Russia-Ukraine Conflict Cyber Updates

Russia-Ukraine Conflict Cyber Updates

TLP: WHITE

February 24, 2022, through March 1, 2022, saw a flurry of cyber activity related to the ongoing conflict between Russia and Ukraine. Amid speculation that there would be a massive cyberwar between Russia and the rest of the world, several hacktivist and threat actor groups decided to make their positions on the conflict known. In a message that would be considered highly unusual for a government official, the Ukrainian Vice Prime Minister and Minister of Digital Transformation made a plea to the public for “digital talent” to coordinate their efforts against designated Russian targets. World governments were far from the only ones to take action against Russia; social media giants Meta, Twitter, and YouTube took various steps to protect their users from disinformation campaigns and block Russian state-owned accounts from earning money through advertisements.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Scope Note

This report focuses on the various cyber activity taking place between February 24, 2022, and March 1, 2022, as it pertains to the Russia-Ukraine conflict.

Key Findings

• Despite the increase in visibility of attacks against Russian-owned or operated organizations, ZeroFox has not observed a notable increase in activity against organizations outside of the region within the realm of general cyber underground activity.
• While several hacktivist groups have announced support for Ukraine, very few threat actors or ransomware groups have publicly voiced support for Russia as many expected them to do.
• In a highly unusual move for a government official, Ukraine’s Vice Prime Minister made a public plea for assistance in targeting Russian-owned entities via cyberattacks.
• Amidst widespread sanctions against Russian government officials, oligarchs, and organizations, social media companies also began to take action to protect users by clearly labeling state-affiliated accounts and limiting the ability for Russian-owned media accounts to earn money through advertising on multiple social media platforms.
• Despite the increase in visibility of attacks against Russian-owned or operated organizations, ZeroFox has not observed a notable increase in activity against organizations outside of the region within the realm of general cyber underground activity.

Disclaimer Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 8:45 AM (EST) on March 1, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Details

Cyber Activity

On February 26, 2022, Mykhailo Fedorov, Ukraine’s Vice Prime Minister and Minister of Digital Transformation, made a public plea for “digital talent” amid the ongoing Russia-Ukraine conflict. His social media posting linked to a public Telegram channel titled IT Army of Ukraine. “There will be tasks for everyone. We continue to fight on the cyber front.” Tasks listed in the channel are being posted in both Ukrainian and English “For all IT specialists from other countries.”

Hacktivist groups and threat actors alike have begun making their respective stances known, with several choosing between Russia or Ukraine. Security researchers began tracking several threat actors and hacktivist groups to gather information on group location, types of attacks used, and which side of the conflict each group supports (if any). Updates to the list may be made as more activity is discovered.

Figure 1. A list of hacking groups and threat actors that have made announcements regarding the Russia-Ukraine conflict
Source: ZeroFox Intelligence

Anonymous declared themselves “officially in cyber war against the Russian government” on February 24, 2022. The following days proved to be a busy time for the group, as they are believed to be responsible for multiple DDoS attacks causing outages for Russian government websites. In addition to the typical DDoS attacks seen by the collective, multiple Russian state TV outlets were hacked over the weekend to broadcast Ukrainian music and national symbols, a database for the Russian Ministry of Defense was leaked, and multiple Russian news sites were defaced to display anti-war messages.

Ransomware groups, typically known for claims of political neutrality, have also started getting involved. Conti, one of the largest ransomware groups currently operating, released a statement on February 25, 2022, announcing the group’s “full support of Russian government.” The announcement went on to state, “If anybody will decide to organize a cyberattack or any war activities against Russia, we are going to use our all possible resources to strike back at the critical infrastructures of an enemy.”

Figure 2. Conti's original statement regarding the Russia-Ukraine conflict
Source: ZeroFox Intelligence

Later that same day, Conti appeared to walk back their initial full support for the Russian government and posted a new message claiming that they do not ally with any government and condemn the war. However, Conti stated that any attacks against Russian citizens or critical infrastructure in any Russian-speaking parts of the world would be met with retaliation by the group.

Figure 3. Conti's revised statement regarding the Russia-Ukraine conflict
Source: ZeroFox Intelligence

In a blow to the Conti group, roughly one year’s worth of chat logs were leaked online, potentially revealing behind-the-scenes information the group may not want to be made publicly available. These chat logs were sent to various journalists and security researchers to be analyzed. Malware library vx-underground published a copy on their website for anyone to download on February 27, 2022, and later announced on Twitter that they were the target of a DDoS attack.

The LockBit ransomware group also released a statement on February 27, 2022, seemingly in response to questions they were receiving. The group claims to be “apolitical” with members geographically located across the world.

Figure 4. LockBit's response to questions about the Russia-Ukraine conflict
Source: ZeroFox Intelligence

Members of the CoomingProject reportedly voiced their willingness to help the Russian government should any cyberattacks target the country.

Figure 5. CoomingProject voicing their support of the Russian government
Source: DarkTracer

The CoomingProject claims to be a ransomware group, however, researchers widely believe the group mainly takes advantage of previous leaks to extort their victims. Any Russia-Ukraine involvement by the group may be limited, as hacking group AgainstTheWest is claiming to have identified several members of the CoomingProject and passed the details to law enforcement agencies in France.

On February 28, 2022, ZeroFox observed an update on the Intel Repository leak site publishing information about a Russian defense manufacturer. The actor indicated the data was leaked in support of Ukraine. The alleged leaked file belongs to a defense manufacturer working for the Russian government, and the actor obtained it from the AgainstTheWest (ATW) hacking group.

Figure 6. HackingGroup AgainstTheWest announces they have sent French law enforcement details on members of the CoomingProject
Source: Cyber, etc...

On February 25, 2022, ZeroFox observed forum user “NetSec” posting dumps for 53 million Ukrainian citizens. NetSec has also claimed to dump usernames and passwords related to the Federal Security Service (FSB) of Russia.

Figure 7. An alert in the ZeroFox platform showing the dump containing 53 million Ukrainian citizens
Source: ZeroFox Intelligence

Response from Social Media Companies

Twitter began taking steps on February 25, 2022, to combat misinformation on the platform. The official Twitter Safety account detailed the steps being taken, including disrupting attempts to amplify misinformation; detecting platform manipulation; taking enforcement action against accounts attempting to push misleading narratives; and temporarily pausing advertisements in Russia and Ukraine to “ensure critical public safety information is elevated and ads don’t detract from it.” Twitter later announced on February 28, 2022, that labels were being added to tweets linking to Russian state-affiliated media websites.

Facebook’s parent company, Meta, announced on February 28, 2022, that it had identified and taken steps to remove anti-Ukrainian propaganda across its multiple platforms. This effort comes after a separate campaign was identified compromising Ukrainian journalists and government officials. The actor behind the campaign was given the name “Ghostwriter” by security researchers.

YouTube took steps on February 27, 2022, to stop running ads by Russian state-backed media and other accounts affected by current sanctions. Access to RT, previously known as Russia Today, and “a number of other channels” will also be restricted from within Ukraine.

Analyst Commentary

The last several days have seen heightened activity for cyberattacks related to the ongoing conflict in Ukraine. In addition to the previously observed finance, government, and energy industries being targeted within Russia and Ukraine, ZeroFox has also observed Russian state-owned media and several other Russian organizations targeted by hacking groups. Some of the currently unverified victims include AMD Russia, Yandex, and Mail.ru.

The Conti ransomware group may have followed up on a set of very aggressive public announcements after its internal chat logs were leaked and subsequently shared by vx-underground. Shortly after sharing the files, the vx-underground website became the target of a DDoS attack but did not appear to be knocked offline at any point. This has been the only instance of possible retaliation by known threat actor groups observed by ZeroFox to date.

Long-simmering tension between Russia and Ukraine brought widespread speculation that any perceived aggression from either side could erupt into a massive cyberwar that spilled over to affect the rest of the world. As of this report’s writing, ZeroFox has only observed minimal attacks by Russia against organizations outside of Ukraine.

Despite the increase in visibility of attacks against Russian-owned or operated organizations, ZeroFox has not observed a notable increase in activity against organizations outside of the region within the realm of general cyber underground activity.

ZeroFox is continuing to monitor the situation in Ukraine with regards to cyber activity against Russia, Ukraine, and the actors who may wish to target organizations around the world due to connections with either country.

Recommendations

Organizations can protect themselves by continuing to have employees stay vigilant for the usual cyber threats. To that end, ZeroFox recommends the following measures continue to be taken:

• Continue to push for multi-factor authentication (MFA) everywhere possible to reduce the chance of compromised credentials being used by threat actors.
• Be wary of attachments from unknown or unexpected senders, especially those asking for recipients to enable macros through the “enable content” button in the Microsoft Office suite of applications.
• Services should only be exposed to the internet when absolutely necessary to reduce an organization’s remotely-available attack surface.
• Use built-in operating system features, such as Windows’ System Resource Usage Monitor (SRUM) and previously-installed third-party security solutions, to create a baseline of known or typical activity on corporate workstations and servers.
• Monitor and log network, workstation, and server activity and alert on all suspicious events.
• Create and maintain a regular patch cycle policy, allowing the necessary time for testing and gradual rollout of the most critical systems.
• Backups should be conducted on a regular basis using the popular “3-2-1 Rule.” This means having three copies of data on at least two separate types of media and at least one copy stored completely offline.
• Corporate “gold images” should be regularly updated and maintained in the event that a large number of corporate systems need to be rebuilt quickly.
• Create, maintain, and exercise a basic cyber incident response plan and associated communications plan that includes response and notification procedures.

The Cybersecurity & Infrastructure Security Agency (CISA) also provides guidance related to the ongoing conflict. In addition to this, CISA also has several excellent resources related to preparare against ransomware attacks and breaking down how foreign influence and mis-, dis-, and malinformation campaigns work.

A defense-in-depth security strategy is most effective, and the best way for organizations to protect themselves is by continuing to build upon the security posture already in place.

Please note that this information is current as of the ZeroFox Intelligence collection conclusion at 8:45 AM (EST) on March 1, 2022.