White House pins Ukraine DDoS attacks on Russian GRU hackers

Today, the White House has linked the recent DDoS attacks that knocked down the sites of Ukrainian banks and defense agencies to Russia’s Main Directorate of the General Staff of the Armed Forces (also known as GRU).

“The US government believes that Russian cyber actors likely have targeted the Ukrainian government, including military and critical infrastructure networks, to collect intelligence and preposition to conduct disruptive cyber activities,” said Deputy National Security Advisor for Cyber Anne Neuberger.

“We believe that the Russian government is responsible for wide-scale cyberattacks on Ukrainian banks this week.

“We have technical information that links the Russian main intelligence directorate, or GRU, as known GRU infrastructure was seen transmitting high volumes of communication to Ukraine-based IP addresses and domains.”

Neuberger also added that, although “of limited impact” these incidents could be part of a more significant Russian effort to prepare for other, “laying groundwork” for more disruptive attacks that would come together with a potential invasion of Ukraine’s territory.

Ilya Vityuk, the cybersecurity chief of Ukraine’s SBU intelligence agency, also accused Russia of coordinating this week’s attacks targeting sites belonging to Ukrainian banks and government agencies.

However, the Kremlin has denied all accusations, with spokesperson Dmitry Peskov saying that Russia had absolutely nothing to do with the denial of service attacks.

“And, as the President said earlier this week, if Russia attacks the United States or allies through asymmetric activities like disruptive cyberattacks against our companies or critical infrastructure, we are prepared to respond,” Neuberger added.

The incidents Neubergerer refers to are DDoS attacks that targeted online services belonging to the Ukrainian military and state-owned bank websites earlier this week.

On Tuesday, the Ministry of Defense and the Armed Forces of Ukraine and two of the country’s state-owned banks, Oschadbank (the State Savings Bank) and Privatbank (Ukraine’s largest bank), were taken down after being hammered by DDoS attacks.

While the Ukrainian defense ministry’s website was knocked out, Oschadbank’s and Privatbank’s sites were still accessible, even though customers could not log into their online banking accounts.

The attacks followed a Monday press release from the Security Service of Ukraine (SSU)—whose website has been unreachable since Wednesday—saying that the country is currently being targeted by a “massive wave of hybrid warfare.”

This campaign’s end goal is to trigger anxiety and undermine Ukrainians confidence in the state’s ability to defend them, according to the SSU.

The Ukrainian Computer Emergency Response Team also warned of attacks targeting Ukrainian authorities, coordinated by the Gamaredon hacking group (previously linked to Russia’s Federal Security Service (FSB) by the Ukrainian security and secret services).

“It’s unsurprising to learn that the DDOS attacks in Ukraine were conducted by the GRU. Russia’s military intelligence service is the most aggressive of its peers when it comes to cyberattacks and other activity in the sphere,” John Hultquist, VP of Intelligence Analysis at Mandiant, told BleepingComputer.

“We have seen them carry out DDOS attacks on several occasions which they use to harass and undermine institutions. It’s not unusual for incidents such as these to be nested within a larger campaign that can take many forms from hack and leak to serious destructive attack.”