Ukraine seeks volunteers to defend networks as Russian troops menace Kyiv
(2022/02/25)
- Reference: 1645816031
- News link: https://www.theregister.co.uk/2022/02/25/ukraine_cyber_russia/
- Source link:
As the Russian invasion of Ukraine continues, the latter's government is reportedly seeking cybersecurity volunteers to help defend itself. Meanwhile, Russia's CERT has warned critical infrastructure operators that any strange outages should be treated as "a computer attack."
Reuters [1]reported this morning that a Google Docs form had been published so Ukrainian infosec specialists can register their services. The form reportedly had this message with it:
Ukrainian cybercommunity! It's time to get involved in the cyber defense of our country.
As Register readers know, inputting one's details into a Google Docs form [2]can be risky ; El Reg 's own sources, however, suggested something officially sanctioned was definitely afoot.
Conflict latest
→ Russian forces are [3]bearing down on Ukraine's capital Kyiv amid a full-blown invasion of the nation. Volunteers in the city have been given 18,000 guns, and told to make and use Molotov cocktails, to repel Putin's military.
→ Right now the bulk of Russian troops are roughly 50km from Kyiv.
→ The Champions League final will not be held in Russia nor will the country host a F1 Grand Prix.
→ Facebook [4]said its services in Russia will be restricted after refusing an order by Moscow to stop fact checking and labeling Russian state-owned media.
Similarly, this afternoon Ukraine's CERT warned [5]in a Facebook post that a threat group known as UNC1151 was targeting "private ‘i.ua’ and ‘meta.ua’ [email] accounts of Ukrainian military personnel and related individuals" to launch phishing attacks.
Threat intel firm Mandiant said two domains mentioned by the UCERT, i[.]ua-passport[.]space and id[.]bigmir[.]space were known command-and-control domains of UNC1151, adding: "We are able to tie the infrastructure reported by CERT.UA to UNC1151, but have not seen the phishing messages directly. However, UNC1151 has targeted Ukraine and especially its military extensively over the past two years, so this activity matches their historical pattern."
UNC1151 was [6]previously attributed by Ukrainian officials to Belarus, following deployment of a device-wiping malware strain. Belarus is widely believed in the West to be acting as a proxy for Russia. Another file-destroying software nasty was [7]spotted in Ukraine this week by ESET.
[8]
"The world will hold Russia, as well as Belarus, accountable for their actions," said NATO in a statement issued this afternoon as it urged the world to "condemn this unconscionable attack unreservedly".
[9]
[10]
While the US and its NATO allies are not getting involved in the shooting war, the US CISA infosec agency has published a list of free services and tools as highlighted by its director Jen Easterly on Twitter:
🛡 We've had tremendous response so far to our FREE [11]#cybersecurity services & tools page but would ❤️ your help in getting the word out even further. 🙏 Resources available at [12]https://t.co/lY02JtIJYm [13]pic.twitter.com/iQqwWUeFXV — Jen Easterly (@CISAJen) [14]February 25, 2022
Meanwhile, the Russian National Coordination Center for Computer Incidents has issued an advisory warning of "the threat of an increase in the intensity of computer attacks on Russian information resources."
"In addition, in the future, it is possible to carry out harmful influences from the Russian information space to form a negative image of the Russian Federation in the eyes of the world community," said the [15]advisory .
It concluded:
Any failure in the operation of [critical information infrastructure] objects for a reason that has not been reliably established should first of all be considered as the result of a computer attack.
As is necessary when reading anything from Russia, the wider intent must be looked at rather than just the words in isolation. The advisory may be a genuine warning to Russians and Russian-aligned organisations but could also be an attempt to lay a smokescreen for Russian politicians to claim someone else is carrying out a false flag attack in their name. [16]Such techniques are well known.
[17]How to fool infosec wonks into pinning a cyber attack on China, Russia, Iran, whomever
[18]Cyberwarfare looms as Russia shells Ukraine
[19]Ukraine's IT sector looks to business continuity plans as Russia invades
[20]Ukraine invasion may hit chip supply chain – analysts
Despite some expectations that Russia would conduct a blitzkrieg-style invasion of Ukraine, using every military means available to smash the country and its population, the use of indiscriminate large-scale cyber-attacks has either not been publicly reported or is simply not occurring yet. Nonetheless, the previously-reported wiper malware has been seen in the wild in Ukraine, and other cyber activity is most definitely happening.
British infosec company Orpheus Cyber said it had seen stolen Ukrainian government data, purloined earlier this month, being published on a Tor website by a threat actor called FreeCivilian. In a [21]blog post the firm said: "The lack of extortion tactics and the publishing of significant amounts of free data suggests that the actor's objective is to disrupt Ukrainian government websites regardless of monetisation."
[22]
A shipping labor agency director, speaking to Lloyd's List, described the effects of apparent Russian missile attacks against civilian shipping south of Ukrainian waters, near the port of Odessa.
Danica Crewing managing director Henrik Jensen told the insurance company's news organ: "We have been in contact with all office staff and they are all safe and sheltering. We have unconfirmed reports that Russian troops are in Odessa. Communication including internet is still fully operational." ®
Bootnote
As international disagreements about fresh sanctions against Russia fly back and forth, at least one multinational institution has got itself into gear and taken a hard stance against Russian aggression.
Statement from [23]@EBU_HQ regarding Russia's participation in the Eurovision Song Contest 2022. [24]https://t.co/HmKJdqVE4J [25]pic.twitter.com/tVH6yFxzbq — Eurovision Song Contest (@Eurovision) [26]February 25, 2022
"The European Broadcasting Union (EBU) has announced that no Russian act will participate in this year's Eurovision Song Contest," reads the first line of the embedded picture above.
Get our [27]Tech Resources
[1] https://www.reuters.com/world/exclusive-ukraine-calls-hacker-underground-defend-against-russia-2022-02-24/
[2] https://www.theregister.com/2020/05/28/google_branded_phishing/
[3] https://apnews.com/article/russia-ukraine-vladimir-putin-volodymyr-zelenskyy-boris-johnson-business-08f569df695831ee467979527ea2e241
[4] https://twitter.com/nickclegg/status/1497279120853590025
[5] https://www.facebook.com/UACERT/posts/312939130865352
[6] https://www.theregister.com/2022/01/17/ukraine_pc_wiping_malware_belarus_accusations/
[7] https://www.theregister.com/2022/02/23/ukraine_wiper_malware/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://twitter.com/hashtag/cybersecurity?src=hash&ref_src=twsrc%5Etfw
[12] https://t.co/lY02JtIJYm
[13] https://t.co/iQqwWUeFXV
[14] https://twitter.com/CISAJen/status/1497231510642036745?ref_src=twsrc%5Etfw
[15] https://rkn.gov.ru/news/rsoc/news74084.htm
[16] https://www.theregister.com/2019/12/05/fooling_attribution_breadcrumbs/
[17] https://www.theregister.com/2019/12/05/fooling_attribution_breadcrumbs/
[18] https://www.theregister.com/2022/02/24/cyberwarfare_russia_ukraine/
[19] https://www.theregister.com/2022/02/24/ukrainian_it_companies_look_to/
[20] https://www.theregister.com/2022/02/25/ukraine_chipmaking_supply/
[21] https://orpheus-cyber.com/blog-suspected-state-front-freecivilian-publishes-ukrainian-government-data-after-ddos-and-wiper-attacks/
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://twitter.com/EBU_HQ?ref_src=twsrc%5Etfw
[24] https://t.co/HmKJdqVE4J
[25] https://t.co/tVH6yFxzbq
[26] https://twitter.com/Eurovision/status/1497243799889711104?ref_src=twsrc%5Etfw
[27] https://whitepapers.theregister.com/
Reuters [1]reported this morning that a Google Docs form had been published so Ukrainian infosec specialists can register their services. The form reportedly had this message with it:
Ukrainian cybercommunity! It's time to get involved in the cyber defense of our country.
As Register readers know, inputting one's details into a Google Docs form [2]can be risky ; El Reg 's own sources, however, suggested something officially sanctioned was definitely afoot.
Conflict latest
→ Russian forces are [3]bearing down on Ukraine's capital Kyiv amid a full-blown invasion of the nation. Volunteers in the city have been given 18,000 guns, and told to make and use Molotov cocktails, to repel Putin's military.
→ Right now the bulk of Russian troops are roughly 50km from Kyiv.
→ The Champions League final will not be held in Russia nor will the country host a F1 Grand Prix.
→ Facebook [4]said its services in Russia will be restricted after refusing an order by Moscow to stop fact checking and labeling Russian state-owned media.
Similarly, this afternoon Ukraine's CERT warned [5]in a Facebook post that a threat group known as UNC1151 was targeting "private ‘i.ua’ and ‘meta.ua’ [email] accounts of Ukrainian military personnel and related individuals" to launch phishing attacks.
Threat intel firm Mandiant said two domains mentioned by the UCERT, i[.]ua-passport[.]space and id[.]bigmir[.]space were known command-and-control domains of UNC1151, adding: "We are able to tie the infrastructure reported by CERT.UA to UNC1151, but have not seen the phishing messages directly. However, UNC1151 has targeted Ukraine and especially its military extensively over the past two years, so this activity matches their historical pattern."
UNC1151 was [6]previously attributed by Ukrainian officials to Belarus, following deployment of a device-wiping malware strain. Belarus is widely believed in the West to be acting as a proxy for Russia. Another file-destroying software nasty was [7]spotted in Ukraine this week by ESET.
[8]
"The world will hold Russia, as well as Belarus, accountable for their actions," said NATO in a statement issued this afternoon as it urged the world to "condemn this unconscionable attack unreservedly".
[9]
[10]
While the US and its NATO allies are not getting involved in the shooting war, the US CISA infosec agency has published a list of free services and tools as highlighted by its director Jen Easterly on Twitter:
🛡 We've had tremendous response so far to our FREE [11]#cybersecurity services & tools page but would ❤️ your help in getting the word out even further. 🙏 Resources available at [12]https://t.co/lY02JtIJYm [13]pic.twitter.com/iQqwWUeFXV — Jen Easterly (@CISAJen) [14]February 25, 2022
Meanwhile, the Russian National Coordination Center for Computer Incidents has issued an advisory warning of "the threat of an increase in the intensity of computer attacks on Russian information resources."
"In addition, in the future, it is possible to carry out harmful influences from the Russian information space to form a negative image of the Russian Federation in the eyes of the world community," said the [15]advisory .
It concluded:
Any failure in the operation of [critical information infrastructure] objects for a reason that has not been reliably established should first of all be considered as the result of a computer attack.
As is necessary when reading anything from Russia, the wider intent must be looked at rather than just the words in isolation. The advisory may be a genuine warning to Russians and Russian-aligned organisations but could also be an attempt to lay a smokescreen for Russian politicians to claim someone else is carrying out a false flag attack in their name. [16]Such techniques are well known.
[17]How to fool infosec wonks into pinning a cyber attack on China, Russia, Iran, whomever
[18]Cyberwarfare looms as Russia shells Ukraine
[19]Ukraine's IT sector looks to business continuity plans as Russia invades
[20]Ukraine invasion may hit chip supply chain – analysts
Despite some expectations that Russia would conduct a blitzkrieg-style invasion of Ukraine, using every military means available to smash the country and its population, the use of indiscriminate large-scale cyber-attacks has either not been publicly reported or is simply not occurring yet. Nonetheless, the previously-reported wiper malware has been seen in the wild in Ukraine, and other cyber activity is most definitely happening.
British infosec company Orpheus Cyber said it had seen stolen Ukrainian government data, purloined earlier this month, being published on a Tor website by a threat actor called FreeCivilian. In a [21]blog post the firm said: "The lack of extortion tactics and the publishing of significant amounts of free data suggests that the actor's objective is to disrupt Ukrainian government websites regardless of monetisation."
[22]
A shipping labor agency director, speaking to Lloyd's List, described the effects of apparent Russian missile attacks against civilian shipping south of Ukrainian waters, near the port of Odessa.
