On the day that the Ukraine war began, Russian hackers are known to have used distributed denial-of-service attacks to target Kyiv government websites— including that of the parliament, government, Foreign Ministry, and other institutions.

The Wall Street Journal (WSJ) reported that the NotPetya malware – one of the most notorious pieces of ransomware in modern history – was put into practice hours before Russia invaded.

Researchers from Slovakia-based cyber firm ESET said they had detected NotPetya on hundreds of Ukrainian machines with timestamps that indicated the malware had been created nearly two months previously in preparation for deployment.

However, SBRC CEO Jude McCorry commented that, despite previous discussions around “cyber-war,” the escalation of conflict between Russia and Ukraine has shown that cyber “has been secondary”.

“The cyber takedowns in Ukraine have not had much impact on the country, as the Ukrainian government is focused on the activity on the ground with tanks, missiles and other military activity, as most of the government departments/hospitals are not functioning anyhow,” McCrory said.

While this is certainly in line with the discourse around how much stock Russia puts into cyber-warfare – it’s the images of ruined government offices and besieged residential areas that have catalysed responses from Russia’s almost global crowd of detractors.

Russia’s “cyber-war” appears to fall flat

While the physical weapons of war have wreaked havoc on the country, the comparable tameness of Russia’s cyber-activities has given some hope to Ukraine.

Internet is working across the country, and President Zelenskyy has been able to rally global support through smartphone messages and videos.

In a show of solidarity, countries around the world, including the US and the UK, have responded by launching their own hacker campaigns to thwart Russian agents, as have the Ukrainians themselves.

We are even seeing platforms such as Telegram being leveraged to coordinate cyber-attacks on Russia and garner cryptocurrency donations.

Ukraine’s capital Kyiv has recruited what it calls an “IT Army,” to help fight the expected Russian cyber-onslaught.

In an impassioned call, Zelenskyy asked SpaceX and Tesla founder Elon Musk to provide its Starlink satellite system to the country to help it fight.

Musk responded by sending the satellites, designed to provide internet access to underserved global locations, and stated they were now “active” in Ukraine and more equipment was on the way.

Russia itself has also suffered setbacks not just from the response from Western countries, but from its own people.

Through its state-run media channels, the Kremlin has been pushing the narrative that its invasion of Ukraine is an exercise in liberation, and to “deNazify” Ukrainian leadership.

However, in a sign of changing attitudes in Russia, user data collected by Atlas VPN found that Virtual Private Network (VPN) installs in the country have surged by almost 2,000%, with sudden interest driven on February 16, 2022, after the first known wave of cyber-attacks against Ukraine occurred.

Data revealed that VPN installs reached record heights one day after another during the last week of February.

On the 25th, VPN installs rose by 241% above the average, Atlas VPN said, with data from the following day suggesting VPN installs increased by 1,076%.

However, on the 27th on February, they increased even further, soaring 1,906% higher than the average use in Russia.

If major events continue and the Ukraine war escalates further then VPN uptake could increase even more, Atlas said.

The Russian state still maintains strong mass media regulations to restrict harmful content. However, these regulations are known to be routinely abused to censor criticism of the government or local administrations, as well as limiting a range of social media and communication platforms.

What can we expect now

Despite these setbacks, and as the Ukraine war rages on, it is believed that Russia will start to get its cyber-campaign against Ukraine in gear.

There is fear that, with a delicate balance of diplomatic tensions between Vladimir Putin and Western leaders, a major cyber-attack could spill over into other parts of Europe, triggering a wider war.

The Scottish Business Resilience Centre (SBRC) warned businesses in Scotland that there will likely be an increase in retaliatory Russian cyber-attacks against other nations.

Updated guidance has been released by the National Cyber Security Centre which sets out steps organisations should take when the cybersecurity threat is heightened.

McCrory added: “We have no specific threats for Scotland or the UK, but what we need to be aware of is the overspill or rogue cyber activity coming into other countries like Scotland – so we are urging everyone to be more vigilant.

“I have seen the vigilance in public sector and the preparation for any such events, but I still think businesses are not doing enough to prepare.”

However, the impact of the cyber-war on wider European countries remains to be seen. The Russian military is preoccupied with fighting on the ground in Ukraine and meeting fierce resistance.

Bill Buchanan, OBE, Professor of Applied Cryptography at Edinburgh Napier University, said cyber activities are often used to probe and discover before war begins, but once the battle starts, the impact of cyber-attacks is likely to be lessened.

“For all the talk about cyber warfare within wars, it is bombs and tanks that physically destroy critical infrastructure and lives and inflict more long-term damage than any cyber-attack would ever bring,” Professor Buchanan said.

Recommended

• Scottish Hospital Deploys AI Tech to Spot Cancer Early
• FinTech Scotland has Unveiled its Research and Innovation Roadmap
• Innovid Finalises Acquisition of Edinburgh’s TVSquared

Global expectations of a crippling cyber-campaign against Ukraine, based on prior knowledge that Russia has a major cyber-army at its disposal, have not come to pass.

“Overall, an army on the move is often highly secure in their operations, and their focus is often not to bring down critical infrastructure using electronic methods, but to physically destroy core parts of it,” Professor Buchanan added.

“For example, an attack on the electrical power network will possibly do more damage than a distributed denial of service (DDoS) against Web servers. Unfortunately, tanks and bombs have a more devastating effect on a country and their citizens than cyber activities could ever have.”

In a sign of the war moving away from cyber, Russia’s military has laid siege to Ukrainian cities, moved to encircle the capital Kyiv, and Russian President Vladimir Putin has ordered his nuclear forces to be on alert.

Professor Buchanan continued: “With a cyber-attack we can often put in place defence measures – such as load balancing – or can get services back on-line by placing them in different geographical locations.

“Within a war, cyber activities will often move to intelligence gathering, and it is bombs that are used in damage and disrupt, especially in supressing communication channels.

“In the end, though, it is heart-breaking in this modern world to see lives so disrupted, families split up and children in fear.”

Scot-Secure 2022 – Cybersecurity Conference

The 8th annual Scot-Secure Summit will take place on 23rd March at Dynamic Earth in Edinburgh, and streamed live through our virtual conference platform.

The programme will focus on promoting best-practice cyber security; looking at the current trends, key threats, and offering practical advice on improving resilience and implementing effective security measures.

To find out more and sign up for the event, click here.