Cyberwarfare / Nation-State Attacks
,
Fraud Management & Cybercrime
Self-Described Hacktivists Appear to Remain Moscow Foreign Policy Extension
Russia’s use of high-profile online nuisance attacks to amplify Moscow’s geopolitical agenda continues.
See Also: Real-Time Sanctions and Watchlist Screening: Transforming Compliance into Competitive Advantage
Multiple self-proclaimed Russian hacktivist groups over the past week have trumpeted their targeting of websites in the United Kingdom, France and Spain, among other NATO members, after those countries’ governments pledged to increase their support for Ukraine following the Trump administration’s decision to pare back aid.
Since Russia launched its February 2022 war against Ukraine, groups such as NoName057(16), aka NoName, as well as KillNet, Cyber Army of Russia Reborn, TwoNet, XakNet and Just Evil regularly threatened Moscow’s critics with distributed denial-of-service disruptions. These efforts seem designed to garner headlines, even while the real-world impact of the attacks – if and when they might occur at all – are minimal.
TwoNet on Thursday trumpeted its disruption of public-facing websites run by Britain’s domestic Security Service, aka MI5, as well as British defense contractor BAE Systems and telecommunications giant Vodafone’s U.K. site. The disruptions for anyone attempting to access those organizations’ public-facing websites, at least for anyone outside Great Britain, appeared to continue Friday.
“A flood of DDoS attacks will fall on your sites unless you stop supporting Ukraine,” the group claimed.
The attacks follow efforts in recent days to target organizations in other pro-Ukraine countries, including Spain. NoName claimed to disrupt the Spanish government’s public-facing site, the Ministry of Justice and other agencies and businesses as part of its ongoing “OpSpain” effort, launched after the Spanish government pledged $1 billion in military aid to Ukraine.
Other organizations allegedly disrupted in Spain include a boutique winemaker. TwoNet posted to Telegram on Thursday a video that it claimed showed its hackers successfully infiltrating “the control system of the winemaking equipment of the company,” changing “the pressure and operating mode of the system,” which it promised “will lead to damage to the entire batch of wine products.”
Moscow’s Sour Grapes
Russia-aligned DDoS groups’ announcing a change in their targeting follows a contentious meeting on Feb. 28 between Ukrainian President Volodymyr Zelenskyy and U.S. President Donald Trump in the Oval Office. Trump subsequently announced that the U.S. would pause aid to Ukraine, including military assistance, and cease providing intelligence to help Ukraine defend itself on the battlefield and against Russia’s nonstop targeting of civilians.
Europe has rallied to support Kyiv. The U.K. on Saturday signed a bilateral agreement with Ukraine that includes $2.92 billion in loans to help the country bolster its defense and promised to continue sharing military intelligence that didn’t originate from the U.S. A coalition of European governments, including the U.K. and all 27 EU member states bar Hungary, pledged on Thursday large increases in their defense and deterrence spending, which will likely lead to a boost in military aid for Ukraine.
Following the Oval Office meeting, multiple media reports suggested the U.S. paused any and all offensive operations against Russia, potentially as a prelude to trying to negotiate a peace deal.
TwoNet this week claimed that in response to that news, after a week of supposedly targeting the White House, “we have decided to temporarily stop attacking the U.S.”
As proof of its supposed proof, the group on Monday claimed that it had “gained access to the oil reserves” of Providence, R.I. “We decided not to change the system parameters, so that the changes would not lead to a mass catastrophe!”
This claim could not be verified. As the U.S. Energy Information Administration’s website says: “Rhode Island has no crude oil reserves and does not produce or refine petroleum, but the Port of Providence is a key hub for the distribution of petroleum products to southern New England.”
Whatever the truth or fiction, nuance isn’t part of Russia-aligned or Moscow-sponsored DDoS groups’ playbook.
Would-Be Emperor Has No Clothes
Moscow-aligned DDoS groups continue to get called out for spewing diatribe in service to Putin’s imperialistic ambitions. As the Swiss federal government said last year in the wake of NoName’s attempted disruptions of Swiss federal agencies, the group’s aim “was to convey its political grievances,” adding that “hackers generally use such attacks on website availability as a means of gaining media attention for their cause.”
Clearly, “declaring war” on government institutions and organizations in countries that aren’t aligned with Moscow is much easier than overwhelming Ukraine on the battlefield, as the war’s continuing stalemate demonstrates.
Significant evidence suggests these hacktivist groups are run by Moscow as a psychological operation. Last year, Google’s Mandiant threat-intelligence group reported that Unit 74455 of Russia’s General Staff Main Intelligence Directorate – tracked by cybersecurity companies as APT44 and Sandworm – appeared to have significant crossover with multiple supposedly independent hacktivist groups (see: Ukraine Facing Phishing Attacks, Information Operations).
“Consistent with the group’s pre-war activity leveraging personas such as Anonymous Poland and Guccifer 2.0, APT44 continues to cultivate hacktivist identities as assets for its follow-on information operations,” Mandiant said. “It has cycled through at least three primary hacktivist-branded Telegram channels to claim responsibility for its wartime disruptive operations: XakNet Team, CyberArmyofRussia_Reborn1 and Solntsepek.”
Further bolstering that assessment, Check Point Research last week analyzed hacktivist groups’ public-facing pronouncements and found “significant stylistic overlap” between them. “Stylometric analysis not only revealed that groups like JustEvil and NoName057 shared writing styles with Cyber Army of Russia Reborn, but also pointed to shared operators and potential state sponsorship,” it said.
Whatever hacktivist groups’ claims and whoever pays their bills, it’s important to remember that these DDoS groups’ real-world impact appears to remain nuisance-level. Supposedly targeted websites often don’t get disrupted, and even if they do, normal operations typically resume quickly. So while Russian hackers may be screaming from the rooftops, their weaponized PR isn’t crashing the planet, or oftentimes even Moscow’s enemies.