More than any of the mixed signals of the high-level meetings between the U.S. and Russia, two cyberwar developments today are far more clear indicators of the direction of the Ukrainian conflict playing out between NATO, Putin, and the U.S.

One event – a major cyberattack on Ukrainian government websites – does not, as of yet, have direct nation-state attribution to Russia (which is possibly how they want the attack to “play’ in the media.  Cyberattack as misinformation).  The other  – the Russian Federal Security Service (FSB) takedown of the REvil Ransomware Gang – is very specific, positive signaling from the Kremlin to the White House that they understand the seriousness with which the U.S. military and intelligence apparatus are taking the strategic cyber threats posed by Russia to the U.S. political and economic systems and the U.S. homeland.

The concurrent elements of appeasement and aggression are troubling.  Both events have false flag elements relative to the other, which makes for both a tactical and strategic quandary for the U.S. and Ukraine (as the governments and military sort out the true impact and implications of these cyber maneuvers by Russian state and non-state actors). Are both incidents integrated active measures and only part of a larger geopolitical operation by the Russians?

FSB Shuts Down REvil Ransomware Gang

Moments ago (and just days after talks on Ukraine, where the U.S. and Russia Deadlocked Over NATO Expansion),  The Record just reported that “The Russian Federal Security Service (FSB) said today that it has raided and shut down the operations of the REvil ransomware gang.” (1)

Below, we include the full text of the press release sent out by the FSB today to highlight the specificity of the language about cooperation with U.S. law enforcement, consistent with a direct request by the U.S. in July that Russia must crack down on cybercriminals.

This raid signals cooperation with the U.S. requests made by phone directly by President Biden to President Putin and reinforced during negotiations a few days ago.  What is unclear is, while this raid is a positive development in U.S/Russia relations, how does the raid impact the conditions on the ground in Ukraine?  The raid appeases the U.S. but does not directly address Ukraine’s interests and the military threat posed by Russia to the region.

The full text of the FSB Press Release [CAPS theirs]:

According to CNN:  “A threatening message of “be afraid and wait for the worst” was shone on a number of Ukrainian government websites after they were targeted in a cyberattack.”  Source: CNN.com

Source: https://archive.fo/VIDeS/image

Today’s OODA Loop Daily Pulse included the following report:  Cyberattack hits Ukraine government websites: Here is what you should do.  Please take a look for OODA-informed next steps if your organization is a possible target for Russian state and non-state actors in this current climate.

Sources tell me ~15 sites in Ukraine – all using October content management system – have been defaced, incl Min of Foreign Affairs, Cabinet of Ministers, Min of Ed, Emergency Services, Treasury, Environmental Protection. Attackers apparently used this: https://t.co/7ojWbjZWDd pic.twitter.com/FaepCsRO5E

— Kim Zetter (@KimZetter) January 14, 2022

What we Know (from CNN and The Record):

• The attack took place on the night between January 13 and January 14 and impacted the websites of the Ukrainian Ministry of Foreign Affairs, Ministry of Education and Science, Ministry of Defense, the State Emergency Service, the website for the Cabinet of Ministers, and others.
• The Record provided the following translation of the message sent by the hackers:  “Ukrainian! All your personal data has been sent to a public network. All data on your computer is destroyed and cannot be recovered. All information about you stab (public, fairy tale and wait for the worst. It is for you for your past, the future, and the future. For Volhynia, OUN UPA, Galicia, Poland, and historical areas.”
• Officials say they are investigating the attacks, but all signs post to an attack carried out by Russian hackers.
• Ukrainian officials have not yet formally attributed the attack to any threat actor or nation-state.
• “As a result of a massive cyberattack, the websites of the Ministry of Foreign Affairs and a number of other government agencies are temporarily down,” Foreign Ministry spokesman Oleg Nikolenko said on his official Twitter account on Friday.

As a result of a massive cyber attack, the websites of the Ministry of Foreign Affairs and a number of other government agencies are temporarily down. Our specialists have already started restoring the work of IT systems, and the cyberpolice has opened an investigation.

— Oleh Nikolenko 🇺🇦🇨🇦 (@OlehNikolenko_) January 14, 2022

What’s Next: Expect more attacks like this, not just on Ukraine, but on NATO governments and on commercial entities. Some malicious code can escape like in the June 2017 NotPetya attacks.

