Ukraine and Russia seems to be at the moments on both traditional and cyber war. We could call that hybrid warfare. We are at a cyber war. Countless examples exist of damage to infrastructure from hostile acts via computer attacks. Russia’s invasion of Ukraine has been a hybrid war from the start, a mix of conventional military strategy — traditional “boots on the ground” — and a slightly more unconventional, digital or cyberwar. On the morning of February 22, 2022, the world woke to the news that Russia had moved troops into two separatist regions of eastern Ukraine. Russia started to conduct attacks to Ukraine on February 24. Before physical attacks Russia did several cyber attacks towards IT systems in Ukraine.
Here are links to some material on the cyber side of this war:
How the Eastern Europe Conflict Has Polarized Cyberspace
https://blog.checkpoint.com/2022/02/27/how-the-eastern-europe-conflict-polarized-cyberspace/
The war between Russia and Ukraine is advancing. People everywhere are deciding who they will support. The same dynamic happens in the cyberspace. Hacktivists, cybercriminals, white hat researchers or even technology companies are picking a clear side, emboldened to act on behalf of their choices. Historically, Russia has had superiority over Ukraine in the cyberspace. And last week, Ukraine was attacked by destructive wiping malware. However, the situation is starting to change, as most of the non-nation cyber state actors are taking the side of Ukraine. To defend itself, the Ukrainian government has created an international IT army of hacktivists.
As war escalates in Europe, it’s ‘shields up’ for the cybersecurity industry
https://techcrunch.com/2022/03/02/as-war-escalates-in-europe-its-shields-up-for-the-cybersecurity-industry/
In unprecedented times, even government bureaucracy moves quickly. As a result of the heightened likelihood of cyberthreat from Russian malactor groups, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) — part of the Department of Homeland Security — issued an unprecedented warning recommending that “all organizations — regardless of size — adopt a heightened posture when it comes to cybersecurity and protecting their most critical assets.”
Digital technology and the war in Ukraine
https://blogs.microsoft.com/on-the-issues/2022/02/28/ukraine-russia-digital-war-cyberattacks/
All of us who work at Microsoft are following closely the tragic, unlawful and unjustified invasion of Ukraine. This has become both a kinetic and digital war, with horrifying images from across Ukraine as well as less visible cyberattacks on computer networks and internet-based disinformation campaigns. We are fielding a growing number of inquiries about these aspects and our work, and therefore we are putting in one place a short summary about them in this blog. This includes four areas: protecting Ukraine from cyberattacks; protection from state-sponsored disinformation campaigns; support for humanitarian assistance; and the protection of our employees.. Also:
https://threatpost.com/microsoft-ukraine-foxblade-trojan-hours-before-russian-invasion/178702/
Ukraine: Cyberwar creates chaos, ‘it won’t win the war’
https://www.dw.com/en/ukraine-cyberwar-creates-chaos-it-wont-win-the-war/a-60999197
There have been at least 150 cyberattacks in Ukraine since Russia’s invasion. Their effect is mainly psychological, and experts say they won’t decide the war.
Russia’s invasion of Ukraine has been a hybrid war from the start, a mix of conventional military strategy — traditional “boots on the ground” — and a slightly more unconventional, digital or cyberwar.
The global technology company Microsoft has said its Threat Intelligence Center (MSTIC) detected “destructive cyberattacks directed against Ukraine’s digital infrastructure” hours before the first launch of missiles or movement of tanks on February 24.
Those attacks, which Microsoft dubbed FoxBlade, included so-called wipers — malicious software or malware — that make their way inside computer networks and literally wipe the data from all connected devices.
Cybersecurity experts in Germany have said there have been over a hundred cyberattacks, in various forms, since then. But their effect has mainly been psychological.
Why Russia Hasn’t Launched Major Cyber Attacks Since the Invasion of Ukraine
https://time.com/6153902/russia-major-cyber-attacks-invasion-ukraine/
In the relatively short and rapidly evolving history of cyber conflict, perhaps nothing has been established with greater certainty and more widely accepted than the idea that Russia has significant cyber capabilities and isn’t afraid to use them—especially on Ukraine. In 2015, Russian government hackers breached the Ukrainian power grid, leading to widespread outages. In 2017, Russia deployed the notorious NotPetya malware via Ukrainian accounting software and the virus quickly spread across the globe costing businesses billions of dollars in damage and disruption.
As tensions escalated between Russia and Ukraine, many people were expecting the conflict to have significant cyber components.
But as the invasion continues with few signs of any sophisticated cyber conflict, it seems less and less likely that Russia has significant cyber capabilities in reserve, ready to deploy if needed. Instead, it begins to look like Russia’s much vaunted cyber capabilities have been neglected in recent years, in favor of developing less expensive, less effective cyber weapons that cause less widespread damage and are considerably easier to contain and defend against. For instance, many of the cyberattacks directed at Ukraine in the past month have been relatively basic distributed denial-of-service attacks.
Given Russia’s past willingness to deploy cyberattacks with far-reaching, devastating consequences, it would be a mistake to count out their cyber capabilities just because they have so far proven unimpressive. And it’s all but impossible to prove the absence of cyber weapons in a nation’s arsenal. But the longer the conflict goes on without any signs of sophisticated cyber sabotage, the more plausible it becomes that the once formidable Russian hackers are no longer playing a central role in the country’s military operations.
Crowd-sourced attacks present new risk of crisis escalation
https://blog.talosintelligence.com/2022/03/ukraine-update.html
An unpredictable and largely unknown set of actors present a threat to organizations, despite their sometimes unsophisticated techniques.
Customers who are typically focused on top-tier, state-sponsored attacks should remain aware of these highly motivated threat actors, as well. Misattribution of these actors carries the risk of nations escalating an already dangerous conflict in Ukraine. Based on data from our fellow researchers at Cisco Kenna, customers should be most concerned about threat actors exploiting several recently disclosed vulnerabilities, highlighting the importance of consistently updating software and related systems.
Russia, Ukraine and the Danger of a Global Cyberwar
https://www.securityweek.com/russia-ukraine-and-danger-global-cyberwar
On the morning of February 22, 2022, the world woke to the news that Russia had moved troops into two separatist regions of eastern Ukraine. At the time of writing, it is not yet a full invasion of Ukraine, but Russia did conduct attacks on February 24, hitting cities with airstrikes and artillery in what was called a “special military operation” by Russian President Vladamir Putin.
Russia has been waging its own cyberwar against Ukraine for many years.
Since the beginning of 2022, however, it seems that Russian cyber activity against Ukraine has increased. This includes evidence that wiper malware has again disrupted some Ukrainian government networks, and attacks from the FSB-linked Gamaredon have targeted around 5,000 entities, including critical infrastructure and government departments. So far, however, there has not been the same scale of disruption as occurred in 2015, 2016 and 2017.
The purpose of such cyber activity is to weaken critical infrastructure, damage government’s ability to respond to any aggression, and to demoralize the population.
The U.S. has been warning the rest of the world against a potential widening scope of Russian cyber activity, and that cyber defenses generally should be tightened.
“Part of the worry,” said Willett, “is that cyberattacks against Ukraine might bleed over, like NotPetya, to affect other countries and cause wider damage unintentionally. There is some concern that the Russians may intentionally do stuff more widely, but that would probably be in retaliation for something that the U.S. or NATO might do.
This raises the whole question of ‘attribution’. The received belief is it is impossible to do accurate cyber attribution. ““It would be a mistake for any one nation to think it could attack another without being known,” said Willett.That is absolutely wrong,” said Willett.
