Ukraine Has Endured Thousands of Cyberattacks, Says Cybersecurity Official

An army of volunteers is collecting evidence of Russian war crimes and conducting offensive operations against Russia

In a briefing to reporters, Viktor Zhora, Deputy Head of the State Service for Special Communication and Information Protection of Ukraine, said since the days just before the Russian invasion of Ukraine, his office has registered nearly 3,000 cyberattacks, including as many as 275 distributed denial-of-service (DDoS) attacks in a single day.

But, he said, so far his office has not observed "super sophisticated activity" along the lines of prior attacks on critical infrastructure such as the electrical grid. He assessed multiple potential reasons for that, including that Russian cyber forces have likely had to assume a somewhat more defensive posture. Zhora emphasized that while the Ukrainian government is still primarily focused on defending its critical assets and officials, he is aware of a separate set of volunteer operations that are not coordinated by his office that are engaged in actions on behalf of Ukraine, including offensive cyberattacks directed at Russian military infrastructure. He said that his office had observed a notable increase in the number of attacks directed at Russian targets.

"Russia itself never faced so many attacks, mainly because all the countries were behaving responsibly in cyberspace," said Zhora. "And now, for the cyber community all around the globe, the limits are off and they feel free to use this opportunity to use aggression [during] this conventional war against Ukraine against civilians to show their skills at targeting Russia based military infrastructure and their government services, which are responsible for providing the war against Ukraine."

Zhora did confirm, however, that an attack on a Viasat satellite network did cause a communications outage on February 24, the day Russia invaded Ukraine. Zhora was not able to provide much detail or a specific attribution for the attack, but did say it resembled the "Russian methodology to attack communication lines."

Zhora said Ukraine hopes to eventually provide "lessons learned" during the war to "strengthen the protection of democratic countries that are attacked by countries like Russia." He also said his office is focused on collecting evidence that will aid it in attributing attacks in order to identify crimes in this "hybrid war" that can potentially be useful to prosecutors in the International Criminal Court.

With regard to the volunteers assisting Ukraine, Zhora said most of the activity is not offensive. "A lot of people are helping us on OSINT (open source intelligence), and delivering the truth" about Russian war crimes to Russian citizens, who he said are in the thrall of "constant lies" by Russian state media.

"They don't even know that [the Russian army] use mobile crematories, that they don't take the corpses of fallen Russian soldiers away, that they use force to kill Russian soldiers that are willing to surrender to Ukrainians," said Zhora. "All of this is absolutely unfamiliar to Russian audiences, and only a few people understand what's really happening in Ukraine. The idea was to use this IT army to deliver truthful content to a Russian audience, to mothers of Russian soldiers that are unaware of where their children are, what they are doing, that they are in Ukraine, that they are killing Ukrainian civilians."

A captured Russian soldier told CNN that behind the Russian front lines were "echelons [units] that kill deserters." According to the fact checking organization Snopes, it is alleged Russia has used mobile crematoriums in Ukraine in the past.

Zhora said those collecting OSINT are focused on identifying the exact names of "soldiers and officers and generals" that are responsible for conducting war crimes in Ukraine.

Zhora said in some regions, such as near Kherson, mobile networks have been damaged, but he believes outages are temporary. "We understand mobile coverage in every point of Ukraine is extremely important," and that operators are permitting internal roaming throughout the country. He suggested that maintaining communications is one reason why "Ukraine continues to resist this aggression."