Belarusian hacktivist group attacks Belarusian Railways as military frictions mount

The attack is the latest salvo in cyber activity related to military tensions between Russia and Ukraine.

A group of Belarusian hackers claim to have encrypted the servers, databases and workstations of Belarusian Railways with the aim of slowing down Russian troop movements as tensions continue to mount toward a potential Russian invasion of Ukraine.

The Belarus Cyber Partisans — a group of pro-democracy hacktivists who have been targeting the Russia-friendly Belarusian government with a series of hack-and-leak operations aimed to expose government corruption — tweeted mid-morning Monday U.S. time that they’d “encrypted some of BR’s servers, databases and workstations to disrupt operations.”

They demanded the release of 50 political prisoners they say are the most in need of medical attention want Russian troops to stay out of their country. Franak Viacorka, an adviser to a Belarusian human rights advocate, tweeted screenshots purporting to show access to the railway company’s servers. Additional screenshots of the data were posted by the Cyber Partisans’ Telegram account.

The Belarus Cyber Partisans are a group of roughly 15 self taught “hacktivists” who’ve fled the country but claim to have help from disaffected members of the Belarusian security forces, The Washington Post reported in September 2021. The group has published detailed information on government officials’ corruption in the country with a particular emphasis on President Lukashenko, a key ally of Russian President Vladimir Putin.

Juan Andres Guerrero-Saade, principal threat researcher at cybersecurity firm SentinelOne, said it was too soon to confirm or speak about the technical particulars of this particular attack. But he noted that while skepticism is warranted with many contemporary “hacktivism” claims — which are often abused as fronts for state-sponsored operations or disinformation campaigns — the Belarus Cyber Partisans have so far “displayed consistent traits of authentic activism.”

“It’s fascinating to see ransomware being used to benefit the underdog in what’s ostensibly a revolutionary struggle,” he said. “That’s a nuance that we seldom deal with as we think primarily of targeted ransomware as an enterprise or financial concern.”

Belarusian Railways and the office of Belarusian President Alexander Lukashenko did not immediately respond to  messages asking about the situation.

Belarus, which shares a border with Ukraine just 56 miles from the Ukrainian capital city of Kyiv, serves as a key corridor for Russian military deployment. Belarus may also be involved on the cyber front. A senior Ukrainian security official told Reuters Jan. 15 that the country’s intelligence was involved in the cyberattacks that hit the Ukrainian government Jan. 14 that included website defacement as well as limited numbers of computer systems wiped.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure