After years of talks about the need for public-private partnerships to combat cyberattacks, the war in Ukraine is stress-testing the system.
Ukrainians gather in a train station in Kyiv in an effort to leave the city shortly after the Russian invasion began.
WASHINGTON — Last Wednesday, a few hours before Russian tanks began rolling into Ukraine, alarms went off inside Microsoft’s Threat Intelligence Center, warning of a never-before-seen piece of “wiper” malware that appeared aimed at the country’s government ministries and financial institutions.
Within three hours, Microsoft threw itself into the middle of a ground war in Europe — from 5,500 miles away. The threat center, north of Seattle, had been on high alert, and it quickly picked apart the malware, named it “FoxBlade” and notified Ukraine’s top cyberdefense authority. Within three hours, Microsoft’s virus detection systems had been updated to block the code, which erases — “wipes” — data on computers in a network.
Then Tom Burt, the senior Microsoft executive who oversees the company’s effort to counter major cyberattacks, contacted Anne Neuberger, the White House’s deputy national security adviser for cyber- and emerging technologies. Ms. Neuberger asked if Microsoft would consider sharing details of the code with the Baltics, Poland and other European nations, out of fear that the malware would spread beyond Ukraine’s borders, crippling the military alliance or hitting West European banks.
Before midnight in Washington, Ms. Neuberger had made introductions — and Microsoft had begun playing the role that Ford Motor Company did in World War II, when the company converted automobile production lines to make Sherman tanks.
After years of discussions in Washington and in tech circles about the need for public-private partnerships to combat destructive cyberattacks, the war in Ukraine is stress-testing the system. The White House, armed with intelligence from the National Security Agency and United States Cyber Command, is overseeing classified briefings on Russia’s cyberoffensive plans. Even if American intelligence agencies picked up on the kind of crippling cyberattacks that someone — presumably Russian intelligence agencies or hackers — threw at Ukraine’s government, they do not have the infrastructure to move that fast to block them.
“We are a company and not a government or a country,” Brad Smith, Microsoft’s president, noted in a blog post issued by the company on Monday, describing the threats it was seeing. But the role it is playing, he made clear, is not a neutral one. He wrote about “constant and close coordination” with the Ukrainian government, as well as federal officials, the North Atlantic Treaty Organization and the European Union.
ImageMicrosoft President Brad Smith speaking with President Joe Biden at the White House in January.Credit…Sarahbeth Maney/The New York Times
“I’ve never seen it work quite this way, or nearly this fast,” Mr. Burt said. “We are doing in hours now what, even a few years ago, would have taken weeks or months.”
The intelligence is flowing in many directions.
Company executives, some newly armed with security clearances, are joining secure calls to hear an array of briefings organized by the National Security Agency and United States Cyber Command, along with British authorities, among others. But much of the actionable intelligence is being found by companies like Microsoft and Google, who can see what is flowing across their vast networks.
Mr. Biden’s aides often note that it was a private firm — Mandiant — that found the “SolarWinds” attack 15 months ago, in which one of Russia’s most cybersavvy intelligence agencies, the S.V.R., infiltrated network management software used by thousands of U.S. government agencies and private businesses. That gave the Russian government unfettered access.
Such attacks have given Russia a reputation as one of the most aggressive, and skilled, cyberpowers. But the surprise of recent days is that Russia’s activity in that realm has been more muted than expected, researchers said.
Most early tabletop exercises about a Russian invasion started with overwhelming cyberattacks, taking out the internet in Ukraine and perhaps the power grid. So far, that hasn’t happened.
“Many people are quite surprised that there isn’t significant integration of cyberattacks into the overall campaign that Russia is undertaking in Ukraine,” said Shane Huntley, the director of Google’s threat analysis group. “This is mostly business as normal as to the levels of Russian targeting.”
Live Updates: Russia-Ukraine War
Updated Feb. 28, 2022, 8:47 p.m. ET
- Disney will pause theatrical movie releases in Russia.
- Refugees fleeing Ukraine describe their experiences: ‘People haven’t slept in days’
- Bulgaria’s leader contrasts ‘intelligent,’ ‘educated’ refugees with those from the Middle East.
Mr. Huntley said Google regularly observes some Russian attempts to hack accounts of people in Ukraine. “The normal level is actually never zero,” he said. But those attempts have not markedly increased in the past several days, as Russia has invaded Ukraine.
“We have seen some Russian activity targeting Ukraine; it just hasn’t been the big sets,” said Ben Read, a director at the security firm Mandiant.
It is not clear to American or European officials why Russia held off.
It could be that they tried but defenses were stronger than they anticipated, or that the Russians wanted to reduce the risk of attacking civilian infrastructure, so that a puppet government they installed would not struggle to rule the country.
But American officials said a massive cyberattack by Russia on Ukraine — or beyond, in retaliation for the economic and technology sanctions imposed by the United States and Europe — is hardly off the table. Some speculate that just as Moscow steps up its indiscriminate bombing, it will seek to cause as much economic disruption as it can muster.
