A year ago, what was planned to be as a swift, focused, military invasion of Ukraine did not go according to Russian expectations. The war continues, and so do its effects on cybersecurity. Let’s focus attention on three key areas that have seen significant changes: state-sponsored activity, cybercrime, and hacktivism. Understanding their evolution will help security practitioners update threat models and better prepare for more changes.

State-Backed Tactics Above the Battlefield 

During the weeks preceding the official invasion of Ukraine, the ReliaQuest Photon Research team observed foreboding signs—among them, military movements along the Ukrainian borders and minor cyber attacks against Ukrainian private and public entities. Everything seemed to point to a wave of Russian state-sponsored destructive cyber attacks to support the invasion, multiplying the threat posed by the Russian army.  

That situation didn’t materialize with the scale and intensity predicted. However, Russian advanced persistent threat (APT) groups did steadily support on-ground Russian military operations, with multiple efforts in the cyber domain. 

Russian-government–backed APT groups have waged a range of cyber attacks against Ukrainian targets since the beginning of 2022. The goals have varied significantly, but they all probably correspond with Russian state goals. The social engineering campaigns would have aimed to secure initial network access and extract sensitive information. And wiper malware, such as “CADDYWIPER” and “PAYWIPE,” set their sights on disrupting business continuity and operational plans. Influence operations, such as disinformation campaigns, have also been used to shape the public perception of the war, undermining support for Ukraine and maintaining domestic support for the war. 

Despite these efforts, we haven’t observed the kind of paralyzing attacks we expected at the beginning of the war. Russian APT operations have been plentiful, but it’s hard to imagine that they’ve produced the desired results, given the on-ground war situation. Two main factors can offer an explanation.  

First, Ukraine has been heavily supported by NATO allies and has developed a stronger cyber-defense strategy than ever before. Second, given the lukewarm progress of the Russian military during the first months of the war, Moscow probably assigned far more resources to their army—rather than their cyber units—causing APT activity to slow. It’s also possible that Moscow simply pictured a quick win, which wouldn’t require loads of destructive cyber attacks in a country they would have to govern.  

But government-backed cyber units aren’t the only cyber groups that have been supporting Russian interests. Cybercriminals and hacktivists have stepped up in great numbers to leave their mark on the cyber-threat landscape.

Cybercrime Politicized: More than the Money

The cybercrime scene has seen major changes with Russia’s invasion of Ukraine. Several groups have appeared, or disappeared, and have adapted their tactics, techniques, and procedures (TTPs) to the shifting geopolitical conditions. This is natural, given the tight links between prominent cybercrime groups and the Commonwealth of Independent States region. 

The ransomware scene has been affected, too. Remember what happened with “Conti” in the aftermath of the invasion? After the high-profile ransomware gang publicly expressed their sympathy with the Russian cause, a Ukrainian security researcher leaked their communications. The resulting “Conti leaks” made other cybercriminals think twice about openly aligning with Russia’s goals. 

This mouths-shut approach has paid off for some groups. Ransomware activity has continued to thrive; among the beneficiaries was the “LockBit” group, which climbed to the top of the ransomware success pyramid by compromising targets at an unprecedented pace. By carefully refusing to align with any country involved in the war— and avoiding targeting critical national infrastructure—LockBit sidestepped a law-enforcement crackdown (at least for the moment).  

Other cybercrime groups have kept their Russian allegiance quiet but adjusted their targets and objectives to suit Russian interests. And so, we’ve seen significant TTP overlaps between cybercrime groups and Russian-backed APT groups—a trend that’s moving across the broader threat landscape. Cybercriminals are no longer focused solely on chasing the money.

Return of the Hack: Ideological Wartime Attacks

Before 2017, the ideologically motivated “Anonymous” collective gained global notoriety, but hacktivism has been in global decline since Anonymous activity dwindled. Cyber attacks attributed to hacktivist groups have been typically scarce and caused only minor lasting damage. The Russia-Ukraine war has dramatically changed this. 

Multiple ideologically motivated cyber-threat groups have emerged to conduct operations supporting either Russia or Ukraine. These groups aim to disrupt business and military operations with frequent, crowdsourced attacks, such as distributed denial of service (DDoS), website defacement, and targeted data breaches. Despite not being technically sophisticated, these attacks can mean a lot of downtime for business operations, not to mention the leak of personally identifiable information. 

With hacktivism’s resurgence, new groups have organized. The two most notable are “KillNet” and the “IT Army of Ukraine.” KillNet, named after a tool for launching DDoS attacks, suddenly and surprisingly rebranded at the beginning of the war, as a hacktivist group. KillNet received overwhelming support from the Russian public and is highly active against Western targets.  

The IT Army of Ukraine popped up in February 2022, at the request of the Ukrainian vice-prime minister and minister for digital transformation, to combat Russian cyber-action. Openly available on Telegram as the IT Army of Ukraine, this collective is probably the first example of a publicly announced, centrally organized hacktivist group operating in a crowdsourced way. This tweaking of how hacktivism is coordinated will probably be seen with future conflicts or geopolitical flash points.   

Hacktivists now represent one of the biggest cyber threats to most business, in terms of how likely attacks are and how much damage they’ll cause to business operations. The suspected ties between some hacktivist groups and Russian intelligence services will probably only strengthen their resources and technical skills.

Conclusion and Recommendations

This war has birthed probably the most innovative example of wartime state-directed cyber-activity, with converging espionage efforts, disruptive ransomware attacks and other cybercrime, and hacktivism against Ukrainian organizations. War as we’ve known it is disappearing, and being replaced by a cyber-enhanced version; if threat actors are carefully organized, their attacks can significantly multiply the threat of a field army.  

The traditional lines dividing groups (resources, motives, objectives, etc) are now increasingly blurred. Identifying attackers is no easy task, and that’s probably lending support to Russian interests and connected threats. Organizations should closely monitor any developments within Russian cyber-threat groups, to adjust threat models and improve resilience. If we’ve learned one thing over the past year, it’s that almost nothing is impossible if a well-resourced threat actor puts their mind to it.