Five Eyes pin Russia for pre-Ukraine invasion attack on Viasat

The Five Eyes nations consisting of the United States, United Kingdom, Australia, New Zealand, and Canada, as well as the European Union and Ukraine have pinned Russia for a series of cyber incidents leading up to the invasion of Ukraine.

Pulling up short of absolutely attributing the attack, the UK said it was “almost certain” that Russia caused the Viasat outage in February that began an hour before the invasion of Ukraine commenced.

“Although the primary target is believed to have been the Ukrainian military, other customers were affected, including personal and commercial internet users. Wind farms in central Europe and internet users were also affected,” the UK said.

The UK added tens of thousands of Viasat terminals were rendered inoperable thanks to the attack.

The United States said Russia had deployed multiple families of wiper malware including WhisperGate against the Ukrainian government and private sector networks.

“In the months leading up to and after Russia’s illegal further invasion began, Ukraine experienced a series of disruptive cyber operations, including website defacements, distributed denial-of-service attacks, and cyber attacks to delete data from computers belonging to government and private entities — all part of the Russian playbook,” the US said.

The Canadian attribution further pinned Russia for targeting Ukraine’s banking sector in February, historically exploiting the big SolarWinds vulnerability of 2021, going after Canadian COVID vaccine research, and interfering in Georgia’s parliamentary elections in 2020.

“Russian government cyber actors have compromised a number of Ukrainian civilian entities since October 2021 that would be involved in crisis response activities, including networks related to emergency services, energy, transport and also communications,” the Australian government said.

New Zealand said it would be sanctioning eight individuals and entities involved in the attacks and “Putin’s campaign of disinformation”.

“President Putin’s propaganda machine is in full swing, spreading lies and false information to justify Russia’s illegal invasion,” NZ Foreign Minister Nanaia Mahuta said.

“Today’s announcement reflects our complete rejection of Putin’s narrative and his attempts to mislead the international community.”

For its part, Ukraine said Russia had been attacking its cyberspace for eight years.

“Russia has launched at least several malware families upon Ukraine since the beginning of the year: WhisperGate/WhisperKill, CaddyWiper, Hermetic Wiper, Industroyer2, DoubleZero, etc,” it said.

“Russia uses cyberattacks to create a humanitarian disaster in Ukraine, since hackers are trying to disrupt operation of the energy sector, emergency services, communications, logistics.

“Russian hackers pose a threat not only to Ukraine, but to the whole world.”

Related Coverage