生活课还请编剧真听真看真思考

In 2024, cyber-specialists working as part of the Main Directorate of Intelligence of the Ministry of Defence of Ukraine (HUR) and the Security Service of Ukraine (SBU) initiated several cyberattacks on Russian technology and infrastructure, including attacks on Russia's banking sector, Russian internet providers, regional and municipal administration web resources, Russian airports, several Russian state institutions, and private companies. The operations were conducted as means to impede Russian military operations and uncover classified documents that could be taken into account by the Armed Forces of Ukraine during the Russian invasion of Ukraine, as well as to destabilize Russia's institutions. Cyberattacks began to intensify in scope in June and July 2024.

Background

This section is an excerpt from Russo-Ukrainian cyberwarfare § History.[edit]

Russian–Ukrainian cyberwarfare is a component of the confrontation between Russia and Ukraine since the Revolution of Dignity in 2013–2014. Russian cyberweapon Uroburos had been around since 2005. However, the first attacks on information systems of private enterprises and state institutions of Ukraine were recorded during mass protests in 2013. In 2013, Operation Armageddon, a Russian campaign of systematic cyber espionage on the information systems of government agencies, law enforcement, and defense agencies, began, thought to help Russia on the battlefield. Between 2013 and 2014, some information systems of Ukrainian government agencies were affected by a computer virus known as Snake / Uroborus / Turla. In February–March 2014, as Russian troops entered Crimea communication centers were raided and Ukraine's fibre optic cables were tampered with, cutting connection between the peninsula and mainland Ukraine. Additionally Ukrainian Government websites, news and social media were shut down or targeted in DDoS attacks, while cell phones of many Ukrainian parliamentarians were hacked or jammed. Ukrainian experts also stated the beginning of a cyberwar with Russia.

Cybersecurity companies began to register an increase in the number of cyberattacks on information systems in Ukraine. The victims of Russian cyberattacks were government agencies of Ukraine, the EU, the United States, defense agencies, international and regional defense and political organizations, think tanks, the media, and dissidents. As of 2015, researchers had identified two groups of Russian hackers who have been active in the Russian-Ukrainian cyber war: the so-called APT29 (also known as Cozy Bear, Cozy Duke) and APT28 (also known as Sofacy Group, Tsar Team, Pawn Storm, Fancy Bear).

Attacks

January

In mid-January, the Ukrainian HUR reported that volunteer BO Team hackers employed by the ministry deleted 280 servers and 2 petabytes of data from Planet, a state space hydrometeorology research center in the Far East that aided the Russian military and fifty other state agencies with gathering and analyzing satellite imaging and data. According to HUR, the cyberattack cost Russia approximately US$10 million in damages, which included a destroyed supercomputer and its software, together costing US$350,000 with Western sanctions greatly complicating its replacement. The attack also impacted warehouses and the center building of the research center, including its humidification, air conditioning, servers, and emergency power supply. Further attacks on a Russian Arctic station on Bolshevik Island "completely cut off" its connection with Russian networks.

February

On February 4, HUR's official Telegram channel reported that they accessed an electronic document management system called "bureaucrats", and exposed detailed information about high-ranking Russian military personnel and specialists. The ministry also said that they found a wide array of classified documents, specifically mentioning documents belonging to Russian Deputy Defense Minister Timur Ivanov. The hack resulted in the HUR recovering sensitive information that included Russian army orders, reports, and instructions that were circulating among over 2,000 military units within Russia's defense ministry that could be analyzed by the Armed Forces of Ukraine. The hackers sarcastically thanked Russian Defense Minister Sergei Shoigu's inadvertent role in facilitating the cyberattack's success.

HUR hackers were also able to target Russian military software used to modify commercial DJI drones for military applications, shutting down servers responsible for Russia's "friend or foe" identification system, preventing troops from accessing the server for drone operations. The cyberattack also prevented troops from configuring control panels, transmitting video feeds to command posts, and operating drones using computer interfaces, forcibly grounding several drone fleets and halting operations.

April

In April, the HUR cooperated with the BO Team hacker group to target Interregional TransitTelecom (MTT), a subsidiary of MTS, one of Russia's largest telecom companies, after gaining comprehensive access to MTT's network equipment. The HUR reported that the attack destroyed critical software and configuration files, leading to severe internet disruptions throughout Russia that affected major cities such as Moscow and St. Petersburg, requiring workers to physically access and re-connect equipment to fix the outages.

