Weaponized Cybercrime: What Organizations can Learn from the Conflict in Ukraine

Russia launched a full-scale military invasion of Ukraine with attacks on land, sea, air.  What has been less visible but nonetheless a critical element of the conflict is the battle being waged in cyberspace.  Just like the military conflict with its wider consequences in terms of disruption to trade and the tragedy of the refugee crisis, the war in cyberspace has an impact beyond the borders of Ukraine and Russia. While no one can predict how long this war will last, we can say for certain that the cyber aspects of the conflict in Ukraine will continue to resonate long after the guns have been silenced, as highlighted in Check Point’s Mid-Year Security Report 2022.

So, what does the conflict teach us about cyberwarfare and how can organizations prepare themselves for this new world order?

A new era of cyberwarfare

One thing we can take away from what’s happening in Ukraine is that cyberwarfare has become an established component of global conflict both in the propaganda battle as well as in the actual conduct of military operations.  From Distributed Denial of Service (DDoS) attacks and website defacements to destructive critical infrastructure attacks, activity on both sides has escalated dramatically since the initial invasion in February.

Just three days into the conflict in late February, Check Point Research (CPR) noted a 196% increase in cyberattacks on Ukraine’s government and military sector. And these attacks have shown no signs of slowing down in the months since. New figures from CPR reports that between February and August of this year, cyberattacks on Ukraine’s government and military sector more than doubled, increasing by a staggering 112%, while Russia’s same sector decreased by 8%.  While Russia has not completely disconnected from the internet as per previous reports, government and military networks and websites have implemented different measures to limit access to their resources from outside of Russia, which make the execution of some of the attacks more difficult. Indeed, Ukraine has been under constant attack - throughout the conflict, corporate networks have experienced over 1,500 cyberattacks a week on average. This is 25% higher than before the conflict, versus 1,434 weekly cyberattacks on Russia corporate networks.

Russian operations, in particular, have focused on a campaign of disruption and destruction, with government and state-sponsored APT groups conducting sophisticated operations that have ranged from critical infrastructure attacks to espionage missions. For the first time, we've also seen coordination between cyberattacks and kinetic military assaults. One notable example took place on March 1st when a Russian missile assault on Kyiv’s TV tower coincided with a simultaneous cyberattack designed to knock out the city’s broadcasting capabilities.

CPR also reported that the most attacked industry In Russia during the conflict was the finance sector, with an average of more than 2600 attacks per organization every week, an increase of 24% compared to before the conflict. The second most attacked industry during the conflict was Communications, with an average of 1928 weekly attacks per organization (8% decrease). This could possibly be due to a heavier focus on the finance industry having greater activity, due to global sanctions implemented on Russia from government and business organizations outside of Russia. Disrupting this sector will also severely disturb the day-to-day normal activities of its citizens, similar to attacks on the Communications sector, where the majority of services provided online such as calls or internet services would push normal activities into disarray.

CPR also reported that the most attacked industry during the conflict in Ukraine was the finance sector, with an average of 1,841 cyberattacks per organization every week, a decrease of 29% compared to the period before the conflict, followed by the government and military sector, with an average of 1,406 weekly attacks per organization, which also saw the highest increase in weekly cyberattacks with a 112% increase compared to before the conflict, which could be due to increased attacks inflicted on them by factions siding with Russia. Manufacturing was the third heavily attacked sector, with over 400 attacks per organization every week (64% decrease). Like Russia, the finance sector also saw major attacks, probably as an outcome of the various government and individual financial aid received, as well as cybercriminals who were looking to cash in on known donations being sent to Ukraine for the war and refugee efforts. It was not surprising to see the manufacturing sector also being heavily attacked as this is one of their key critical industries for any country to be sustained, with its global wheat exports contributing heavily to Ukraine’s economy. Such disruptions would now not only impact inflows of funds into Ukraine, but negatively impact their exports.

Perhaps the defining aspect of these attacks, however, has been the strength and relative successes of Ukraine's cybern defenses, something that highlights the importance of ongoing operational security

But continued vigilance is just one of the factors at play here. The other notable impact has come from the army of volunteers who have flocked to support Ukraine, and whose involvement might change the face of cybersecurity as we know it.