Cyber ​​attack hits Ukraine government websites

Several Ukrainian government websites were the target of a cyberattack with a threatening text warning Ukrainians to “be fearful and expect the worst” and claiming that their personal information was hacked.

“As a result of a massive cyber attack, the websites of the Ministry of Foreign Affairs and several other government agencies are temporarily down,” Foreign Ministry Spokesperson Oleg Nikolenko said on his official Twitter account on Friday. thursday (14th).

“Our experts have already started to restore the functioning of the IT systems and the cyber police have opened an investigation,” he added.

The attack appears to be a low-level incident, but it is symbolic of the end of a week of frantic diplomacy involving NATO, the Organization for Security and Cooperation in Europe (OSCE) and bilateral talks between Russia and the United States aimed at of trying to ease tensions on the Ukrainian border.

“According to an investigation by the Center for Strategic Communications and Information Security, early data suggests that the attack was carried out by the Russian Federation,” Ukraine’s Ministry of Information said in a statement.

“This is not the first time or even the second time that Ukrainian internet resources have been attacked since the beginning of Russian military aggression,” he added.

Most of the affected state resources have now been restored, according to Ukraine’s security service, which said personal data had not been breached.

What happened?

Early on Friday morning, Ukrainian government websites, including the Ministry of Foreign Affairs, displayed dark screens with ominous text that said Ukrainians’ personal information had been hacked.

“Ukrainian! All your personal data has been uploaded to the public network. All data on the computer has been destroyed, it is impossible to restore it,” read the message, published in Ukrainian, Russian and Polish.

“All information about you has become public, be afraid and expect the worst. This is for you for your past, present and future. For Volhynia, for the OUN UIA [Organização dos Nacionalistas Ucranianos Exército Insurgente Ucraniano], to Galicia, to Polesie and through historic lands”, read the web page.

The UIA and the OUN were Ukrainian ultranationalist groups that fought for independence during the Soviet era, while Galicia, Volhynia and Polesie are areas from which they historically gained high levels of support.

A statement from Ukraine’s Ministry of Culture and Information Policy suggested the text mentioned the groups and regions as a “way of hiding the ‘Russian footprint’ by hackers.

“It is obvious that this was done on purpose to cast a shadow over the hacker attack on Poland: Russia and its representatives have been working for a long time to create the quarrel between two friendly neighboring countries,” the ministry added in a statement.

The Security Service of Ukraine said in a statement that while “provocative messages were posted on the main page of these websites”, the content of the websites was not changed, adding that “the leakage of personal data, according to preliminary information, did not take place”.

The websites of the ministries of Education, Foreign Affairs, Sport, Energy, Agrarian Policy, Veterans, Environment and the Emergency Service of Ukraine’s state and state treasury were targeted, according to state media Ukrinform.

The Ministry of Education and Science, whose official website is down, directed citizens to use the ministry’s official social media channels on Friday while the issue is being resolved.

The head of Ukraine’s security and intelligence technical service, Yuri Shchigol, said nearly 70 websites of central and regional authorities were affected.

“It appears that each of these sites was developed on behalf of the government of Ukraine by a Ukrainian company called Kitsoft,” Matt Olney, director of threat intelligence and interdiction at Talos, the threat intelligence unit of tech giant Cisco, told CNN.

“While obviously unfortunate, we do not view this event per se as indicating an increase or decrease in risk. [cibernético] in Ukraine,” he added.

Kitsoft, a Kiev-based software company, did not immediately respond to a request for comment on Friday.

While the Ukrainian government has hinted at Russian involvement in the hack, outside experts say they cannot make this attribution without forensic evidence.

Oleh Derevianko, founder of Kiev-based cybersecurity firm ISSP, said he was not surprised by the defacement of government websites.

“It’s a good illustration of how you can use a simple disfigurement attack as an informational op tool when everyone is so nervous and agitated about a possible break-in,” he told CNN.

Attacks add to an ‘already tense situation’

EU chief diplomat Josep Borrell condemned the cyberattack, warning that it contributed to the “already tense situation” in the region.

During a joint press conference with the French Foreign Minister in Brest, France, on Friday, Borrell, the EU’s high representative for foreign affairs and security policy, said he had called an emergency meeting upon learning of the attack. to Ukrainian government websites.
“Such actions aimed at destabilizing Ukraine contribute to a further escalation of the already tense situation,” Borrell said.

When asked whether Russian government or non-government actors were behind the attacks, Borrell replied that while he didn’t want to “point fingers”, “there is a certain probability where they came from”.

Ukrainian Foreign Ministry spokesman Oleg Nikolenko said on Friday that it was “too early to draw conclusions” about who was behind the attack, but said there was a “long record of Russian cyber attacks against Ukraine in the past”.

Separately, Ukraine’s Defense Ministry claimed in a statement on Friday that Russian special services are preparing provocations against Russian military personnel to accuse Ukraine.

The statement from the ministry’s intelligence directorate said: “The aggressor country’s military units and their satellites are ordered to prepare for such provocations.”

A CNN contacted the Russian Ministry of Defense for comment on both allegations.