Ukraine: Russian cyber attacks aimless and opportunistic

Russian cyber attacks on Ukrainian infrastructure have devolved into a chaotic series of opportunistic events.

That's according to Victor Zhora, the de facto head of cybersecurity for the Ukrainian government in Kyiv. Zhora, whose official title is deputy chairman of Ukraine's State Service of Special Communications and Information Protection (SSSCIP), has led the country's cyber-response efforts during the Russian invasion, which began in late February.

Speaking at the 2022 Blackberry Security Summit on Wednesday, Zhora described conditions amongst the country's infrastructure as "day to day" but noted that the nation has been able to remain resilient, thanks in part to the opposition's lack of organization.

Zhora said that in the early months of the war, the country saw the expected volume of attacks and exploits from Russia's military hacking units. Since then, however, things seem to have fallen apart for the Kremlin's cyber forces.

"There was a huge growth within the first months of war and a number of highly sophisticated attacks in March and April," said Zhora. "But up to the moment, we see no particular strategy, and we see rather opportunistic behavior."

The admission may not come as much of a surprise given what was already known about the nature of Russia's cyber-offensive against the Ukraine. Experts noted back in August that the vast majority of activity was being carried out by Russia's Main Directorate of the General Staff of the Armed Forces -- more commonly known as the GRU -- and other military and intelligence agencies.

As the military offensive has broken down, so too have the cyber attacks, it seems.

Zhora -- who shook off the label of "head of cybersecurity" in Ukraine and likens his role instead to that of a deputy officer in CISA -- said that the Ukrainian government has been dealing with Russian cyber attacks since the country's 2014 presidential elections and continuing to the 2017 outbreak of the NotPetya ransomware.

These years of constant attacks and threats allowed his and other government agencies to prepare themselves for the wave of cyber offensives that coincided with Russia's invasion of Ukraine.

"One of the key elements of this preparation was the training of professionals and task forces," Zhora explained. "We did exercises, hackathons and many other exercises. This is one of the key factors that helped us to ensure resilience in these challenging times."

Despite the resilience of Ukraine's internal networks and key government communication channels, Zhora noted that the country still faces challenges as it struggles to maintain basic utilities such as electricity. Zhora spoke at Black Hat USA 2022 in August with researchers from ESET. There, they detailed how the government and private sector companies joined forces to stop the Industroyer2 malware attacks, which were designed to trigger a blackout in the country.

He noted that his keynote address came at a rare time when both the power and network connection in his home were active, something that is not a given at a time when Kyiv remains a target for military attacks.

As for stopping the Russian cyber attacks entirely, Zhora believes that economic sanctions and other business incentives will cut off the lifeblood of Russia's remaining cyber efforts.

"We need to weaken our aggressor," he said. "We need to weaken his ability to attack Ukraine and other countries. This can be done with sanctions."