{"id":44637,"date":"2022-03-01T10:17:48","date_gmt":"2022-03-01T02:17:48","guid":{"rendered":"https:\/\/version-2.com.sg\/?p=44419"},"modified":"2022-03-16T11:25:27","modified_gmt":"2022-03-16T03:25:27","slug":"the-russia-ukraine-conflict-from-an-industrial-cybersecurity-perspective","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2022\/03\/the-russia-ukraine-conflict-from-an-industrial-cybersecurity-perspective\/","title":{"rendered":"The Russia-Ukraine Conflict from an Industrial Cybersecurity Perspective"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

\"\" <\/p>\n\n

In recent weeks, Ukraine has been hit with numerous cyberattacks targeting its government and banking sector as a part of the Russo-Ukrainian crisis. Several Ukrainian government departments and banks were knocked offline by a DDoS attack, and multiple wiper malwares have been observed targeting Ukrainian organizations.<\/p>\n

For its part, Russia claimed it has never conducted and does not conduct any malicious operations in cyberspace.<\/p>\n

These attacks resulted in fear of a wider cyber conflict, with western governments bracing for Russian cyberthreats and considering their response.<\/p>\n\n

The Russia-Ukraine Cyber Conflict<\/h2>\n

In January, about 70 government websites were taken offline by a DDoS attack. Shortly after, a destructive malware infected government, non-profit, and IT organization devices in Ukraine. This malware, dubbed WhisperGate<\/span><\/a>, was designed to look like ransomware, but lacks a recovery feature, indicating that their goal was to destroy files rather than to encrypt them for ransom.<\/p>\n

Hours prior to the beginning of the Russian invasion of Ukraine, a new wiper malware was discovered. This attack leveraged at least three components: HermeticWiper<\/span><\/a> for data wiping, HermeticWizard for spreading in the network, and HermeticRansom acting as a decoy ransomware. HermeticWiper was seen conducting malicious activity as early as November 2021, indicating that the attack was prepared months in advance. <\/p>\n

As the invasion began, the second wiper malware, IsaacWiper<\/span><\/a>, surfaced. IsaacWiper and HermeticWiper have no code similarities, the former is less sophisticated than the latter.<\/p>\n

While it cannot be confirmed whether Russia is behind these attacks, it is believed they are part of Russia\u2019s \u201chybrid warfare\u201d, which consists of a combination of conventional and advanced methods.<\/p>\n

Ukraine\u2019s cyber activity has not been solely defensive, with the Ukrainian government forming an \u201cIT Army\u201d. Since the crisis began, several Russian government and media websites have been intermittently offline. Some of these attacks were carried out by the Anonymous hacktivist movement, which has pledged allegiance to Ukraine. The group and its affiliates also claimed to have compromised the Russian Nuclear Institute and the Control Center of the Russian Space Agency \u2018Roscosmos\u2019.<\/p>\n\n

Russian APT Groups and Known Attacks<\/h2>\n

There are a number of APT groups affiliated with Russian organizations:<\/p>\n

APT28<\/span><\/p>\n