Trace Id is missing

Special Report: Ukraine

Download
Share
A map of ukraine with a blue background.

An overview of Russia’s cyberattack activity in Ukraine

This interim report details the cyber activity Microsoft has observed as part of the war in Ukraine, and the work we have done in collaboration with Ukrainian cybersecurity officials and private sector enterprises to defend against cyberattacks. Microsoft’s ongoing, daily engagement establishes that the cyber component of Russia’s assault on Ukraine has been destructive and relentless. The purpose of this report is to provide insights into the scope, scale, and methods of Russia’s use of cyber capabilities as part of the largescale “hybrid” war in Ukraine, to acknowledge the work of organizations in Ukraine defending against persistent adversaries, and to provide strategic recommendations to organizations worldwide.

Throughout this conflict, we have observed Russian nation state cyber actors conducting intrusions in concert with kinetic military action.

At least six Russian Advanced Persistent Threat (APT) actors and other unattributed threats, have conducted destructive attacks, espionage operations, or both, while Russian military forces attack the country by land, air, and sea. It is unclear whether computer network operators and physical forces are just independently pursuing a common set of priorities or actively coordinating. However, collectively, the cyber and kinetic actions work to disrupt or degrade Ukrainian government and military functions and undermine the public’s trust in those same institutions.

Destructive attacks have been a prominent component of Russian cyber operations during conflict.

A day before the military invasion, operators associated with the GRU, Russia’s military intelligence service, launched destructive wiper attacks on hundreds of systems in Ukrainian government, IT, energy, and financial organizations. Since then, the activity we have observed has included attempts to destroy, disrupt, or infiltrate networks of government agencies, and a wide range of critical infrastructure organizations, which Russian military forces have in some cases targeted with ground attacks and missile strikes. These network operations have at times not only degraded the functions of the targeted organizations but sought to disrupt citizens’ access to reliable information and critical life services, and to shake confidence in the country’s leadership. 

Based on Russian military goals for information warfare, these actions are likely aimed at undermining Ukraine’s political will and ability to continue the fight, while facilitating collection of intelligence that could provide tactical or strategic advantages to Russian forces. Through our engagements with customers in Ukraine, we have observed that Russia’s computer-enabled efforts have had an impact in terms of technical disruption of services and causing a chaotic information environment, but Microsoft is not able to evaluate their broader strategic impact.

Related articles

Defending Ukraine: Early Lessons from the Cyber War

The latest findings in our ongoing threat intelligence efforts in the war between Russia and Ukraine, and a series of conclusions from its first four months reinforces the need for ongoing and new investments in technology, data, and partnerships to support governments, companies, NGOs, and universities.
Learn more

Rising cyber threats in response to expanding IoT/OT connectivity

In our latest report, we explore how increasing IoT/OT connectivity is leading to greater and more-severe vulnerabilities for organized cyber threat actors to exploit.
Learn more

Cyber Signals Issue 2: Extortion Economics

Hear from frontline experts on the development of ransomware as a service. From programs and payloads to access brokers and affiliates, learn about the tools, tactics, and targets cybercriminals favor, and get guidance to help protect your organization.
Learn more

Follow Microsoft Security