Russia reports thousands of cyberattacks on election infrastructure during vote

Russian authorities said they repelled thousands of cyberattacks targeting online voting systems and other digital infrastructure during the country's three-day parliamentary election.

According to Deputy Digital Development Minister Oleg Kachanov, Russia detected and blocked about 2,000 cyberattacks and other attempts to disrupt its federal online voting platform and e-government systems.

Kachanov said Sunday that the incidents caused no service disruptions and that Russia’s newly deployed election administration system, Vybory 2.0, continued operating normally.

Those claims could not be independently verified, and Russian officials provided little technical evidence about the attacks or who was behind them. 

Separate figures, presented during a Central Election Commission (CEC) broadcast, showed that more than 3,000 waves of distributed denial-of-service (DDoS) attacks targeted Russian digital infrastructure between the start of voting on Sept. 18 and Sunday evening.

According to the commission, the attacks included 135 waves targeting the federal remote voting platform, 16 against the commission’s website and nearly 2,000 against e-government infrastructure. Another 420 targeted infrastructure operated by Russian telecommunications giant Rostelecom.

CEC Chair Ella Pamfilova said the attacks originated primarily outside Russia and that none had successfully compromised election systems.

The Kremlin repeatedly blamed foreign actors for the activity, including Ukraine, but offered little public evidence to support those attributions.

Pamfilova said at a Saturday briefing that attempted cyberattacks had originated from the United Kingdom, Ukraine, Brazil and Mexico. Russia’s communications regulator, Roskomnadzor, separately reported more than 1,500 DDoS attacks originating outside the country and targeting election-related and government services.

The regulator also reported phishing websites designed to impersonate official election resources.

Some disruptions were reported during the vote, particularly in Moscow, which operates a remote voting platform separate from the federal system.

On the first day of voting, a technical failure briefly knocked electronic voting terminals offline in the Russian capital, according to Moscow Election Commission Chair Olga Kirillova. Russian officials attributed the disruption to a cyberattack.

Dmitry Reut, deputy chair of the Moscow City Election Commission, reported further attacks Sunday, including against the electronic voter registry used to issue paper ballots. He said the disruption contributed to lines and crowding at some polling stations.

Pamfilova separately claimed that a representative of an established Russian political party had deliberately attempted to introduce malware into Moscow’s remote voting system. She did not identify the person or party or provide evidence supporting the allegation.

The cyber incidents came alongside reported physical disruptions to communications infrastructure. Russia’s Digital Development Ministry said Friday that deliberate damage to a fiber-optic line caused internet problems in the Far East in what officials described as an attempt to interfere with voting.

Rostelecom also said two backbone fiber-optic lines in the region went down at separate times. Chief Executive Mikhail Oseevsky characterized the incidents as organized sabotage intended to disrupt the election. Connectivity was restored through backup channels, according to the company.

The Russian government’s claims about the cause and intent of the outages could not be independently verified.

Security concerns

The election infrastructure was already facing questions about its security before voting began.

Last week, an anonymous hacking group calling itself CikLeak claimed it had penetrated systems belonging to Russia’s Central Election Commission and contractors involved in developing Vybory, the state-run platform used to administer elections.

The hackers claimed to have obtained internal documents, server configurations, passwords and employee communications from the commission and its contractors, including Rostelecom. They also published screenshots purportedly showing access to compromised systems.

The group said it did not intend to disrupt voting but urged Russians to cast ballots in person on the final day of the election, arguing that doing so would make manipulation more difficult.

The election marked the first federal vote conducted using Vybory 2.0, which began replacing an earlier election administration system this year. Online voting was available in 32 regions through the federal platform, while Moscow used its own system. More than 3.6 million people cast ballots electronically through the federal platform, according to official figures.

The cyberattacks unfolded as Russia held its first State Duma election since its full-scale invasion of Ukraine in 2022. The vote took place with most opposition excluded from the ballot and amid reports from independent and domestic observers of electoral violations, pressure on voters and ballot manipulation.

Results Monday showed the ruling United Russia party with about 57.8% of the party-list vote with more than 95% of ballots counted, putting it on track to retain its dominant position in the lower house of parliament. Final results are expected by Sept. 25.

The final day of voting also coincided with a massive Ukrainian drone and missile attack against targets in and around Moscow. Ukrainian President Volodymyr Zelenskyy confirmed the operation, saying Ukrainian forces targeted Russian oil and logistics infrastructure.

The Institute for the Study of War said Moscow regional authorities did not activate air-raid sirens or send text-message warnings during the Sept. 20 attack. The institute assessed that authorities did not want warnings to depress election turnout.