Your Action: Read the latest on the cyber threat and defensive strategies on the OODA Cyber Sensemaking page. Become an OODA Network member to discuss this topic with peers. For tips on establishing a more detailed action plan see: The OODA C-Suite Guide To Improving Your Cybersecurity Posture Before Russia Invades Ukraine

https://oodaloop.com/archive/2021/12/22/c-suite-guide-to-improving-your-cybersecurity-posture-before-russia-invades-ukraine/

 

OODA Loop provides actionable intelligence, analysis, and insight on global security, technology, and business issues. Our members are global leaders, technologists, and intelligence and security professionals looking to inform their decision making process to understand and navigate global risks and opportunities.

You can chose to be an OODA Loop Subscriber or an OODA Network Member. Subscribers get access to all site content, while Members get all site content plus additional Member benefits such as participation in our Monthly meetings, exclusive OODA Unlocked Discounts, discounted training and conference attendance, job opportunities, our Weekly Research Report, and other great benefits. Join Here.

Further Resources

Security Researcher Gary Warner turned around this quick, prescient analysis earlier this AM.  Find it here.

A related story in the last few days on the ground in Ukraine:  Ransomware gang behind attacks on 50 companies arrested in Ukraine

Previous OODA Loop coverage of REvil

Kaseya Obtains Universal Decryptor for REvil Ransomware

Kaseya Patches Zero-Days Used in REvil Attacks

REvil Group Demands $70 Million for ‘Universal Decryptor’

REvil Claims Responsibility for Invenergy Hack

REvil Hits US Nuclear Weapons Contractor

JBS Paid $11M to REvil Gang Even After Restoring Operations

Cyberwar and Cybercrime Analyses:

 Will Cyber Breaches Start a Shooting War?

The Next Evolution of Ransomware Gangs: Collaboration

Related Reading:

Black Swans and Gray Rhinos

Now more than ever, organizations need to apply rigorous thought to business risks and opportunities. In doing so it is useful to understand the concepts embodied in the terms Black Swan and Gray Rhino. See: Potential Future Opportunities, Risks and Mitigation Strategies in the Age of Continuous Crisis

Cybersecurity Sensemaking: Strategic intelligence to inform your decisionmaking

The OODA leadership and analysts have decades of experience in understanding and mitigating cybersecurity threats and apply this real world practitioner knowledge in our research and reporting. This page on the site is a repository of the best of our actionable research as well as a news stream of our daily reporting on cybersecurity threats and mitigation measures. See: Cybersecurity Sensemaking

Corporate Sensemaking: Establishing an Intelligent Enterprise

OODA’s leadership and analysts have decades of direct experience helping organizations improve their ability to make sense of their current environment and assess the best courses of action for success going forward. This includes helping establish competitive intelligence and corporate intelligence capabilities. Our special series on the Intelligent Enterprise highlights research and reports that can accelerate any organization along their journey to optimized intelligence. See: Corporate Sensemaking

Artificial Intelligence Sensemaking: Take advantage of this mega trend for competitive advantage

This page serves as a dynamic resource for OODA Network members looking for Artificial Intelligence information to drive their decision-making process. This includes a special guide for executives seeking to make the most of AI in their enterprise. See: Artificial Intelligence Sensemaking

COVID-19 Sensemaking: What is next for business and governments

From the very beginning of the pandemic we have focused on research on what may come next and what to do about it today. This section of the site captures the best of our reporting plus daily daily intelligence as well as pointers to reputable information from other sites. See: OODA COVID-19 Sensemaking Page.

Space Sensemaking: What does your business need to know now

A dynamic resource for OODA Network members looking for insights into the current and future developments in Space, including a special executive’s guide to space. See: Space Sensemaking

Quantum Computing Sensemaking

OODA is one of the few independent research sources with experience in due diligence on quantum computing and quantum security companies and capabilities. Our practitioner’s lens on insights ensures our research is grounded in reality. See: Quantum Computing Sensemaking.

The OODAcast Video and Podcast Series

In 2020, we launched the OODAcast video and podcast series designed to provide you with insightful analysis and intelligence to inform your decision making process. We do this through a series of expert interviews and topical videos highlighting global technologies such as cybersecurity, AI, quantum computing along with discussions on global risk and opportunity issues. See: The OODAcast