Attacks on communication company Moskollector by the SBU shut down 87,000 alarm sensors used for sewage monitoring and control throughout the Moscow metropolitan area, destroying "70 servers and at least 90 terabytes of company data, emails, backup copies and contracts" in the process.

June

In early June, HUR cyber operatives conducted a widespread attack on various Russian government websites, including those of key ministries such as the ministries of Justice, Defense, Information Technology and Communications, Finance, Internal Affairs, Industry and Energy, and Emergency Situations. The disruptions extended to civilian services, with local reports indicating several wedding cancellations due to system outages. Attacks on the United Aircraft Company (UAC), Russia's primary advanced aircraft manufacturer, impacted its operations and caused its website to be rendered inaccessible for an extended period. HUR reported that its primary method of cyberattack was by using distributed denial-of-service (DDoS) attacks.

On June 12, coinciding with Russia Day, Ukrainian hackers targeted the online systems of multiple Russian airports, causing flight disruptions. Targeted airports included Yuzhno-Sakhalinsk's airport, Moscow Domodedovo Airport, and Saratov's Gagarin Airport, delaying flights mainly destined for Sochi, Bodrum, and Moscow. The attack also forced airplanes to divert to Samara and Ulyanovsk. Prior to the attack, cyber-specialists accessed the official website server of the Stavropol Region's State Duma, adding a banner containing the phrase "Hold on, we will liberate you!" and depicted Red Square bearing Ukrainian flags, shortly before targeting the airports.

Shortly after on June 14, the HUR cooperated with the BO Team hacker group to attack Russian municipal web resources, primarily targeting the Ulyanovsk regional administration's digital infrastructure. The attack resulted in considerable damage to the administration's IT systems, where two hypervisors and communication devices were reportedly disabled, while ten virtual machines and one personal computer were destroyed. Additionally, the operation led to the erasure of approximately 20 terabytes of data. Prior to the main assault, the hackers engaged in a phishing campaign that targeted other local government bodies, courts, and members of the public.

As part of the operation, the attackers published a fabricated order on the Ulyanovsk administration's website. This false directive, attributed to Mayor A.E. Boldakin, called for public demonstrations. The infiltration also provided the BO Team access to sensitive documents, including reports on military recruitment practices. These documents reportedly referred to Ulyanovsk residents reported for "bypassing of candidates for military service" as "targeted individuals".

On June 26, Russian-occupied Crimea's largest internet providers were targeted by intense cyberattacks.

July

In July 2024, Ukrainian intelligence services reportedly launched a major cyberattack against several Russian technology-based sectors. The attacks started on July 15, when HUR cyber-specialists worked with a community of hackers to target roughly one hundred Russian web resources to erase their internal data, picked based on their involvement with Russian agencies involved with Russia's invasion of Ukraine. Affected webpages were shut down and replaced with a picture of a bloody, decapitated pig head colored with Russia's flag next to an axe bearing the flag of Ukraine, with the phrase "404 Russia not found" listed.

A larger operation was initiated on July 23 by the Main Intelligence Directorate of Ukraine's Ministry of Defense, which targeted financial institutions it stated were involved in funding military activities against Ukraine. By July 27, the attack's impact became severe and widespread. Customers of several major Russian banks were unable to withdraw cash from ATMs, with credit and debit cards being blocked upon use. The cyberattack affected various aspects of Russia's virtual banking infrastructure, which included freezing of payment systems and mobile banking applications, banking portal outages, and breaches into the databases of several major banks which included Dom.RF, Alfa-Bank, Raiffeisen Bank, VTB Bank, Rosbank, Gazprombank, RSHB Bank, Sberbank, iBank, and Tinkoff Bank. The attacks also targeted public transportation systems, popular Russian social networks and internet platforms, and caused service interruptions for multiple large Russian telecom and internet providers including MegaFon, Tele2, Beeline, and Rostelecom.

A source from the Ukrainian intelligence stated that the attack was "gaining momentum" and implied escalations in attacks.

Russia acknowledged the cyberattacks as being initiated by "politically motivated hackers".

See also

• List of cyberattacks
• 2022 Ukraine cyberattacks
• 2017 Ukraine ransomware attacks
• 2016 Kyiv cyberattack
• Ukraine power grid hack