laws to address nation-state-sponsored attacks are still in their infancy, and investigators are rarely able to trace hacks back to specific individuals or connect hackers to governments, despite evidence indicating such connections. Ukrainian and U.S. officials have credited the previous grid hacks to Russia, linking the malware observed in the affected systems to Russian nation-state cyber actors and assessed that these actors conducted cyber campaigns against Ukrainian critical infrastructure.⁸

While the Russian government commonly operates through its intelligence services, it also uses cyber criminal groups to achieve its goals, which allows the Kremlin to maintain plausible deniability. On January 14, 2022, Russia arrested several members of the Russia-based ransomware collective REvil, which was responsible for the 2021 ransomware attacks against JBS Foods and Colonial Pipeline.⁹ Such an unprecedented move caused cybersecurity analysts to question Russia's motives, including speculation it was designed to make it easier for the government to deny a connection to any future cyber attacks.

U.S. officials have issued alerts to U.S. critical infrastructure operators and local governments about the potential for cyber attacks launched by the Russian government in response to any U.S. or NATO involvement in the ongoing conflict in Ukraine. As seen in the past, shortly after attacks on the Ukrainian power grid in 2015 and 2016, Russian malware was discovered inside at least 10 utility companies, including the operator of a nuclear plant in Kansas.¹⁰ These incidents took place in the wake of a political revolution in Ukraine, the annexation of Crimea, and amid military clashes in Ukraine's Donetsk and Luhansk regions.

Russia Steps Up Information Campaigns Amid Tensions

Russia has weaponized false narratives in cyberspace through the development of a disinformation and propaganda ecosystem to create doubt about what is true. Such strategies seek to manipulate information and relationships and weaken countries' geopolitical control. A solid example was the anti-Western disinformation campaigns that took place during the 2014 annexation of the Crimean Peninsula along with military operations in eastern Ukraine, which sowed fear across the local population that the Ukrainian and Western governments were threatening their lives and freedoms. Various social media, chat platforms, and state-backed media outlets continue to push the same narrative in 2022—while overplaying NATO and U.S. interference in Ukraine and overhyping its collective threat to the Russian-speaking population. ZeroFox assesses that Russia will focus on the United States or NATO in its continued efforts to sow confusion and prevent a unified response to Russian aggression in Ukraine. At a moment of more fragile alliances and complicated political environments between European nations and the United States, the Kremlin can achieve important goals by shaping public conversation and perception as the conflict in eastern Ukraine unfolds.

Over the past eight years, much of the Russian propaganda efforts have been aimed at a domestic audience in Russia and pro-Moscow Ukrainians. These efforts have focused on disparaging the Ukrainian government and accusing it of a humanitarian crisis in eastern Ukraine, where Ukrainian government forces have been battling Russia-led separatists. Russian propaganda efforts have included conducting damaging social media operations, using overt and covert online Russia-supported media outlets, hosting conferences and roundtables designed to influence attendees into falsely believing that Ukraine—not Russia— is at fault for heightened tensions in the region, and leveraging cyber operations to deface media outlets or spread fake bomb threats.¹¹ In the first few weeks of 2022 alone, Ukrainian police investigated over 3,000 fake bomb threats aimed at sowing panic among the public. Ukrainian authorities blame Russia for the false alerts as part of the country’s so-called hybrid war in Ukraine.

After invading Ukraine in 2014, the Russian government and state-controlled disinformation outlets began to label anyone who questioned Russia's actions as Russophobes.¹² Disinformation surrounding the 2014 downing of Malaysia Airlines flight 17 with a Buk missile over eastern Ukraine—in which Russia refutes a joint international investigation conclusion that flight MH17 was shot down by a missile from an area under control of Russia-backed militants— is an example of the attempt to discredit the criminal trial, deny responsibility, and distort the narrative away from the Kremlin.¹³ Reportedly, the Buk missile was brought in from the territory of the Russian Federation and, after having shot down flight MH17, was taken back to the Russian Federation. Russia continues to deny any involvement and does not accept responsibility for shooting down this civilian plane, which resulted in the loss of 298 passengers. The aftermath of the MH17 disaster was a case study in using a multitude of different communication channels to achieve a common goal: the discrediting of all those who claimed that Russia played some part in the attack and instead accusing the Ukrainian military of the attack.

