Ukrainian official: Russian hackers change tactics from disruptive attacks

Russian hackers have become increasingly focused on intelligence gathering to gain advantage on the battlefield.

LAS VEGAS — Russian hackers targeting Ukraine have pivoted away from disruptive attacks and are increasingly focusing on collecting data of use to Russian forces on the battlefield, Victor Zhora, a top Ukrainian cybersecurity official, said during a panel appearance at the Black Hat security conference in Las Vegas.

Some 15 months since Russian forces invaded Ukraine, Zhora has observed “a shift from disruptive and chaotic attacks to more focused activity, cyber espionage and data collection.”

Zhora, the deputy chairman of the State Service of Special Communications and Information Protection of Ukraine, said Ukrainian network defenders recently discovered a Russian operation “targeting our situational awareness system, technical battlefield systems in order to gain information” that “can give them some advantage on the battlefield.”

According to a recent report from the Ukrainian security services, Russian hackers targeted the Android phones used by Ukrainian military personnel for planning and operating combat missions. Using devices captured on the battlefield, Russian hackers attempted to spread malware that targeted configuration information of Starlink satellite terminals — which are a key tool of the Ukrainian military to carry out operations— and backup communication channels.

Ukraine’s security service attributed the operation with high confidence to the Russia’s infamous Sandworm hacking unit.

Zhora said Russian cyber operations target Ukrainian security and defense sectors, logistics, supply chains, service providers are used “not only for impact, but also for intelligence purposes,” but that Ukraine is seeing some success thwarting Russian operations. Ukrainian defenders were able to disrupt the campaign targeting Android devices early due in part to increased collaboration and shared threat intelligence, Zhora said, noting that such intelligence is “crucial” for detecting campaigns before they occur.

Speaking alongside Zhora, Jen Easterly, the director of the Cybersecurity and Infrastructure Security Agency, said that a memorandum of cooperation between CISA and Ukraine’s SSSCIP “allowed us to really focus on how do we effectively share information, best practices, exercise together, train together, figure out how to hunt for adversary activity.”

Easterly went on to describe what has become a common refrain from the director on the need to improve societal resilience.

While Ukraine has shown great resilience in responding to the Russian invasion on thwarting cyberattacks, the U.S. public is far less resilient in the phase of similar threats, such as the Colonial Pipeline ransomware attack and the Chinese spy balloon that floated over the U.S., she said.

“I don’t see that level of resilience in terms of how we respond to potential threats,” Easterly said. “We should be unified as an American people in the face of these very serious threats.”

Easterly noted that while Russia poses a major threat in cyberspace, the U.S. intelligence community’s annual threat assessment noted that China in the event of a conflict is “almost certainly is capable” of launching disruptive attacks against U.S. pipeline infrastructure as well as rail systems.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure