War in Ukraine: Pulse of Cyber Defense (August, 2022)

 

The State Service of Special Communication and Information Protection of Ukraine: War in Ukraine: Pulse of Cyber Defense – analytics, August, 2022 – 6 MONTHS OF WAR

UKRAINIAN CYBERHUB

The largest since World War II, war on the European continent continues not only on the land and in the air, but also in cyberspace. The State Service of Special Communication and Information Protection of Ukraine is responsible for the standards of cybersecurity in the country and takes an active part in its defense. The lessons of this war are extremely important for enhancing the protection of democratic states attacked by aggressive countries like russia.

In this regard, the SSSCIP initiates making available a public analytical report on the state and means of cyber defense. The SSSCIP CyberHub will make public its data and conclusions that may be used by the global cyber community for their own defense.

During the six months of the war the Computer Emergency Response Team of Ukraine (CERT-UA) under the SSSCIP has detected 1,123 cyberattacks.

Highlights

• The major goal of russian hackers has changed since the beginning of the war. While during the first month (and a month just before the war) cyberattacks had been aimed at communications in order to impair the capacities of the Ukrainian military and government, after the first failures at the front the russian aggressor has focused on inflicting maximum possible damage on the civilian population. Such strategy conforms with the russian army’s approach, which is to destroy civil infrastructure (schools, kindergartens, maternity wards), critical infrastructure, residential buildings and killing defenseless people instead of fighting. Complex attacks require much time for preparation. Therefore, lesser stress from
  “complex” attacks could mean preparation for a new wave.
• Ukraine continues to strengthen cooperation with partners in cyberdefense: the USA, Poland, Slovenia. “Joining efforts with partners have become one of the pillars of successful resistance to the enemy’s cyberattacks. This experience should be shared and it should become the basis for the democratic world’s collective cyberdefense system.”
• Attribution of cyberattacks and search of individuals and organizations responsible for their preparation is a challenge for the entire world. The rf’s attacking groups are divided into three types: 1. military hackers that might be associated with various groups — APT28, Armageddon, etc. 2. certain cybercriminals who joined those rf’s criminal terroristic groups, but who had been attacking, for instance, western financial institutions before that. 3. so-called script kiddies — volunteers uniting on Telegram channels and joining attacks on Ukrainian resources.

More via SSSCIP