But accidents happen. The two iconic cyberweapons have been Stuxnet and NotPetya. It is assumed that the U.S. developed Stuxnet (although this has never been admitted). NotPetya has been confidently attributed to the Russian government. Both malwares escaped from their assumed targets into the wider world. This was probably accidental – but similar accidents could lead to wider implications during a period of global geopolitical tension.
On the morning of February 24, 2022, Russian troops invaded Ukraine. This was accompanied by a further increase in cyber activity.
Ukraine Digital Army Brews Cyberattacks, Intel and Infowar
https://www.securityweek.com/ukraine-digital-army-brews-cyberattacks-intel-and-infowar
Formed in a fury to counter Russia’s blitzkrieg attack, Ukraine’s hundreds-strong volunteer “hacker” corps is much more than a paramilitary cyberattack force in Europe’s first major war of the internet age. It is crucial to information combat and to crowdsourcing intelligence.
Inventions of the volunteer hackers range from software tools that let smartphone and computer owners anywhere participate in distributed denial-of-service attacks on official Russian websites to bots on the Telegram messaging platform that block disinformation, let people report Russian troop locations and offer instructions on assembling Molotov cocktails and basic first aid.
The movement is global, drawing on IT professionals in the Ukrainian diaspora whose handiwork includes web defacements with antiwar messaging and graphic images of death and destruction in the hopes of mobilizing Russians against the invasion.
The cyber volunteers’ effectiveness is difficult to gauge. Russian government websites have been repeatedly knocked offline, if briefly, by the DDoS attacks, but generally weather them with countermeasures.
It’s impossible to say how much of the disruption — including more damaging hacks — is caused by freelancers working independently of but in solidarity with Ukrainian hackers.
A tool called “Liberator” lets anyone in the world with a digital device become part of a DDoS attack network, or botnet. The tool’s programmers code in new targets as priorities change.
Ukraine Cyber Official: We Only Attack Military Targets
https://www.securityweek.com/ukraine-cyber-official-we-only-attack-military-targets
A top Ukrainian cybersecurity official said Friday a volunteer army of hundreds of hackers enlisted to fight Russia in cyberspace is attacking only what it deems military targets, prioritizing government services including the financial sector, Kremlin-controlled media and railways.
Victor Zhora, deputy chair of the state special communications service, also said that there had been about 10 hostile hijackings of local government websites in Ukraine to spread false text propaganda saying his government had capitulated. He said most of Ukraine’s telecommunications and internet were fully operational.
Zhora told reporters in a teleconference that presumed Russian hackers continued to try to spread destructive malware in targeted email attacks on Ukrainian officials and — in what he considers a new tactic — trying to infect the devices of individual citizens.
Army of Cyber Hackers Rise Up to Back Ukraine
https://www.securityweek.com/army-cyber-hackers-rise-back-ukraine
An army of volunteer hackers is rising up in cyberspace to defend Ukraine, though internet specialists are calling on geeks and other “hacktivists” to stay out of a potentially very dangerous computer war.
According to Livia Tibirna, an analyst at cyber security firm Sekoia, nearly 260,000 people have joined the “IT Army” of volunteer hackers, which was set up at the initiative of Ukraine’s digital minister Mykhailo Fedorov.
The group, which can be accessed via the encrypted messaging service Telegram, has a list of potential targets in Russia, companies and institutions, for the hackers to target.
It’s difficult to judge the effect the cyber-army is having.
Russia Releases List of IPs, Domains Attacking Its Infrastructure with DDoS Attacks
https://thehackernews.com/2022/03/russia-releases-list-of-ips-domains.html
Russia Blocks Access to Facebook Over War
https://www.securityweek.com/russia-blocks-access-facebook-over-war
Russia’s state communications watchdog has ordered to completely block access to Facebook in Russia amid the tensions over the war in Ukraine.
The agency, Roskomnadzor, said Friday it decided to cut access to Facebook over its alleged “discrimination” of the Russian media and state information resources. It said the restrictions introduced by Facebook owner Meta on the RT and other state-controlled media violate the Russian law.
Cyberattack Knocks Thousands Offline in Europe
https://www.securityweek.com/cyberattack-knocks-thousands-offline-europe
Thousands of internet users across Europe have been thrown offline after what sources said Friday was a likely cyberattack at the beginning of Russia’s offensive in Ukraine.
According to Orange, “nearly 9,000 subscribers” of a satellite internet service provided by its subsidiary Nordnet in France are without internet following a “cyber event” on February 24 at Viasat, a US satellite operator of which it is a client.
Eutelsat, the parent company of the bigblu satellite internet service, also confirmed to AFP on Friday that around one-third of bigblu’s 40,000 subscribers in Europe, in Germany, France, Hungary, Greece, Italy and Poland, were affected by the outage on Viasat.
In the US, Viasat said on Wednesday that a “cyber event” had caused a “partial network outage” for customers “in Ukraine and elsewhere” in Europe who rely on its KA-SAT satellite.
Viasat gave no further details, saying only that “police and state partners” had been notified and were “assisting” with investigations.
General Michel Friedling, head of France’s Space Command said there had been a cyberattack.
Cybercriminals Seek to Profit From Russia-Ukraine Conflict
https://www.securityweek.com/cybercriminals-seek-profit-russia-ukraine-conflict
Dark web threat actors are looking to take advantage of the tensions between Russia and Ukraine, offering network access and databases that could be relevant to those involved in the conflict, according to a new report from Accenture.
Since mid-January, cybercriminals have started to advertise compromised assets relevant to the Russia-Ukraine conflict, and they are expected to increase their offering of databases and network access, with potentially crippling effects for the targeted organizations.
Just over a month ago, soon after the destructive WhisperGate attacks on multiple government, IT, and non-profit organizations in Ukraine, threat actors started to advertise on the dark web access to both breached networks and databases that allegedly contained personally identifiable information (PII).
Amid Russian invasion, Ukraine granted formal role with NATO cyber hub https://therecord.media/amid-russian-invasion-ukraine-granted-formal-role-with-nato-cyber-hub/
Ukraine was granted the formal role of “contributing participant” to the hub, known as the Cooperative Cyber Defence Centre of Excellence (CCDCOE), by its 27-member steering committee, the organization announced. “Ukraine’s presence in the Centre will enhance the exchange of cyber expertise, between Ukraine and CCDCOE member nations, ” Col.
Jaak Tarien, the institution’s director, said in a statement.
This Ukrainian cyber firm is offering hackers bounties for taking down Russian sites https://therecord.media/this-ukrainian-cyber-firm-is-offering-hackers-bounties-for-taking-down-russian-sites/
In the days following Russia’s invasion of Ukraine, dozens of hacking groups have taken sides in the conflict, launching attacks on various organizations and government institutions. Cyber Unit Technologies, a Kyiv-based cybersecurity startup, has been particularly outspoken on Tuesday, the company started a campaign to reward hackers for taking down Russian websites and pledged an initial $100, 000 to the program.
High Above Ukraine, Satellites Get Embroiled in the War
https://www.wired.com/story/ukraine-russia-satellites/
While the Russian invasion rages on the ground, companies that operate data-collecting satellites find themselves in an awkward position.
Some researchers are worried that the reliance on satellite imagery has given too much power to the companies that control this technology. “There’s companies like Maxar and Planet that are privately owned and they have the final say on whether or not they want to share the information, ” says Anuradha Damale. The role of private companies in conflicts such as Ukraine means commercial satellites could become targets. In the days before Russia invaded, US space officials warned satellite companies that the conflict could extend into space.
CISA Releases Advisory on Destructive Malware Targeting Organizations in Ukraine https://www.cisa.gov/uscert/ncas/current-activity/2022/02/26/cisa-releases-advisory-destructive-malware-targeting-organizations
CISA and the Federal Bureau of Investigation have released an advisory on destructive malware targeting organizations in Ukraine. The advisory also provides recommendations and strategies to prepare for and respond to destructive malware. Additionally, CISA has created a new Shields Up Technical Guidance webpage that details other malicious cyber activity affecting Ukraine. The webpage includes technical resources from partners to assist organizations against these threats.
Alert: https://www.cisa.gov/uscert/ncas/alerts/aa22-057a
US firms should be wary of destructive malware unleashed on Ukraine, FBI and CISA warn – CNNPolitics
https://www.cnn.com/2022/02/26/politics/ukraine-malware-warning-cybersecurity-fbi-cisa/index.html
EU Activates Cyber Rapid Response Team Amid Ukraine Crisis
https://www.bankinfosecurity.com/eu-activates-cyber-rapid-response-team-amid-ukraine-crisis-a-18584
Amid rapid escalation in the Russia-Ukraine conflict derived from historical grievances and qualms with Ukraine’s plan to join the military alliance NATO, the world’s network defenders remain on high alert. And on Tuesday, the European Union confirmed that it will activate its elite cybersecurity team to assist Ukrainians if Russian cyberattacks occur.
UK alludes to retaliatory cyber-attacks on Russia
https://therecord.media/uk-alludes-to-retaliatory-cyber-attacks-on-russia/
The UK government alluded yesterday that it might launch offensive cyber operations against Russia if the Kremlin attacks UK computer systems after an invasion of Ukraine.
Amazon: Charities, aid orgs in Ukraine attacked with malware
https://www.bleepingcomputer.com/news/security/amazon-charities-aid-orgs-in-ukraine-attacked-with-malware/
Charities and non-governmental organizations (NGOs) providing critical support in Ukraine are targeted in malware attacks aiming to disrupt their operations and relief efforts seeking to assist those affected by Russia’s war. Amazon has detected these attacks while working with the employees of NGOs, charities, and aid organizations, including UNICEF, UNHCR, World Food Program, Red Cross, Polska Akcja Humanitarna, and Save the Children.
Ransomware Used as Decoy in Destructive Cyberattacks on Ukraine
https://www.securityweek.com/ransomware-used-decoy-destructive-cyberattacks-ukraine
Destructive ‘HermeticWiper’ Malware Targets Computers in Ukraine
https://www.securityweek.com/destructive-hermeticwiper-malware-targets-computers-ukraine
Just as Russia was preparing to launch an invasion of Ukraine, Ukrainian government websites were disrupted by DDoS attacks and cybersecurity firms reported seeing what appeared to be a new piece of malware on hundreds of devices in the country.
The new malware, dubbed “HermeticWiper” by the cybersecurity community, is designed to erase infected Windows devices. The name references a digital certificate used to sign a malware sample — the certificate was issued to a Cyprus-based company called Hermetica Digital.
“At this time, we haven’t seen any legitimate files signed with this certificate. It’s possible that the attackers used a shell company or appropriated a defunct company to issue this digital certificate,” explained endpoint security firm SentinelOne, whose researchers have been analyzing the new malware.
The malware has also been analyzed by researchers at ESET and Symantec. Each of the companies has shared indicators of compromise (IoCs) associated with HermeticWiper.
ESET first spotted HermeticWiper on Wednesday afternoon (Ukraine time) and the company said hundreds of computers in Ukraine had been compromised.
HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack/
On February 23rd, the threat intelligence community began observing a new wiper malware sample circulating in Ukrainian organizations. Our analysis shows a signed driver is being used to deploy a wiper that targets Windows devices, manipulating the MBR resulting in subsequent boot failure. This blog includes the technical details of the wiper, dubbed HermeticWiper, and includes IOCs to allow organizations to stay protected from this attack. This sample is actively being used against Ukrainian organizations, and this blog will be updated as more information becomes available. Also:
https://www.welivesecurity.com/2022/02/24/hermeticwiper-new-data-wiping-malware-hits-ukraine/
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia
https://www.bleepingcomputer.com/news/security/new-data-wiping-malware-used-in-destructive-attacks-on-ukraine/
HermeticWiper: A detailed analysis of the destructive malware that targeted Ukraine https://blog.malwarebytes.com/threat-intelligence/2022/03/hermeticwiper-a-detailed-analysis-of-the-destructive-malware-that-targeted-ukraine/
The day before the invasion of Ukraine by Russian forces on February 24, a new data wiper was unleashed against a number of Ukrainian entities. This malware was given the name “HermeticWiper” based on a stolen digital certificate from a company called Hermetica Digital Ltd. This wiper is remarkable for its ability to bypass Windows security features and gain write access to many low-level data-structures on the disk. In addition, the attackers wanted to fragment files on disk and overwrite them to make recovery almost impossible.
In Ukraine, Online Gig Workers Keep Coding Through the War
https://www.wired.com/story/gig-work-in-ukraine/
Freelancers or gig workers who piece together work on online platforms are a hidden engine of the Ukrainian economyand the world’s. They work as software engineers, project managers, IT technicians, graphic designers, editors, and copywriters. And they work for everyone.
Invading Russian forces have plunged freelancers’ home offices into chaos and uncertainty. Vlad, a video editor in southern Ukraine, says he’s grown accustomed to the air alarm signal, and hiding until it has passed. Now there are battles 30 miles from his home. “But as long as there is water, electricity, and internet, I can work, ” he says.
“Because we all need to live for something, eat
Leaving Russia? Experts Say Wipe Your Phone Before You Go
https://www.forbes.com/sites/thomasbrewster/2022/03/04/russians-escaping-putins-repression-urged-to-wipe-their-phones/
Russians fleeing President Vladimir Putin’s regime as it cracks down on anti-war sentimentand rumors of martial law grow louderare being advised to wipe their phones, especially of any traces of support for Ukraine. If they don’t, experts say they may face detention. They’re starting by deleting messages on Signal, Telegram or any app that promises security. For those leaving the country, they’re deleting the apps themselves, and urging others to do the same. Russian media has first-hand accounts of lengthy interrogations at the border, along with phone and laptop searches, though Forbes could not corroborate those claims.
Why ICANN Won’t Revoke Russian Internet Domains
The organization says cutting the country off would have “devastating” effects on the global internet system.
https://www.wired.com/story/why-icann-wont-revoke-russian-internet-domains/#intcid=_wired-bottom-recirc_8e802014-a05f-48c5-89e8-9dad931361ad_text2vec1-reranked-by-vidi
Ukraine on Monday asked ICANN to revoke Russian top-level domains such as .ru, .рф, and .su; to “contribute to the revoking for SSL certificates” of those domains; and to shut down DNS root servers in Russia. Fedorov argued that the requested “measures will help users seek for reliable information in alternative domain zones, preventing propaganda and disinformation.”
Ukraine’s request to cut Russia off from core parts of the internet has been rejected by the nonprofit group that oversees the Internet’s Domain Name System (DNS). CEO Göran Marby of the Internet Corporation for Assigned Names and Numbers (ICANN) said the group must “maintain neutrality and act in support of the global internet.”
“Our mission does not extend to taking punitive actions, issuing sanctions, or restricting access against segments of the internet—regardless of the provocations,” Marby wrote in his response to Ukraine Vice Prime Minister Mykhailo Fedorov.
https://www.icann.org/en/system/files/correspondence/marby-to-fedorov-02mar22-en.pdf
TikTok Was Designed for War
As Russia’s invasion of Ukraine plays out online, the platform’s design and algorithm prove ideal for the messiness of war—but a nightmare for the truth.
https://www.wired.com/story/ukraine-russia-war-tiktok/#intcid=_wired-bottom-recirc_8e802014-a05f-48c5-89e8-9dad931361ad_text2vec1-reranked-by-vidi
1,795 Comments
Tomi Engdahl says:
https://www.atlanticcouncil.org/blogs/ukrainealert/putin-believed-his-own-propaganda-and-fatally-underestimated-ukraine/?mkt_tok=NjU5LVdaWC0wNzUAAAGF5ZnjDI5qSE6vd2Eotux_XSfcz0tEWFTssgagBR0D5mjyyy_MRc2C33XTChduKi2UrGFqlMKiSYNARszRcswmANSAUchac1n7AEcsNtK_ZQ
Tomi Engdahl says:
The Fall and Rise of Russian Electronic Warfare The Ukraine invasion has become an old-fashioned slog, enabling Russia to unleash its electronic weapons
https://spectrum.ieee.org/the-fall-and-rise-of-russian-electronic-warfare
Tomi Engdahl says:
Näin Venäjä levittää propagandaa Ukrainalta miehittämillään alueilla: uhkailee toimittajia, vaihtaa koulukirjoja ja ammentaa neuvostohistoriasta
Miehitetystä kaupungista paennut toimittaja, mediatutkija ja Venäjän turvallisuuspalvelun asiakirjat kertovat, kuinka Venäjä pyrkii vaihtamaan Ukrainassa totuuden toiseksi.
https://yle.fi/uutiset/3-12529532
Tomi Engdahl says:
https://www.apu.fi/artikkelit/pekka-sauri-ukrainan-sota-ei-ole-ohi-pidetaan-liput-liehumassa
Tomi Engdahl says:
Refrigerator and dishwasher semiconductors drive RWS of Russian tanks
https://bulgarianmilitary.com/2022/07/31/refrigerator-and-dishwasher-semiconductors-drive-rws-of-russian-tanks/
SOFIA ($1=1.91 Bulgarian Levs) — Semiconductors from refrigerators and dishwashers brought as “spoils” from the war in Ukraine control the remote weapon systems of Russian tanks. Such a statement was made by US Commerce Secretary Gina Raimondo in a statement to the Senate nearly two months ago. “We have reports from Ukrainians that when they find Russian military equipment, it’s full of semiconductors that they took out of dishwashers and refrigerators,” Raimondo told a Senate hearing.
Robin Patterson, a spokesman for the Commerce Department, said Ukrainian authorities told Raimondo that when they opened up captured Russian tanks, they found components intended for refrigerators and commercial and industrial machinery. Semiconductors, telecommunications equipment, lasers, avionics, and marine technology are subject to Russian export controls.
Since the beginning of the war in Ukraine, social media has been full of photos of Russian soldiers burdening household appliances. A part of the “spoils of war” goes to the homes of Russian soldiers, others appear to the Uralvagonzavod for “reuse”.
Tomi Engdahl says:
Hakkerit kyykyttävät itänaapurin ”paperista” kyberpuolustusta – näin Anonymous ”nolasi” Venäjän https://www.is.fi/digitoday/tietoturva/art-2000008977622.html
Tomi Engdahl says:
https://www.verkkouutiset.fi/a/venaja-syyttaa-yhdysvaltoja-suorasta-osallistumisesta-sotaan/#d3bb9eba
Tomi Engdahl says:
Ukraine war: Russia accuses US of direct role in Ukraine war
https://www.bbc.com/news/world-europe-62389537
Tomi Engdahl says:
https://www.suomenuutiset.fi/usan-senaatti-vaatii-venajan-julistamista-terroristivaltioksi-mitka-olisivat-sen-seuraukset/
Tomi Engdahl says:
Putin on laatinut itselleen pakosuunnitelman sodan häviämisen varalta, sanoo kovista väitteistään tunnettu Telegram-kanava
https://www.aamuposti.fi/uutissuomalainen/4758707
Vladimir Putin ‘preparing plans for evacuation’ if Ukraine overcomes his troops in war that has lasted 162 days so far
https://www.skynews.com.au/world-news/vladimir-putin-preparing-plans-for-evacuation-if-ukraine-overcomes-his-troops-in-war-that-has-lasted-162-days-so-far/news-story/7c098576968f205292763fe4cbe84052
The Russian President and close allies are reportedly putting plans in place, with one country in mind it will evacuate to, should Ukrainian soldiers defeat Russian troops in the war.
Tomi Engdahl says:
Movie torrents hijacked to send tips on bypassing Russian censorship
https://www.bleepingcomputer.com/news/technology/movie-torrents-hijacked-to-send-tips-on-bypassing-russian-censorship/
A team of Ukrainian cyber-activists has thought of a simple yet potentially effective way to spread uncensored information in Russia: bundling torrents with text and video files pretending to include installation instructions.
Named “Torrents of Truth,” the initiative is similar to “Call Russia,” a project to help break through Russian propaganda and open people’s eyes to what’s happening in Ukraine.
The initiative creates torrents that contain a text file with a list of credible news sources that Russians can trust and instructions on downloading and installing a VPN to secure anonymity from ISPs.
Tomi Engdahl says:
https://www.verkkouutiset.fi/a/jarno-limnell-lannen-ylitettava-punaisia-linjoja/#4ff9bf02
Tomi Engdahl says:
https://www.suomenuutiset.fi/paunio-vihreiden-50-vuotinen-sota-energiaa-vastaan-saa-kauhean-loppunaytoksensa-ensi-talvena/
Tomi Engdahl says:
Ukraine Situation Report: U.S. Sending More Rockets As HIMARS Achieves ‘Rock Star’ Status
U.S.-supplied rocket artillery systems gain a cult pop-culture following in Ukraine as they are used to pound Russian positions.
https://www.thedrive.com/the-war-zone/ukraine-situation-report-u-s-sending-more-rockets-as-himars-achieves-rock-star-status
Tomi Engdahl says:
https://www.bleepingcomputer.com/news/security/ukraine-takes-down-1-000-000-bots-used-for-disinformation/
Tomi Engdahl says:
Varoitus Venäjältä – ”Pitkittynyt sota kääntyy meitä vastaan”
https://www.verkkouutiset.fi/a/varoitus-venajalta-pitkittynyt-sota-kaantyy-meita-vastaan/#9abb33b0
Tomi Engdahl says:
Sähkökriisi uhkaa Eurooppaa – Ranska joutunut sulkemaan jopa parikymmentä ydinvoimalaansa
Tuula Laatikainen31.7.202213:45
Ranskan ydinvoimaloiden turvallista toimintaa hankaloittaa nyt korroosio.
https://www.tekniikkatalous.fi/uutiset/sahkokriisi-uhkaa-eurooppaa-ranska-joutunut-sulkemaan-jopa-parikymmenta-ydinvoimalaansa/27af24d5-0635-4344-88e2-294892a23592#Echobox=1659265838
Tomi Engdahl says:
Euroopan suurin ydinvoimala Ukrainassa on vaurioitunut pahasti tulituksessa, kertoo voimalan käytöstä vastaava yhtiö https://www.is.fi/ulkomaat/art-2000008989045.html
Tomi Engdahl says:
Sotatieteiden tohtorilta karu arvio Ukrainasta: Todella synkkä käänne
Ukrainan tilannetta Uuden Suomen blogissaan arvioivan sotatieteiden tohtorin Jarno Limnéllin mukaan Venäjän hyökkäyssota Ukrainassa on kääntynyt kansanmurhaksi, joka tähtää ukrainalaisten kansallisen identiteetin hävittämiseen.
https://www.iltalehti.fi/ulkomaat/a/65811db3-d806-469e-8539-ed35d92ed577
Tomi Engdahl says:
Venäjältä 360 miljoonan sakot Googlelle vaatii yhtiötä piilottamaan “erikoisoperaatioon” liittyvän sisällön https://www.is.fi/digitoday/art-2000008954215.html
VENÄLÄINEN tuomioistuin on määrännyt 21 miljardin ruplan eli noin 360 miljoonan euron suuruiset sakot teknologiajätti Googlelle.
Tiedotusvälineitä Venäjällä valvovan Roskomnadzorin mukaan Google ja sen alaisuudessa toimiva YouTube eivät ole suostuneet poistamaan alustoiltaan “kiellettyä materiaalia”. Käytännössä tämä tarkoittaa kaikkea Kremlin vastaista informaatiota ja etenkin sellaista, joka käsittelee Venäjän hyökkäyssotaa Ukrainassa. Viranomainen vaatii Googlea poistamaan alustoiltaan kaiken sellaisen materiaalin, joka käsittelee Venäjän “erikoisoperaatiota”, tukee “terrorismia ja ääriliikkeitä”, mainostaa “alaikäisten hengelle ja terveydelle vaarallisia aiheita” tai mainostaa “kiellettyihin joukkotapahtumiin osallistumista”.
Tomi Engdahl says:
Venäläinen haittaohjelma leviää “Tavoitteena tietojen varastaminen Venäjän tiedustelupalvelulle”
https://www.iltalehti.fi/tietoturva/a/08d6d001-043d-4415-8fae-90ab209c2206
Tietoturvayhtiö Palo Alto Networks kertoo tiedotteessaan venäläisryhmä Cloaked Ursan hyökkäyksistä, joiden tavoitteena on ollut luultavasti tietojen varastaminen Venäjän tiedustelupalvelun käyttöön. Palo Alto Networks kertoo, että naamioitu tunkeutumisyritys on kohdistanut hyökkäyksensä Google Drive- ja DropBox-pilvipalveluihin. Näihin palveluihin on yritetty tunkeutua Cobalt Strike -ohjelmistoa hyödyntämällä. Yhtiön tiedotteessa kerrotaan, että tunkeutumisyritykset ovat kohdistuneet esimerkiksi Portugalissa ja Brasiliassa sijaitseviin eri maiden suurlähetystöihin. Hyökkäyksessä on pyritty kalastelemaan tietoja valheellisella tapahtumakutsulla, jossa on käytetty haitallista HTML-tiedostoa. Jos kohde avaa tiedoston, mahdollistaa se Cobalt Strike -ohjelmiston käytön saastuttajana ja sallii hyökkääjälle pääsyn tietoihin. Erityisen vaaralliseksi hyökkäysyrityksen tekee sen kyky naamioitua suojausohjelmistolta. Erityisesti Venäjän tiedustelupalvelun kohteena näissä hyökkäyksissä ovat olleet Nato-maiden suurlähetystöt ja näiden käyttämät pilvipalvelut, tiedotteessa kerrotaan. Alkup.
https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/
Tomi Engdahl says:
Google catches Turla hackers deploying Android malware in Ukraine https://www.bleepingcomputer.com/news/security/google-catches-turla-hackers-deploying-android-malware-in-ukraine/
Google’s Threat Analysis Group (TAG), whose primary goal is to defend Google users from state-sponsored attacks, said today that Russian-backed threat groups are still focusing their attacks on Ukrainian organizations. In a report regarding recent cyber activity in Eastern Europe, Google TAG security engineer Billy Leonard revealed that hackers part of the Turla Russian APT group have also been spotted deploying their first Android malware. They camouflaged it as a DDoS attack tool and hosted it on cyberazov[.]com, a domain spoofing the Ukrainian Azov Regiment. “This is the first known instance of Turla distributing Android-related malware. The apps were not distributed through the Google Play Store, but hosted on a domain controlled by the actor and disseminated via links on third party messaging services, ” Leonard explained.
Tomi Engdahl says:
Popular vehicle GPS tracker gives hackers admin privileges over SMS https://www.bleepingcomputer.com/news/security/popular-vehicle-gps-tracker-gives-hackers-admin-privileges-over-sms/
Vulnerability researchers have found security issues in a GPS tracker that is advertised as being present in about 1.5 million vehicles in
169 countries. A total of six vulnerabilities affect the MiCODUS MV720 device, which is present in vehicles used by several Fortune 50 firms, governments in Europe, states in the U.S., a military agency in South America, and a nuclear plant operator. The risks stemming from the findings are significant and impact both privacy and security. A hacker compromising an MV720 device could use it for tracking or even immobilizing the vehicle carrying it, or to collect information about the routes, and manipulate data. For example, MiCODUS GPS trackers are used by the state-owned Ukrainian transportation agency, so Russian hackers could target them to determine supply routes, troop movements, or patrol routes, researchers at cybersecurity company BitSight say in a report today.
Tomi Engdahl says:
Inside The Russian Cybergang Thought To Be Attacking Ukraine – The Trickbot Leaks
https://www.forbes.com/sites/daveywinder/2022/07/15/inside-the-russian-cybergang-thought-to-be-attacking-ukraine-the-trickbot-leaks/?sh=23b2648576a8
Threat intelligence specialist Cyjax has today published an in-depth analysis delving deep into the heart of the Trickbot cybergang. Months of painstaking research through hundreds of leaked documents has resulted in what is possibly the most comprehensive breakdown of a significant international cybercrime syndicate I’ve seen. Covering everything from membership and management to operational infrastructure, these are the Trickbot Leaks.
https://www.cyjax.com/2022/07/15/who-is-trickbot/
Tomi Engdahl says:
Meet Mantis the tiny shrimp that launched 3, 000 DDoS attacks https://www.theregister.com/2022/07/15/mantis_botnet_ddos_attack/
The botnet behind the largest-ever HTTPS-based distributed-denial-of-service (DDoS) attack has been named after a tiny shrimp. Likewise, the Mantis botnet operates a small fleet of bots (a little over 5, 000), but uses them to cause massive damage specifically, a record-breaking attack.
Tomi Engdahl says:
Anti-Russian denial-of-service app actually infects pro-Ukrainian activists https://www.bitdefender.com/blog/hotforsecurity/anti-russian-denial-of-service-app-actually-infects-pro-ukrainian-activists/
An app which purported to launch distributed denial-of-service (DDoS) attacks against the internet infrastructure of Russia, was in reality secretly installing malware on to the devices of pro-Ukrainian activists. As researchers at Google’s Threat Analysis Group (TAG) describe, the Moscow-backed Turla hacking group created a website purporting to belong to Ukraine’s Azov regiment.
Tomi Engdahl says:
EU warns of Russian cyberattack spillover, escalation risks https://www.bleepingcomputer.com/news/security/eu-warns-of-russian-cyberattack-spillover-escalation-risks/
The Council of the European Union (EU) said today that Russian hackers and hacker groups increasingly attacking “essential” organizations worldwide could lead to spillover risks and potential escalation.
“This increase in malicious cyber activities, in the context of the war against Ukraine, creates unacceptable risks of spillover effects, misinterpretation and possible escalation, ” the High Representative on behalf of the EU said Tuesday. “The latest distributed denial-of-service (DDoS) attacks against several EU Member States and partners claimed by pro-Russian hacker groups are yet another example of the heightened and tense cyber threat landscape that EU and its Member States have observed.”
Tomi Engdahl says:
Cyber Command shares bevy of new malware used against Ukraine https://therecord.media/cyber-command-shares-bevy-of-new-malware-used-against-ukraine/
U.S. Cyber Command on Wednesday disclosed dozens of forms of malware that have been used against computer networks in Ukraine, including 20 never-before-seen samples of malicious code. The indicators of compromise were shared with the command’s Cyber National Mission Force
(CNMF) by the Security Service of Ukraine, that country’s law enforcement authority and intelligence agency. The disclosure is part of what has become a regular effort by Cyber Command and other U.S.
agencies to highlight hacking tools used by foreign adversaries like Russia, China, Iran and North Korea to blunt the impact of their digital operations.