Danica Crewing managing director Henrik Jensen told the insurance company's news organ: "We have been in contact with all office staff and they are all safe and sheltering. We have unconfirmed reports that Russian troops are in Odessa. Communication including internet is still fully operational." ®
Bootnote
As international disagreements about fresh sanctions against Russia fly back and forth, at least one multinational institution has got itself into gear and taken a hard stance against Russian aggression.
Statement from [23]@EBU_HQ regarding Russia's participation in the Eurovision Song Contest 2022. [24]https://t.co/HmKJdqVE4J [25]pic.twitter.com/tVH6yFxzbq — Eurovision Song Contest (@Eurovision) [26]February 25, 2022
"The European Broadcasting Union (EBU) has announced that no Russian act will participate in this year's Eurovision Song Contest," reads the first line of the embedded picture above.
Get our [27]Tech Resources
[1] https://www.reuters.com/world/exclusive-ukraine-calls-hacker-underground-defend-against-russia-2022-02-24/
[2] https://www.theregister.com/2020/05/28/google_branded_phishing/
[3] https://apnews.com/article/russia-ukraine-vladimir-putin-volodymyr-zelenskyy-boris-johnson-business-08f569df695831ee467979527ea2e241
[4] https://twitter.com/nickclegg/status/1497279120853590025
[5] https://www.facebook.com/UACERT/posts/312939130865352
[6] https://www.theregister.com/2022/01/17/ukraine_pc_wiping_malware_belarus_accusations/
[7] https://www.theregister.com/2022/02/23/ukraine_wiper_malware/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://twitter.com/hashtag/cybersecurity?src=hash&ref_src=twsrc%5Etfw
[12] https://t.co/lY02JtIJYm
[13] https://t.co/iQqwWUeFXV
[14] https://twitter.com/CISAJen/status/1497231510642036745?ref_src=twsrc%5Etfw
[15] https://rkn.gov.ru/news/rsoc/news74084.htm
[16] https://www.theregister.com/2019/12/05/fooling_attribution_breadcrumbs/
[17] https://www.theregister.com/2019/12/05/fooling_attribution_breadcrumbs/
[18] https://www.theregister.com/2022/02/24/cyberwarfare_russia_ukraine/
[19] https://www.theregister.com/2022/02/24/ukrainian_it_companies_look_to/
[20] https://www.theregister.com/2022/02/25/ukraine_chipmaking_supply/
[21] https://orpheus-cyber.com/blog-suspected-state-front-freecivilian-publishes-ukrainian-government-data-after-ddos-and-wiper-attacks/
[22] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YhlfmFFzVplByKDLqyKE@QAAAMU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[23] https://twitter.com/EBU_HQ?ref_src=twsrc%5Etfw
[24] https://t.co/HmKJdqVE4J
[25] https://t.co/tVH6yFxzbq
[26] https://twitter.com/Eurovision/status/1497243799889711104?ref_src=twsrc%5Etfw
[27] https://whitepapers.theregister.com/
Re: ...to form a negative image of the Russian Federation
Anonymous Coward
Indeed. We here in the West thought we were were all poised with many evil and devious plans to smash the Russian economy, blight Russian culture, and grind Russia's reputation into the dirt ... until it became clear that Putin was doing that for us already. In fact, he's doing such a thorough job of it that we are starting to feel our plans weren't up to the job, and that maybe, in truth, our heart wasn't in it after all.
:-/
JimboSmith
So that’s the Champions League Final, Sochi F1 Grand Prix and Eurovision that they’re:
a) not holding in Russia,
b) cancelling,
c) banning the Russians from entering,
respectively.
No Fecesbook for Russia?
Androgynous Cow Herd
they could chalk that up to a Win no matter how things unfold.
Eurovision
Anonymous Coward
So now they have put out the ultimate sanction and banned Russia from Eurovision, it is time to put your bets on Ukraine winning the thing due to the popular vote...
But may make it a little tricky to hold the competition in 2023 if they do win.
No help required!
"...to form a negative image of the Russian Federation in the eyes of the world community,"
I'd say that they were doing a pretty good job on their own.
It would be ironic if the Russians were hit with some of the malware they have been inflicting on the rest of the world.
One lives in hope.