The longer and more effectively the Ukrainian resistance holds out against Russia’s army, the more Moscow could be tempted to begin using “the armada of Russian cyberforces,” Senator Mark Warner, the Virginia Democrat who leads the Senate Intelligence Committee, said in an interview last week.
Meta, the parent company of Facebook, disclosed on Sunday that it had discovered hackers taking over accounts belonging to Ukrainian military officials and public figures. The hackers tried to use their access to these accounts to spread disinformation, posting videos that purported to show the Ukrainian military surrendering. Meta responded by locking down the accounts and alerting the users who had been targeted.
Understand Russia’s Attack on Ukraine
Card 1 of 7
What is at the root of this invasion? Russia considers Ukraine within its natural sphere of influence, and it has grown unnerved at Ukraine’s closeness with the West and the prospect that the country might join NATO or the European Union. While Ukraine is part of neither, it receives financial and military aid from the United States and Europe.
Are these tensions just starting now? Antagonism between the two nations has been simmering since 2014, when the Russian military crossed into Ukrainian territory, after an uprising in Ukraine replaced their Russia-friendly president with a pro-Western government. Then, Russia annexed Crimea and inspired a separatist movement in the east. A cease-fire was negotiated in 2015, but fighting has continued.
How did this invasion unfold? After amassing a military presence near the Ukrainian border for months, on Feb. 21, President Vladimir V. Putin of Russia signed decrees recognizing two pro-Russian breakaway regions in eastern Ukraine. On Feb. 23, he declared the start of a “special military operation” in Ukraine. Several attacks on cities around the country have since unfolded.
What has Mr. Putin said about the attacks? Mr. Putin said he was acting after receiving a plea for assistance from the leaders of the Russian-backed separatist territories of Donetsk and Luhansk, citing the false accusation that Ukrainian forces had been carrying out ethnic cleansing there and arguing that the very idea of Ukrainian statehood was a fiction.
How has Ukraine responded? On Feb. 23, Ukraine declared a 30-day state of emergency as cyberattacks knocked out government institutions. Following the beginning of the attacks, Volodymyr Zelensky, Ukraine’s president, declared martial law. The foreign minister called the attacks “a full-scale invasion” and called on the world to “stop Putin.”
How has the rest of the world reacted? The United States, the European Union and others have condemned Russia’s aggression and begun issuing economic sanctions against Russia. Germany announced on Feb. 23 that it would halt certification of a gas pipeline linking it with Russia. China refused to call the attack an “invasion,” but did call for dialogue.
How could this affect the economy? Russia controls vast global resources — natural gas, oil, wheat, palladium and nickel in particular — so the conflict could have far-reaching consequences, prompting spikes in energy and food prices and spooking investors. Global banks are also bracing for the effects of sanctions.
Twitter said it had found signs that hackers attempted to compromise accounts on its platform, and YouTube said it had removed five channels that posted videos used in the disinformation campaign.
Meta executives said the Facebook hackers were affiliated with a group known as Ghostwriter, which security researchers believe to be associated with Belarus.
Ghostwriter is known for its strategy of hacking public figures’ email accounts, then using that access to compromise their social media accounts as well. The group has been “heavily active” in Ukraine during the past two months, said Mr. Read, who researches the group.
While U.S. officials do not currently assess any direct threat to the United States from stepped-up Russian cyberoperations, that calculation could change.
U.S. and European sanctions are biting harder than expected. Mr. Warner said that Russia could respond “with either direct cyberattacks against NATO countries or, more likely, in effect unleashing all of the Russian cybercriminals on ransomware attacks at a massive level that still allows them some deniability of responsibility.”
Russian ransomware criminal groups conducted a devastating series of attacks in the U.S. last year against hospitals, a meat-processing company and most notably, the company that operates gasoline pipelines along the East Coast. While Russia has taken steps to rein in those groups in recent months — after months of meetings between Ms. Neuberger and her Russian counterpart, Moscow conducted some high-profile arrests in January — it could easily reverse its crackdown efforts.
But President Biden has stepped up his warnings to Russia against any sort of cyberattack on the United States.
“If Russia pursues cyberattacks against our companies, our critical infrastructure, we are prepared to respond,” Mr. Biden said on Thursday.
It was the third time Mr. Biden had issued such a warning since winning the election. While any Russian attack on the U.S. seems like it would be a reckless escalation, Representative Adam B. Schiff, the California Democrat who leads the House Intelligence Committee, noted that Mr. Putin’s decision-making so far has proved poor.
“There’s a risk that whatever cybertools Russia uses in Ukraine don’t stay in Ukraine,” he said in an interview last week. “We’ve seen this before, where malware directed to a certain target gets released in the wild and then takes on a life of its own. So we could be the victim of Russian malware that has gone beyond its intended target.”
Source: nytimes.com
