Ukrainian Defenders Report Rise in Russian Cyberattacks

Russia has increased the tempo of its cyber operations targeting Ukraine, say cyber defenders in war-buffeted Kyiv.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The Ukrainian Computer Emergency Response Team responded to approximately 3,000 cybersecurity incidents in the first half of this year, up from 2,580 in the latter half of 2024, says a new report from CERT-UA, a component of the State Service of Special Communications and Information Protection bureau.

Included in that number is a major attack in March against Ukrainian Railways, attributed to Unit 74455 of Russia’s General Staff Main Intelligence Directorate, a cyberwarfare threat actor popularly known as Sandworm. The attack knocked out the online ticketing system, causing long lines at railway stations. Rail has become a principal mode of travel in Ukraine since the Kremlin launched an invasion in February 2022, grounding commercial aviation from fear of missile and fighter jet attack.

Despite the catalog of identified attacks, the actual number is likely to be higher since CERT-UA can’t account for undetected breaches.

“Obviously, visibility – the ability to detect infections – is constantly improving; however, the intensity of cyberattacks is also increasing,” the SSCIP said.

Russian hacking innovations are constant, said Yevheniia Nakonechna, head of Ukraine’s State Cyber Protection Center. “New threats and tactics emerge faster than traditional defense approaches can be developed,” necessitating “constant adaptation” by defenders, she said.

The Kremlin’s targets are also constant from year to year. About one-third of all attacks targeted local authorities, one-fifth the military or government agencies and 5% the country’s energy sector, said the SSCIP.

“As before, the enemy’s top targets remain locations where the largest amount of information circulates – information they can exploit for military purposes – as well as services whose disruption would significantly impact the safety and well-being of the civilians,” it said.

CERT-UA tied the GRU Unit 74455 hacking team to numerous attacks seen in the first half of this year, some of which “were carried out to amplify the impact of kinetic strikes.”

The report singles out further elements of the GRU military intelligence service for conducting “certain cyber operations during massive missile and drone attacks” that “complicated timely incident response and thereby increased the chances of successfully achieving their objectives.”

The Ukrainian government doesn’t publish a full accounting of how many cyberattacks succeed. But officials did say that Russian nation-state hackers continue to refine their tactics, techniques and procedures, especially for distributing malware, which “unfortunately had positive results for the attackers.”

These tools, tactics and procedures have lately included the use of a “steal and go” tactic facilitated by a PowerShell script, codenamed WreckSteel, that gets delivered by a VBS script attached to or triggered by a malicious phishing message and which is being used to target the armed forces, the SSSCIP said.

The WreckSteel PowerShell scripts appear to have been developed using artificial intelligence tools, Ukrainian cyber officials said. The malware is designed to steal data without maintaining persistence on a system, in part to evade defenses that monitor for connections between an infected endpoint and command-and-control servers, blocking it before exfiltration can occur.

Defenders have been tracking two clusters of threat activity tied to these efforts, codenamed UAC-0218 and UAC-0219, with the first attacks appearing last year and intensifying early this year.

Russian attackers continue to use legitimate cloud-based resources as cover, often including links to file-hosting services in their phishing messages, designed to infect victims with malware or malware droppers, officials said. Services used include Bitbucket, Dropbox, 4Sync, Google Drive, OneDrive and the Ukrainian service UKR.NET E-disk.

“The use of legitimate online resources for malicious purposes is not a new tactic. However, the number of such platforms exploited by Russian hackers has been steadily increasing in recent times,” CERT-UA said.

While most services do respond quickly to abuse reports and to takedown requests, cyber defenders urged service providers to more proactively monitor for abuse. “There is always a time gap between detection and mitigation, during which attackers can achieve their objectives,” it said.

Russia Focuses on Attrition

The British government, in coordination with the FBI, NATO and the EU, in July sanctioned multiple GRU officials and hacking teams, including Unit 74455, which they said “represent an advanced, comprehensive cyber capability” that the Russian government uses to achieve its ‘military and foreign policy objectives.'”

As Russia’s invasion drags on, cybersecurity experts say Moscow has focused on running cyber operations and espionage campaigns that target Ukraine’s military, government and civil society in support of its ground campaign, as well as psychological operations designed to poison public morale (see: Looking Tough: Russia Trumpets Pro-Ukraine Hacker Arrests).

The invader’s tactics have changed on the battlefield, where it has similarly failed to gain a decisive edge. Moscow now appears to be trying to wear out its opponent over the long term, including with frequent drone and missile attacks against civilian targets, experts say.

This strategy comes at a serious human cost, with the British Ministry of Defense this past summer estimating that more than one million Russian troops have been killed or injured since the conflict began.

“Russian fatalities and casualties have been extraordinary,” said the U.S.-based Center for Strategic and International Studies. The think tank estimated that since February 2022, up to 250,000 Russian troops have been killed. For Ukraine, the statistics are less stark but still grim, with 60,000 to 100,000 troop fatalities and up to 250,000 total casualties.