Tomi Engdahl says:
Vulnerabilities in GPS tracker could have “life-threatening”
implications
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2022/07/vulnerabilities-in-gps-tracker-could-have-life-threatening-implications/
Researchers at BitSight have discovered six vulnerabilities in the MiCODUS MV720 GPS tracker, a popular vehicle tracking device.
Exploiting these vulnerabilities could potentially put drivers in danger and disrupt supply chains. In fact, there are many possible scenarios which could result in loss of life, property damage, privacy intrusions, and threaten national security.
Tomi Engdahl says:
Ukrainian Radio Stations Hacked to Broadcast Fake News About Zelenskyy’s Health https://thehackernews.com/2022/07/ukrainian-radio-stations-hacked-to.html
Ukrainian radio operator TAVR Media on Thursday became the latest victim of a cyberattack, resulting in the broadcast of a fake message that President Volodymyr Zelenskyy was seriously ill. “Cybercriminals spread information that the President of Ukraine, Volodymyr Zelenskyy, is allegedly in intensive care, and his duties are performed by the Chairman of the Verkhovna Rada, Ruslan Stefanchuk, ” the State Service of Special Communications and Information Protection of Ukraine
(SSSCIP) said in an update.
Tomi Engdahl says:
Näin Anonymous nolasi Venäjän Pelätty puolustusmuuri onkin vain “paperiripustus”
https://www.kauppalehti.fi/uutiset/nain-anonymous-nolasi-venajan-pelatty-puolustusmuuri-onkin-vain-paperiripustus/1d4c125a-0b2c-468b-a1ee-129136b12ce6
Kyberturvallisuusfirma Security Discoveryn perustajajäsen Jeremiah Fowler on pitänyt silmällä Anonymous-hakkerikollektiivin toimintaa ryhmän julistettua Venäjälle kybersodan maan hyökättyä laittomasti Ukrainaan.
Tomi Engdahl says:
Venäjän hyökkäys Ukrainaan muutti kyberympäristöä dramaattisesti Tilanne tulee pahenemaan
https://www.tivi.fi/uutiset/tv/c01f2995-41ea-4c8e-86b4-4433b0846cc3
Ukrainan sota on muuttanut kyberympäristöä dramaattisesti ja hyökkäykset ovat lisääntyneet valtavasti organisaatioissa kaikilla sektoreilla, kertoo tietoturvayhtiö Check Pointin uusi trendiraportti.
Hyökkäykset aiheuttavat myös huomattavaa haittaa jokapäiväiselle elämälle. Yrityksiä uhkaavat eniten kiristyshyökkäykset, mutta myös pilvessä tehtävät toimitusketjuhyökkäykset ovat lisääntymässä.
Valitettavasti tilanne tulee vain pahenemaan, varsinkin kun kiristysohjelmat ovat nyt organisaatioiden ykkösuhka Check Point Softwaren varatutkimusjohtaja Maya Horowitz sanoo tiedotteessa.
Tomi Engdahl says:
How one Ukrainian ethical hacker is training cyber warriors’ in the fight against Russia https://therecord.media/how-one-ukrainian-ethical-hacker-is-training-cyber-warriors-in-the-fight-against-russia/
In the Ukrainian hacker community, Nikita Knysh is a household name.
The 31-year-old former employee of Ukraine’s Security Service (SBU) founded cybersecurity consulting company HackControl in 2017 and launched a YouTube channel about internet security and digital literacy. It has about 8, 000 subscribers. When the war broke out in Ukraine, Knysh took up a weapon his computer and began fighting back against Russia in cyberspace. He wasn’t alone: thousands of volunteers were ready to try to hack Russia while its troops were destroying Ukrainian cities and killing people on the ground. “I realized that we should take control of the situation, ” Knysh told The Record. “Our government didn’t have a cyber army’, so we built it ourselves.” To teach Ukrainians the basics of digital guerrilla war, Knysh launched a website called “HackYourMom Academy, ” a guide to hacking. The website is free to use and is available in Ukrainian, Russian and English.
Tomi Engdahl says:
Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign https://blog.malwarebytes.com/threat-intelligence/2022/07/cobalt-strikes-again-uac-0056-continues-to-target-ukraine-in-its-latest-campaign/
The Malwarebytes Threat Intelligence team recently reviewed a series of cyber attacks against Ukraine that we attribute with high confidence to UAC-0056 (AKA UNC2589, TA471). This threat group has repeatedly targeted the government entities in Ukraine via phishing campaigns following the same common tactics, techniques and procedures (TTPs). Lures are based on important matters related to the ongoing war and humanitarian disaster happening in Ukraine. We have been closely monitoring this threat actor and noticed changes in their macro-based documents as well as their final payloads. In this blog, we will connect the dots between different decoy samples that we and others such as Ukraine CERT have observed. We will also share indicators for a previously undocumented campaign performed by the same threat actor at the end of June.
Cobalt Strike Analysis and Tutorial: CS Metadata Encryption and Decryption https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encryption-decryption/
Cobalt Strike is commercial threat emulation software that mimics a quiet, long-term embedded actor in a network. This actor, known as Beacon, communicates with an external team server to emulate command-and-control (C2) traffic. Due to its versatility, Cobalt Strike is commonly used as a legitimate tool by red teams but is also widely used by threat actors for real-world attacks. Different elements of Cobalt Strike contribute to its versatility, including the processes that encrypt and decrypt metadata sent to the C2 server. In a previous blog, “Cobalt Strike Analysis and Tutorial: CS Metadata Encoding and Decoding, ” we learned that the encrypted metadata is encoded for an HTTP transaction. In this blog post, we will detail and demonstrate the data encryption and decryption algorithm, key generation and extraction, metadata encryption and decryption, and metadata schema definitions. One of the interesting components is how the encryption and decryption algorithm works during C2 traffic communication and why this versatility makes Cobalt Strike an effective emulator that is difficult to defend against.
Tomi Engdahl says:
Palvelunestohyökkäys kaatoi eduskunnan verkkosivut, venäläinen hakkeriryhmä kertoo tehneensä hyökkäyksen https://www.hs.fi/politiikka/art-2000008994152.html
Eduskunnan verkkosivut kaatuivat tiistaina iltapäivällä. Puoli viiden aikaan sivuille ei päässyt, mutta noin kello 16.50 eduskunnan sivut vaikuttivat toimivan taas, joskin hitaasti. Venäläinen hakkeriryhmä
NoName057(16) ilmoitti Telegram-kanavallaan tehneensä verkkohyökkäyksen Suomen eduskunnan sivuille, minkä vuoksi sivut eivät toimineet. Eduskunnan tiedotteen mukaan eduskunnan ulkoisia verkkosivuja vastaan kohdistuu palvelunestohyökkäys, joka alkoi noin kello 14.30. Tiedotteen mukaan eduskunta pyrkii rajaamaan hyökkäystä yhdessä palveluntoimittajien ja Kyberturvallisuuskeskuksen kanssa..
Myös: https://yle.fi/uutiset/3-12569629.
https://www.mtvuutiset.fi/artikkeli/eduskunnan-nettisivut-eivat-toimi-venalainen-hakkeriryhma-kertoi-tehneensa-iskun/8485030.
https://www.tivi.fi/uutiset/tv/20561af8-222c-4879-8713-851f0d6d8727.
https://www.ksml.fi/uutissuomalainen/4776577
Tomi Engdahl says:
Venäjälle ei enää myydä komponentteja
https://etn.fi/index.php/13-news/13851-venaejaelle-ei-enaeae-myydae-komponentteja
Euroopan komponenttien jakelumarkkinat kasvoivat puolijohteiden osalta 33,4 prosenttia ja passiivisissa sekä sähkömekaanisissa komponenteissa 19,6 prosenttina vuodentakaiseen verrattuna. DMASS-järjestö kuitenkin arvioi, että loppuvuoden osalta ennusteiden teko on vaikeampaa. Venäjälle komponentteja ei enää myydä.
