Top Ukrainian cyber official praises volunteer hacks on Russian targets, offers updates

Ukraine's Victor Zhora said the so-called IT Army has done "useful" things, and he offered information about the "CaddyWiper" incident.

The Ukrainian government’s cyber efforts are focused on defense, not offense, a top official said Tuesday, but leaders are “grateful” for offensive actions taken by private hackers within Ukraine and around the world, “since every means and every scenario which will be used to weaken the military potential of Russian aggressors is useful.”

Victor Zhora, the deputy chairman of the State Service of Special Communications and Information Protection of Ukraine, told reporters in a briefing Tuesday that the Ukrainian government’s cyber capabilities are focused on protecting its critical infrastructure and government services.

Zhora referenced the “IT Army” — a broad collection of volunteers who have joined a Telegram channel that shares potential targets and updates on cyber issues, such as possible distributed denial-of-service targets — but he did not talk about offensive hacking efforts reportedly coordinated through the Ukrainian defense ministry in conjunction with Ukrainian cybersecurity expert Yegor Aushev, as reported by Reuters.

Zhora said Tuesday that IT Army volunteers are conducting other operations besides offensive actions. “A lot of people are helping us in OSINT,” he said, referring to open-source intelligence gathering, “in delivering of truth, of real content on Russian war crimes in Ukraine to Russian audience which hidden behind constant lies behind Russian media.”

Zhora also said it was too soon to assess the full damage from the wiper malware made public Monday by cybersecurity firm ESET, the third reported instance of wiper malware to target Ukrainian systems in recent weeks. This malware, labeled “CaddyWiper,” was launched by the Russians on “already compromised systems,” the Ukrainian Computer Emergency Response Team said in a Facebook post Tuesday. There’s just one confirmed infection of this particular wiper, Zhora said, “but we are confident there will be more,” he said. The attackers were focused on a “financial organization,” Zhora said, but he didn’t offer additional details.

Zhora also told reporters that a cyberattack on a satellite network connected with broadband and satellite internet in Ukraine in the hours before the invasion resulted in a “huge loss in communications in the very beginning of the war,” and declined to offer additional detail.

That attack, which targeted modems used to communicate with Viasat Inc.’s KA-SAT satellite, is currently under investigation by several western intelligence agencies, Reuters reported March 11.

Zhora said Tuesday that the Ukrainian government needs more evidence and detail to official attribute the attack, which “will be useful in international crime courts.”

“I don’t need any additional proofs that Russia was targeting Viasat, as well as other companies,” Zhora added. “We understand they’re focusing on satellite communications, they are focusing on ISPs, they are focusing on mobile operators” to destroy infrastructure and prevent Ukrainian armed forces from being able to effectively communicate.

Russian hacking campaign targets rights groups, media, former US ambassador

The government-backed hackers exploited fake friends and family with spear-phishing lures, according to research published Wednesday.

Russian national indicted for role in cyberattacks on Ukraine

Russian military intelligence may have deployed wiper against multiple Ukrainian ISPs

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure