An Introduction to Cyberwar: The Russia–Ukraine War

Suppressing the target country with air, land and naval fire support just before conventional operations is a familiar war strategy.

In military literature, these activities, carried out as part of shaping the battlefield, are mostly conducted with conventional weapons.

With Russia’s invasion of Ukraine, however, we see “cyberattacks” also being used, as an important element of hybrid warfare, in shaping the battlefield.

Russia’s Cyberattacks on Ukraine before the Invasion

Through the cyberattack groups it supports or that sit within its own structures, Russia launched cyberattacks against Ukraine in the period before the morning of 24 February 2022, when it began its invasion.

Russian attacks, which had begun in 2014 and reached more than 288,000 cyberattacks in the first ten months of 2021, were taken to another level before the invasion.

With these attacks, which gathered pace from January 2022 and strained Ukraine’s information technology infrastructure, Russia aimed to consolidate the military superiority it held over Ukraine before the invasion.

On 23 February 2022, the day before the invasion, Russia began targeting the websites of Ukraine’s critical public institutions and banks with cyberattacks.

With this method, known in the literature as a “Distributed Denial of Service” attack, or DDoS for short, the aim is to send the server hosting a website far more requests from many different sources than it can handle, rendering it inoperable and thus bringing the website down.

It is not hard to imagine how devastating it was for Ukraine, preparing its defences, to have the websites of critical public institutions become unreachable on the very eve of the war. When we consider that this attack was carried out on a scale unprecedented in Ukraine’s history, the gravity of the event becomes even clearer.

After the cyberattack launched on 23 February 2022, according to a statement on social media that same afternoon by Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov, another cyberattack began targeting Ukraine’s information technology systems in a similar way.

In this attack, it was reported that a piece of malware called a “wiper” had been activated on hundreds of computers and destroyed all the data on the systems where it ran. While it was reported in the evening that the same attack had been launched again in a new form, it was established that one of the analysed samples of the HermeticWiper malware used in the attack carried a compilation timestamp of 28 December 2021, a finding that suggested the attack had been prepared in advance.

Why Do the Cyberattacks on Ukraine Matter to Europe and the US?

For Ukraine, whose information technology infrastructure was shaken by the attacks described above, another point must be made. Although the cyberattacks Russia launched to soften the battlefield and shape the operational environment were on an unprecedented scale, thanks to the strength of Ukraine’s IT infrastructure and its high level of preparedness for such attacks, the websites of critical institutions and banks were restored faster than expected.

At the same time, Russia’s cyberattacks in Ukraine are being followed closely and with concern by business circles in Europe and America.

The first of two main reasons is that Ukraine is one of the main outsourcing providers in information technology for Western business. About 100 of the world’s 500 largest companies, including giants such as Amazon and Microsoft, outsource IT infrastructure services from Ukraine. Attacks on Ukraine therefore concern these companies directly and, indirectly, the states that host them.

The second reason is that the cyberattacks Russia has carried out in the past, particularly against Ukraine and some other states it has had disputes with, have caused consequences and damage on a global scale.

Cyberattacks Russia Has Backed against States It Has Had Disputes With

According to a report by the US Congressional Research Service, Russia’s military intelligence service (GRU) has at least three cyberattack units.

Of these, the groups with the numbers 26165 and 74455 are the best known and most prominent.

These two groups, among the state-backed threat actors known in cybersecurity literature as “Advanced Persistent Threats” (APTs), are accused of carrying out cyberattacks on the servers used by Hillary Clinton’s campaign before the 2016 presidential election and of seizing documents and e-mails so that they could be used as material against her campaign.

Of these, unit 74455 in particular is also held responsible for the cyberattacks on Ukraine’s energy infrastructure, and especially its power grid, in 2015 and 2016, and for the cyberattacks on Georgia’s parliament and media organisations in 2018 and 2019.

Beyond this, GRU unit 74455 in particular is held responsible for the “NotPetya” cyberattack, which was launched against Ukraine but spread around the world and caused some 10 billion dollars in damage in many sectors, above all healthcare and pharmaceuticals.

Russia’s Cyber Aggression and the Risk of Global Cyberwar

Russia’s aggressive stance, both on the international stage and in the cyber world, raises the risk of, and debate about, a global cyberwar.

US and UK authorities are warning businesses to strengthen their cybersecurity infrastructure in the face of similar Russian cyber activity. Although in real life no one dares to enter a direct war with Russia, the risk of cyberwar grows every day.

In a statement to Parliament on 21 February 2022, Ben Wallace, the then UK Defence Secretary, highlighted the strength of the UK’s National Cyber Force. Using the words “I am a soldier, and I was always taught that offence is the most important part of defence”, the minister gave significant hints about the UK’s cyber capabilities and its readiness to use them offensively if necessary.

Similarly, among the options presented to US President Joe Biden as part of the sanctions on Russia was a cyberattack option.

According to an NBC News report based on security sources, crippling Russia’s internet connectivity and knocking out its power grids through cyberattacks was put before Biden as an option.

Although no decision or action has been taken on this so far, the fact that it is being discussed as an option at the level of the US President shows that cyberwars targeting information technology and capable of affecting humanity on a regional or global scale would come as no surprise in the near future.

In short, with its multifaceted and intertwined structure, the new battlespace looks set to grow ever more complex with cyberattacks.