Pula komponenteista vaikuttaa edelleen Euroopan komponenttien jakeluliiketoiminnassa, mutta niihin liittyy nyt osittaista helpotusta joillakin tuotealueilla. Tästä huolimatta jakelijat myivät huhti-kesäkuussa puolijohteita 3,09 miljardilla eurolla eli kolmanneksen enemmän kuin vuosi sitten. Passiivikomponenteissa myynnin arvo nousi 1,51 miljardiin euroon.
Kaikkiaan jakelijat myivät komponentteja toisella neljänneksellä 4,6 miljardilla eurolla. Summa on 28,5 prosenttia suurempi kuin viime vuonna.
Tomi Engdahl says:
Cyberspying Aimed at Industrial Enterprises in Russia and Ukraine Linked to China
https://www.securityweek.com/cyberspying-aimed-industrial-enterprises-russia-and-ukraine-linked-china
Tomi Engdahl says:
Karu totuus paljastui: Pakotteet pettivät, Venäjää aseistetaan amerikkalaisella teknologialla
Reutersin ja brittiläisen tutkimuslaitoksen julkaiseman raportin mukaan Venäjälle liikkuu yhä hurja määrä amerikkalaisia komponentteja pakotteista huolimatta.
https://www.is.fi/digitoday/art-2000008992093.html
Tomi Engdahl says:
”Totaalinen katastrofi” – Upin Jussi Lassila arvioi, että Amnesty saattoi lahjoittaa Venäjälle syyn siviilien murhiin
Upin Jussi Lassilan mukaan Venäjä voi käyttää raportissa esitettyjä väitteitä hyödykseen.
https://www.iltalehti.fi/ulkomaat/a/2099582d-3e32-486c-a417-17b5dadf65d0
Tomi Engdahl says:
USCYBERCOM Releases IoCs for Malware Targeting Ukraine
https://www.securityweek.com/uscybercom-releases-iocs-malware-targeting-ukraine
The United States Cyber Command (USCYBERCOM) this week released indicators of compromise (IoCs) associated with malware families identified in recent attacks targeting Ukraine.
The malware samples were found by the Security Service of Ukraine on various compromised networks in the country, which has seen an increase in cyber activity since before the beginning of the Russian invasion in February 2022.
USCYBERCOM has released 20 novel indicators in various formats representing IoCs identified during the analysis of recently identified malware samples, but has not shared further information on the attacks.
“Our Ukrainian partners are actively sharing malicious activity they find with us to bolster collective cyber security, just as we are sharing with them. We continue to have a strong partnership in cybersecurity between our two nations,” USCYBERCOM notes.
https://www.cybercom.mil/Media/News/Article/3098856/cyber-national-mission-force-discloses-iocs-from-ukrainian-networks/
Tomi Engdahl says:
Ukrainian Website Threat Landscape Throughout 2022 https://www.wordfence.com/blog/2022/08/ukrainian-website-threat-landscape-throughout-2022/
The Russian invasion of Ukraine began on February 20, 2022. By mid-March it was clear the cyber-war had begun, and the attacks have been consistent ever since. Prior to this, on March 1, 2022, Wordfence reported on an attack campaign on Ukrainian university websites. In response, we deployed our real-time threat intelligence to all sites running Wordfence with a .ua top-level domain (TLD). In the following months, we have continued to monitor the situation, and to block attack attempts aimed at Ukrainian websites.
Tomi Engdahl says:
https://www.verkkouutiset.fi/a/vladimir-putin-ei-ole-venajan-ongelmien-syy-vaan-seuraus/#4ff9bf02
Tomi Engdahl says:
Vai, että “huipputeknologiaa”, kun artikkeli kuitenkin paljastaa, että kyse on esim. samoista mikropiireistä mitä löytyy esim. mikrouuneista ja autoista.
Näiden täydellinen vientikielto Venäjään ei käytännössä onnistu.
Venäjällä yli 20 000 km rajaa ja sen täydellinen valvonta on utopiaa.
Toisekseen miten voisimme valvoa, etteivät venäläiset osta vaikka jääkaappeja, pesukoneita, autoja, mikrouuneja, televisioita, digikameroita, älypuhelimia, kuluttajadroneja yms. mm sen naapurimaista Kazakstanista, Gruusiasta, Azerbaijanista, Mongoliasta tai Kiinasta? Nuo purkamalla saa hyvinkin monenlaisia piirejä.
Toisekseen salakuljetus voi olla hyvin tuottoisaa bisnestä.
Venäläisistä aseista löytyi länsimaisia mikrosiruja — huipputeknologiaa päätyy Venäjälle pakotteista huolimatta
https://yle.fi/uutiset/3-12573707?utm_medium=social&utm_source=facebook-share
Brittiläiset tutkijat löysivät venäläisaseista satoja komponentteja, jotka on valmistettu Yhdysvalloissa, Saksassa, Japanissa ja Sveitsissä. Selvyyttä ei ole siitä, miten komponentit Venäjälle ovat päätyneet.
Venäjän Orlan 10 -tiedustelulennokki käyttää amerikkalaisvalmisteista vakainta.
Tomi Engdahl says:
Venäläislehti: Ukrainan sodan oikeuttamisesta äänesti parlamentti, jota ei valittu laillisesti
Venäjän viimesyksyisissä duumanvaaleissa annettiin yli 17 miljoonaa huijausääntä.
https://suomenkuvalehti.fi/ulkomaat/venalaislehti-ukrainan-sodan-oikeuttamisesta-aanesti-parlamentti-jota-ei-valittu-laillisesti/?shared=1230256-678ee3d0-500
Venäjän viimesyksyisissä duumavaaleissa uurniin tungettiin yli 17 miljoonaa ylimääräistä ääntä, selviää uutissivusto Meduzan tutkimuksesta.
Meduza sai haltuunsa yli miljoona tuntia videonauhaa yli 9200 äänestyspaikalta. Virallisesti ilmoitettujen äänestäjämäärien ja tallenteilla näkyvien äänestäjien ero oli suuri. Kaikkiaan noin kolmasosa otannan äänistä oli väärennettyjä.
Syksyn 2021 vaaleissa presidentti Vladimir Putinin puolue Yhtenäinen Venäjä sai 50 prosenttia äänistä ja enemmistön parlamenttipaikoista.
Valitut 450 duuman jäsentä äänestivät keväällä Venäjän ja Donetskin ja Luhanskin kapinallisalueiden ystävyys, yhteistyö ja avunanto –sopimuksen puolesta. Se ratifioitiin 22. helmikuuta, kaksi päivää ennen kuin Venäjä hyökkäsi Ukrainaan.
Sopimusta käytettiin virallisena oikeutuksena ”erikoisoperaation” toteuttamiseen.
Venäjän vaalien vilpillisyyttä on epäilty, mutta sen laajuutta on ollut hankalaa todentaa.
Videoilla näkyy, miten vaalivirkailijat suojaavat henkilöitä, jotka sullovat uurniin suuren määrän äänestyslappuja. Meduza on tallentanut kaikki videot pilvipalveluun ja ne ovat kaikkien nähtävillä.
Venäläiset ovat aiemmissa vaaleissa voineet katsoa suoraa lähetystä vaalipaikoilta. Valvontakamerat asennettiin mielenosoitusvuonna 2011, kun Putin yritti todistaa, ettei vaalivilppiä tapahdu. Syksyn 2021 vaaleissa live-kuvaa ei välitetty. Syyksi kerrottiin rahapula. Vain ehdokkailla, puolueilla ja vaalikomissiolla oli mahdollisuus katsoa tallenteita.
https://meduza.io/feature/2022/08/12/dogovor-o-druzhbe-s-dnr-i-lnr-prinyatyy-deputatami-gosdumy-dal-start-voyne-no-mnogih-iz-etih-deputatov-poprostu-nikto-ne-vybiral
Tomi Engdahl says:
Russian hackers target Ukraine with default Word template hijacker https://www.bleepingcomputer.com/news/security/russian-hackers-target-ukraine-with-default-word-template-hijacker/
Threat analysts monitoring cyberattacks on Ukraine report that the operations of the notorious Russian state-backed hacking group Gamaredon’ continue to heavily target the war-torn country. According to a report published today by Symantec, a division of Broadcom Software, Gamaredon’s activity continues unabated in the sixth month of the war, with the most recent wave of attacks spanning between July
15 and August 8, 2022. The most recent infection vector involves phishing messages carrying a self-extracting 7-Zip archive that fetches an XML file from an “xsph.ru” subdomain associated with Gamaredon since May 2022. The XML file leads to the execution of a PowerShell info-stealer, of which Symantec spotted several slightly modified variants, most likely an attempt to evade detection.
Tomi Engdahl says:
Näin Ukraina löysi Wagner-tukikohdan – dramaattiset väitetyt yksityiskohdat venäläisen toimittajan vuodoista
https://www.iltalehti.fi/ulkomaat/a/ea2d9bb6-0f90-4734-b49a-c97358356bcf
Kuvissa hän kertoi vierailleensa Wagner-palkka-armeijan salaisessa tukikohdassa ja palkkasotilaat olivat tervehtineet häntä kuten perheenjäsentä. Lisäksi kuvateksteissä hän kertoo sotilaiden kertoneen hauskoja tarinoita.
Osissa kuvista oli nähtävillä tukikohdan tarkka sijainti. Venäläisten palkkatappajien takana olleesta rakennuksessa oli pääovien vieressä nähtävissä rakennuksen osoite.
Moni sotaa tukeva taho Venäjällä on ollut raivoissaan toimittajan julkaisemista kuvista sekä siitä, miten vastuuttomasti hän on toiminut alueella. Hänen toimintansa mahdollisti tukikohdan löytämisen.
Ukrainalainen Pravda-lehti kertoo toimittajan olleen venäläinen Sergei Sreda. Hän julkaisi kuvat 8. elokuuta viestipalvelu Telegramissa.
Vaikka julkaisut poistettiin hänen omalta tililtään, kopiot julkaisuista kiersivät sosiaalisessa mediassa.
Julkaistut kuvat eivät ole ensimmäinen kerta tämän sodan aikana, kun strategisia kohteita on esitelty sosiaalisen median alustoilla. Useita kuvia on ajateltu myös lavastetuiksi ja jonkinlaisiksi houkutuslinnuiksi tehtäviin iskuihin.
Ukrainalaisjoukot pystyvät toteuttamaan entistä tarkempia iskuja käyttäen erityisen tarkkoja, suuren tuhovoiman omaavia yhdysvaltalaisia Himars-raketinheittimiä.
Tomi Engdahl says:
UK spy chief says Putin is losing information war in Ukraine -The Economist
https://news.yahoo.com/uk-spy-chief-says-putin-005554653.html
Russia has failed to gain ground in cyberspace against Ukraine almost six months after its invasion of the country, the head of Britain’s GCHQ intelligence service said on Friday.
Jeremy Fleming, the intelligence head, in an op-ed in The Economist, wrote that both countries have been using their cyber capabilities in the war in Ukraine.
“So far, president Putin has comprehensively lost the information war in Ukraine and in the West. Although that’s cause for celebration, we should not underestimate how Russian disinformation is playing out elsewhere in the world,” Fleming wrote.
“Just as with its land invasion, Russia’s initial online plans appear to have fallen short. The country’s use of offensive cyber tools has been irresponsible and indiscriminate.”
Fleming said Russia had deployed WhisperGate malware to destroy and deface Ukrainian government systems.
He also said Russia has used the same playbook before on Syria and the Balkans and said online disinformation is a major part of Russia’s strategy. However, the GCHQ has been able to intercept and to provide warnings in time, he said.
Tomi Engdahl says:
Viroon kohdistui raju verkkohyökkäys
https://www.is.fi/digitoday/tietoturva/art-2000009012794.html
VIROLAISEN ERR-tietotoimiston mukaan venäläinen Killnet-hakkeriryhmä on ottanut vastuun hyökkäyksestä. Kohteeksi joutui 12 valtionlaitosta ja 4 yksityisen sektorin verkkopalvelua. Yksi kohteista oli Viron sähköinen tunnistautumisjärjestelmä, joka vastaa jossain määrin Suomi.fitä. Palvelu kärsi lyhyistä häiriöistä kuuden muun palvelun ohella. Palvelunestohyökkäysten ohella virolaisiin järjestelmiin yritettiin ujuttaa haittaohjelmia. ERR:n mukaan niitä löytyi 137 laitteelta. Hyökkäykset seurasivat Viron tuoretta päätöstä hankkiutua eroon neuvostoaikaisista muistomerkeistä.
Tomi Engdahl says:
Fortinet: Use of wipers expanding beyond Ukraine to 24 countries https://therecord.media/fortinet-use-of-wipers-expanding-beyond-ukraine-to-24-countries/
The use of wiper malware is increasingly expanding beyond the Ukraine conflict, according to research released today by cybersecurity giant Fortinet, with new variants popping up at an unprecedented rate. Wiper malware has been used heavily by hacking groups supporting Russia’s invasion of Ukraine. Recorded Future’s Insikt Group has tracked nine different wipers used in Ukraine, including WhisperKill, WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, and DoubleZero. Microsoft researchers said in April that they had observed nearly 40 destructive cyberattacks targeting hundreds of systems in Ukraine.
Tomi Engdahl says:
Russian Use of Cyberweapons in Ukraine and the Growing Threat to the West
https://www.securityweek.com/russian-use-cyberweapons-ukraine-and-growing-threat-west
It started with AcidRain. AcidRain was a targeted attack against a Viasat server in Italy that managed a large number of modems, and therefore internet communication, throughout Europe – and Ukraine. The attack was timed for Russia’s physical invasion of Ukraine and marked a dramatic increase in the tempo of Russia’s cyberwar against that country.
The Trustwave study analyzes the Russian state cyberattacks against Ukraine since the war began, tying the attack groups back to their controlling state agencies. The main attackers are APT29 (aka Cozy Bear and The Dukes) controlled by the SVR (the Russian Foreign Intelligence Service); APT 28 and Sandworm controlled by the GRU; and Gameredon (aka Primitive Bear and Armageddon) and Dragonfly (aka Energetic Bear and Crouching Yeti) controlled by the FSB (the Federal Security Service). InvisiMole is included because of its ties to Gameredon.
We should be aware that Russia will not hesitate to directly attack western critical infrastructure whenever Putin decides it is in Russia’s best interests, and whenever he decides the benefits outweigh the costs.
Whatever the outcome of the Ukraine war, geopolitical tensions will continue to rise for many years to come. Western organizations should consider the growing potential for elite Russian government hackers to directly attack them in the future – and expanding from espionage to destruction.
The Trustwave study shows the size of the Russian cyber armory – and as Ziv Mador told SecurityWeek, “They will have an additional arsenal of zero days and cyber tools they haven’t used yet.”