Mapping the Shadow War From Estonia to Ukraine

Evolution of Russian Cyber Operations

This presentation details the evolution of Russian cyber operations, tracing their integration with military actions from 2007 to the present. The speaker, a Senior Director of Research and Threat Intelligence at Cipher with a background in US Army cyber intelligence, highlights how Russia learns and adapts its cyber tactics with each operation.

Early Cyber Operations: Estonia (2007) and Georgia (2008)

Estonia (2007): The first major operation involving cyber elements. Russia used crowdsourcing of cybercriminals to support a campaign of misinformation regarding the removal of a Soviet soldier statue. Distributed Denial of Service (DDoS) attacks were used to overwhelm Estonian defenses, effectively disconnecting the country from the internet. This had significant downstream impacts, disrupting ATM services and news dissemination.

Georgia (2008): Russia employed similar tactics, including misinformation campaigns and crowdsourcing of cybercriminals, to support its annexation of Georgian regions. New tactics introduced included kinetic attacks on communication towers to disrupt internet access and Border Gateway Protocol (BGP) hijacking to route Georgian internet traffic through Russian infrastructure, granting them full control.

Escalation and Sophistication: Crimea (2014)

During the annexation of Crimea, Russia escalated its tactics by deploying a covert unit to attack a Ukrainian telecom provider. Leveraging the "SORM" platform, which mandates Russian ISPs and telecom providers to have surveillance capabilities, they were able to intercept and control communications. Electronic warfare units were deployed to disable Ukrainian military communications, including satellite jammers, effectively isolating Ukrainian forces and contributing to their surrender.

Full-Scale Invasion: Ukraine (2022)

The full-blown invasion of Ukraine in February 2022 largely followed the playbook used in Crimea, incorporating misinformation, data wipes, and control of communications. Key advancements observed were:

Deepfake Technology: Use of deepfake videos for information operations, including a fake video of President Zelensky urging troops to surrender.

Compromise of Satellite Terminals: Russian forces were able to jam satellite communications and compromise Viasat and Starlink terminals. A sophisticated method involved planting malware on captured Android devices used by Ukrainian troops, which were then left behind to be picked up by Ukrainian forces, allowing for Starlink terminal compromise.

The Great Hacker Migration

The war in Ukraine and Russia's partial mobilization have led to a significant movement of cybercriminals. The speaker identifies three waves:

Early War: Cybercriminals fled Ukraine and Russia to nearby countries like Georgia, Thailand, and Vietnam.

Post-Mobilization: As Russia announced partial mobilization, more individuals, including cybercriminals, left the country. This led to increased scrutiny and changes in immigration policies in countries that initially welcomed them.

Current Wave: Following unprecedented law enforcement operations within Russia against cybercriminal groups (even those previously protected by FSB payoffs), the prediction is a move towards South America due to lax visa and money laundering regulations.

Future Outlook and Key Takeaways

Continued Evolution: Russia will continue to evolve its cyber warfare capabilities, integrating AI and deepfakes. Companies dealing with biometric data are at higher risk due to the immutability of facial and fingerprint data.

BGP Hijacking: This remains a significant concern, as it allows Russia to gain full control and visibility over routed traffic. The Yava law in Russia mandates ISPs to retain metadata for six months, accessible by the FSB without court orders.

SORM Platform: This platform ensures Russian telecom providers have surveillance capabilities, allowing for interception of all communications within Russia.

Cybercriminal Collaboration: Potential for collaboration between cybercriminals and cartels is a growing concern, given the organized nature of cartels and their control over various industries, including potentially impacting food supply chains (e.g., avocados).

Reduced Crowdsourcing: The "great hacker migration" may degrade Russia's ability to crowdsource cybercriminal support for military operations, which is a positive development.