Ukrainian authorities have taken numerous steps to counter the threat of Russian information warfare inside Ukraine, including blocking Russian TV channels and social media platforms since the early years of the conflict. However, Ukraine struggles to fight back in the international arena, where—despite regional variations in language and approach—the core Russian narratives employed from country to country have remained familiar throughout 2022: portraying Ukraine as a failed state led astray by both the United States and the West and overrun by far-right extremists. The narrative that U.S. soldiers are fighting on Ukrainian soil still appears to be a prominent theme across multiple Russian online publications. Furthermore, in 2022, Russia’s propaganda efforts rely heavily on the allegation that NATO made a commitment to the Soviet Union in 1990 that the military alliance would not expand. Moscow’s messaging on NATO expansion is meant to reinforce the idea that Russia was wronged by a broken promise—likely to redirect attention from the 100,000 troops amassed on the Ukrainian border.¹⁴ Many of the countries once affiliated with the Soviet Union have since joined NATO, but Ukraine has not. As the conflict in the region escalates, ZeroFox assesses that Russia will continue to wage its information operations campaign against Ukraine to create polarization, destabilize its domestic policy, hinder business, worsen the investment climate, and ultimately drive away trading partners and foreign investors.

Recommendations

The security situation in Ukraine continues to be unpredictable due to the increased threat of Russian military action and can deteriorate with little notice. ZeroFox recommends that organizations continually evaluate potential exposures in the region and elevate their level of security around the connections, software, and processes that link them to Ukraine, as well as ensure proper personnel security and evacuation plans are in place.

Organizations with interests in Ukraine should carefully monitor and isolate systems with connections to Ukraine due to the ongoing challenges. As the Cybersecurity and Infrastructure Security Agency has cautioned, organizations should adopt a heightened state of awareness and conduct proactive threat hunting. More specific recommendations for critical infrastructure providers include logical zoning of operational technology and industrial control systems based on operational necessity and risk and defining acceptable communication conduits between the zones.¹⁵ As a matter of best practice, organizations should create a patch management plan that includes updates to approved software and allows time for testing before a full rollout. Critical and internet-facing systems should be grouped for priority, allowing the organization to react in a timely manner. Organizations should also have a robust log collection strategy, enforce strong passwords and multi-factor authentication, use security solutions like antivirus software, and block unnecessary ports and protocols. Organizations should be extra vigilant and maintain current backups of business-critical systems and data, exercise restoration processes before they are needed, and ensure that backups cannot be impacted by ransomware-style or wiper malware attacks.

1: https://www.cisa.gov/uscert/ncas/alerts/aa22-011a
2: https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
3: https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html
4: https://www.bbc.com/news/world-europe-59992531; https://thedigital.gov.ua/news/rosiya-mae-namir-zniziti-doviru-do-vladi-feykami-pro-vrazlivist-kritichnoi-informatsiynoi-infrastrukturi-ta-zliv-danikh-ukraintsiv; https://www.pravda.com.ua/news/2022/01/16/7320557/
5: https://thehackernews.com/2021/11/ukraine-identifies-russian-fsb-officers.html
6: https://cert.gov.ua/article/10702
7: https://jsis.washington.edu/news/cyberattack-critical-infrastructure-russia-ukrainian-power-grid-attacks/
8: https://www.cisa.gov/uscert/ics/alerts/IR-ALERT-H-16-056-01
9: https://www.zdnet.com/article/white-house-says-person-behind-colonial-pipeline-ransomware-attack-nabbed-during-russian-raid/
10: https://www.bloomberg.com/news/features/2022-01-26/what-happens-when-russian-hackers-cyberattack-the-u-s-electric-power-grid
11: https://www.state.gov/russias-top-five-persistent-disinformation-narratives/
12: https://www.state.gov/russias-top-five-persistent-disinformation-narratives/
13: https://foreignpolicy.com/2016/09/29/how-mh17-gave-birth-to-the-modern-russian-spin-machine-putin-ukraine/
14: https://www.theglobeandmail.com/world/article-moscow-has-ramped-up-disinformation-campaign-playing-a-role-in/
15: https://www.cisa.gov/uscert/ncas/alerts/aa22-011a