Kremlin says it has "no relation" to cyberattack on Ukrainian websites

Ukraine suspects hackers linked to Belarusian intelligence.

Kremlin spokesman Dmitry Peskov said Russia was not involved in cyberattacks on Ukrainian websites.

Dmitry Peskov
Press Secretary of the President of Russia

We live in a world of false accusations, fake news and lies. Until this is proven, we will continue to insist that it is fake news. Russia has no relation to these cyberattacks. We are almost used to Ukrainians blaming Russia for everything, even for the bad weather in their country.

Ukraine suspects hackers linked to Belarusian intelligence

Kyiv believes that a global hacker attack on the websites of the Cabinet of Ministers and the Diia portal was carried out by a group linked to Belarusian intelligence.

The attack on Ukrainian government websites took place on the night of January 13 to 14. Initially, experts assumed that the hackers were operating from Russia.

However, Deputy Secretary of the National Security and Defense Council Serhiy Demedyuk told Reuters that the attack was likely carried out by the "Belarusian" group UNC1151, which has experience of hacker attacks on Lithuania, Latvia, Poland and Ukraine, and has already spread narratives condemning NATO's presence in Europe.

Serhiy Demedyuk
Deputy Secretary of the National Security and Defense Council

Preliminarily, we believe that the UNC1151 group may be involved in this attack. The damage to the websites was only a cover for more destructive actions that took place behind the scenes, the consequences of which we will feel in the near future. UNC1151 is a cyber-espionage group linked to the special services of the Republic of Belarus.

Demedyuk suggested that the hackers used Google Translate to translate their message into Polish.

"Obviously, with this primitive method they failed to mislead anyone, but it still indicates that the attackers were playing on the issue of Polish-Ukrainian relations (which are growing stronger every day)," the Deputy Secretary of the National Security and Defense Council noted.

EU anti-hacker drills

On January 14, the European Union began testing its own cyber defense system by simulating an attack on a fictitious Finnish energy company, Bloomberg reports.

It is noted that during the drills the EU intends to strengthen its digital defenses, as there are concerns about potential hacker attacks.

The virtual "attack" on Finland is part of six-week drills aimed at stress-testing Europe's cyber resilience, strengthening readiness and cooperation between member states, and improving the effectiveness of joint response.

The tests are expected to end in late February, by the time of the meeting of EU foreign ministers.

A potential hacker attack on one country may affect others, since EU countries are closely connected in the digital space. The drills aim to establish intra-European cooperation in the event of a hacker attack.

The EU's response envisages activating working groups of member states on cyber issues to monitor the impact and identify the causes of the crisis, as well as to take possible measures to mitigate the consequences of the attack.

Microsoft detected damage to servers

Microsoft's Threat Intelligence Center (MSTIC) detected malicious software disguised as ransomware, which was used in a hacker attack on Ukraine's government networks. The software interfered with the hard drives of infected devices.

The company said it first detected this malware on January 13. It is disguised as ransomware, but is designed not to extort money, but to disable the devices it targets.

The company noted that it has not yet found significant similarities between the hackers attacking Ukraine and other cybercriminal groups tracked by Microsoft. The company passed its findings to affected organizations, as well as government agencies in the US and other countries.

The malware detected by the center is located in various working directories of devices. It is often called stage1.exe and overwrites the master boot record in victim systems with a ransom note.

"Given the scale of the intrusion, MSTIC cannot assess the intent of the destructive actions identified, but believes that these actions pose an elevated risk to any government agency, non-profit organization or enterprise located in or having systems in Ukraine. Overwriting the MBR is atypical for cybercriminal ransomware. In fact, the ransom message is a trick, and the malware destroys the MBR and the contents of the files it targets," the company said.