The Russian Invasion of Ukraine and the Looming Risk of a Global Cyber War

Suppressing target countries with air, land and naval fire support assets immediately before conventional operations is a well-known war strategy. Creating a surprise effect on the other side and neutralising critical targets identified in advance give the attacker a great advantage, while for the defender they can have devastating consequences.

In military literature, these activities carried out as part of shaping the battlefield are mostly conducted with conventional weapons. However, with Russia’s invasion of Ukraine, we see that “cyber attacks” too are being used as an important element of hybrid warfare in the activities of shaping the battlefield.

Russia’s Cyber Attacks on Ukraine Before the Invasion

Russia launched cyber attacks on Ukraine with the cyber attack groups it supports or that are part of its structures in the period before the morning of 24 February, when it began the invasion. In fact, the Russian attacks, which began in 2014 and reached levels of more than 288,000 cyber attacks in the first ten months of 2021, took on a different dimension before the invasion. Straining Ukraine’s information technology infrastructure with these attacks, which gathered pace from January 2022, Russia aimed to consolidate (strengthen) the combat superiority it had over Ukraine before the invasion.

On 23 February 2022, that is, just one day before the invasion, Russia began targeting the websites of critical Ukrainian public institutions and banks with cyber attacks. With this attack method, known in the literature as a “Distributed Denial of Service Attack”, or commonly “DDoS”, the aim is to send the server hosting a website far more requests from many different sources than it can handle, rendering the server inoperable and thus bringing the website down. It is not hard to imagine how devastating it was for Ukraine, as it prepared its defences, that the websites of critical public institutions became unreachable on the very eve of the war. And when we consider that this attack was carried out on a scale unprecedented in Ukraine’s history, the gravity of the event becomes even clearer.

Following the cyber attack launched on 23 February, according to a statement on a social media platform that evening by Ukraine’s Minister of Digital Transformation Mykhailo Fedorov, another cyber attack similarly began targeting Ukraine’s information technology systems. In this attack, it was reported that malware called a “wiper” had been activated on hundreds of computers and destroyed all data on the systems where it ran. While it was reported that the same attack was relaunched in a new form in the evening hours, it was established that the software used in these attacks had been installed on these systems on 28 December 2021 and had managed to hide itself since then.

Why Do Cyber Attacks on Ukraine Matter for Europe and the US?

Another parenthesis must be opened for Ukraine, whose information technology infrastructure was shaken by the attacks above. Although the cyber attacks Russia launched to soften the battlefield and shape the operational environment were on unprecedented scales, thanks to the strength of Ukraine’s information technology infrastructure and its high level of preparedness for these attacks, the websites of critical institutions and banks could be brought back up faster than expected.

Nevertheless, the cyber attacks carried out by Russia in Ukraine are being closely followed and watched with concern by economic circles in Europe and America. The first of the two main reasons for this is that Ukraine is one of the main outsourcing providers for Western business in the field of information technology. About 100 of the world’s 500 largest companies, including giants such as Amazon and Microsoft, receive outsourcing services from Ukraine for their information technology infrastructure. For this reason, attacks against Ukraine directly concern these companies and indirectly the states that host them.

The second reason is that the cyber attacks Russia has carried out in the past, particularly against Ukraine and some other states with which it has had disputes, have had consequences and caused damage on a global scale.

Cyber Attacks Backed by Russia Against States It Has Had Disputes With in the Past

According to a report prepared by the US Congressional Research Service, there are at least three cyber attack groups within Russia’s military intelligence service (GRU). Of these, the groups numbered 26165 and 74455 are the best known and most prominent. These two groups, among the state-backed threat actors known in the cyber security literature as “Advanced Persistent Threats (APT)”, are accused of carrying out cyber attacks before the 2016 presidential election on the servers running Hillary Clinton’s campaign and of seizing certain documents and e-mails so that they could be used as material against her campaign.

These Russian attack groups are also held responsible for the cyber attacks on Ukraine’s energy infrastructure, especially its power grids, in 2015 and 2016, and for the cyber attacks on Georgia’s parliament and media organisations in 2018 and 2019. Beyond that, the Russian Federation-backed cyber attack groups named above are also held responsible for the cyber attack called “NotPetya”, which was launched against Ukraine but spread worldwide and caused damage of about 10 billion dollars in total in many fields, above all the health and pharmaceutical sectors.

Russia’s Cyber Aggression and the Risk of a Global Cyber War

Russia’s adoption of such an aggressive stance both in the international arena and in the cyber world brings with it the risk of, and debates about, a global cyber war. US and UK authorities are warning businesses to strengthen their cyber security infrastructure in the face of similar Russian activities. Although in real life no one can risk going to war directly with Russia, the risk of cyber war increases every day.

In a statement to parliament on 21 February 2022, UK Defence Secretary Ben Wallace stressed the strength of the UK’s National Cyber Force. Using the words “I am a soldier, and I was always taught that attack is the most important part of defence”, the minister gave important hints about the UK’s cyber capabilities and that they could use them as an offensive force if necessary.

Similarly, among the options presented to US President Joe Biden as part of the sanctions to be imposed on Russia is a cyber attack option. According to an NBC News report based on certain security sources, bringing down Russia’s internet connection and disabling its power grids through cyber attacks was put to Biden as an option. Although no decision or action has been taken on this so far, the fact that it is being discussed as an option at the level of the US President shows that it would come as no surprise if, in the near future, cyber wars targeting information technology and capable of affecting humanity on a regional or global scale were to break out.

In short, with its multifaceted and intertwined structure, the new battlefield seems set to grow ever more complex with cyber attacks.