Russia-Ukraine Conflict: Russian Internet Infrastructure Updates

Russia-Ukraine Conflict: Russian Internet Infrastructure Updates

TLP: WHITE

In this briefing, ZeroFox Intelligence provides an update on Russian Internet infrastructure regarding the Russian-Ukraine conflict.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Link to Download

• https://zf-dashboard-media.s3.amazonaws.com/intel/ZeroFox+Intelligence+Brief_+Russian+Internet+Infrastructure+Updates+March+4+2022.pdf

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EST) on March 4, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

Ukraine has asked the Internet Corporation for Assigned Names and Numbers (ICANN) to revoke Russian top-level domains (TLDs) and SSL certificates. However, ICANN, the United States, and its European Union (EU) counterparts have expressed no interest in sanctions that would restrict Russian access to the global internet. The United States is also unlikely to use offensive cyber capabilities against Russian information and physical infrastructure targets, lest it be construed as an act of war.

Key Findings

• On February 28, 2022, Ukraine asked ICANN to revoke Russian TLDs and SSL certificates, but ICANN said it has no sanctions power.
• ICANN could theoretically be pressured to take more aggressive action against Russia, but the United States and its allies currently have no interest in such measures.
• Targeting Russian internet infrastructure could set precedent for both “splintering” global internet infrastructure and manipulating internet regulators.
• Russia is centralizing the control of its information environment through its “Sovereign Internet Law.” War with Ukraine will likely exacerbate this process.
• The United States has offensive cyber capabilities but is unlikely to take action against Russia that could be construed as an act of war.