Russian Malware in the Ukraine War

Chris Kubecka, a security researcher, describes being in Ukraine when the invasion began in February 2022 and then evacuating by road toward the Romanian border. She frames the talk around what she saw firsthand and the ongoing work she does with emergency response teams and officials in the Ukrainian government.

The central story is wiper malware. A destructive attack hit systems used by the border patrol, so officials checked documents on paper and by landline, and vehicles queued for days in freezing weather while fuel was rationed. Other effects she describes include ATM and banking outages, a cyberattack on water facilities in the Luhansk region, a wiped database of children in state care that left many without identification, and disruptions to the Diia identity app. She also covers cloned government websites and the mix of propaganda, misinformation, disinformation and malinformation used to shape public opinion.

In the question period she discusses links between cyber activity and physical attacks, possible precursors, the use of hacktivists and ransomware groups, and the uneven technical sophistication she observed. Her takeaway for practitioners is that attacks on infrastructure translate directly into harm for civilians, so resilience planning for essential services and smaller vendors matters, and preparation should happen before a conflict escalates.