Cisco warned of a large-scale cyber attack by “Russian hackers” on Ukraine

Alleged hackers from Russia are preparing a large-scale cyber attack on Ukraine, according to Cisco cybersecurity experts. To do this, they infected at least 500,000 routers and storage devices in 54 countries with "very complex" viruses. “With a virus network like that, you can do anything,” told Cisco employee Craig Williams Reuters. During previous cyberattacks on the Ukrainian energy system, millions of people were left without electricity.

Details

According to Cisco, the hackers are using malware called VPNFilter, which allows them to intercept all traffic on an affected device, remotely control it, and infect new targets. In addition, the software has the function of automatic self-destruction and removal of other programs from the infected device. One variant of the virus targets industrial computers, allowing hackers, for example, to gain access to power grid control systems.

• According to Cisco, the VPNFilter viruses use code that was used during previous cyberattacks that US authorities blame Russia for. In particular, there is a similarity with the NotPetya virus. This allows us to speak with "high confidence" about the responsibility of the Russian authorities.
• VPNFilter has infected at least 500,000 devices in 54 countries, and the actual number could be much higher, experts say.
• In Ukraine, a surge in infections has been observed since May 8. This means that the attack is planned for the day of the constitution of Ukraine on June 28, Williams said. Reuters notes that previous major cyber attacks on Ukraine took place during the holidays: the NotPetya virus in June 2017 and the attacks, as well as attacks on energy facilities in 2015 and 2016, shortly before Christmas.
• Russia of preparing a cyber attack using VPNFilter The SBU also accused : the Ukrainian intelligence service is waiting for a large-scale attack on the eve of the Champions League final taking place in the country on May 26.

Context

• The most famous attack that Russia is accused of is the NotPetya ransomware virus. At the end of June last year, a virus blocked Windows computers and demanded the equivalent of $300 in bitcoins to unlock. The virus hit several countries at once, including complaints from the United States, Great Britain, Germany and Russia (in particular, from Rosneft). Ukraine has suffered the most from NotPetya - Ukrainian energy networks, the government system and several banking structures have been attacked. There have been reports of the attack from many other countries, including the US, Russia, the UK and Germany. The United States and Britain officially accused Russia of masterminding the attack.
• The damage from the NotPetya attack around the world amounted to at least $1.2 billion.
• The power grids of Ukraine have been regularly subjected to cyberattacks over the past few years: after one of them in December 2015, were left 1.4 million Ukrainians in 2016 without electricity. A similar attack took place . In both cases, Ukraine blames Russia. You can read in detail and interesting about the investigation of cyberattacks here .

https://www.youtube.com/watch?v=8ThgK1WXUgk

• Washington also suspects Russia of interfering in the 2016 US presidential campaign, including through cyberattacks. Moscow denies all accusations.

What do I get from this?

All such reports, regardless of the factual veracity, reinforce the negative perception of Russia in the West and sometimes lead to specific measures - the latest US economic sanctions were imposed on the basis of the " Kremlin report " of the US Treasury, which was prepared, among other things, in response to alleged cyber attacks on Russia during the elections in USA.

Artem Gubenko