Russia’s recent military conflict with Ukraine began in 2014 when pro-Russian separatists in Ukraine took over the Crimean Peninsula. In February 2022, the conflict escalated into a full-blown war that led to thousands of civilian deaths, 200,000 military casualties, and millions of displaced persons. Economic sanctions imposed on Russia by many Western countries have contributed to Russia carrying out widespread malicious cyber attacks.
Threats against critical infrastructure and industrial manufacturers have steadily increased over the past year. Even if the war stops, cyber attacks likely will not. Since the war began, Ukrainians have had to fiercely defend their critical infrastructure and digital networks against cyber attacks, as well as psychological warfare via information campaigns.
Ukraine has built some resilience to Russian cyberattacks, thanks to a proactive stance and support from the West. However, new vulnerabilities are always emerging as malware constantly becomes more sophisticated.
Russian hacker attacks on Ukrainian infrastructure are not a new phenomenon. Attacks on Ukraine’s power system in 2015 and 2016 had a widespread impact, and since then, Russia has carried out additional attacks. During the first four months of 2022, researchers identified more destructive malware attacks on Ukraine by Russia than in the previous eight years. Critical infrastructure attacks, such as electricity, water, oil, and gas cyber attacks have the potential to cause maximum harm.
SSSCIP, Ukraine’s cybersecurity agency, reported threefold growth in cyber attacks over the past year, including attacks on Ukraine’s energy infrastructure last fall that were linked to sustained bombing campaigns. The coordination between bombings and critical infrastructure attacks is being called a war crime by Ukrainian officials.
Russia is also leveraging disinformation and propaganda and disinformation to create panic. There are allegations that Russia is attempting to penetrate networks and extract data to identify and target people who may threaten their military offensive.
Ongoing cyber attacks have affected citizens and businesses in various sectors across multiple countries, particularly in verticals where Russia has a strong economic interest. For example:
In response, regulatory requirements about critical infrastructure attacks have been stepped up in many countries. In the US, transparency about certain cyber attacks is now required by law. Operators of critical national infrastructure (CNI) must report substantial cyber attacks to the Cybersecurity and Infrastructure Security Agency (CISA). Attacks must be reported within 72 hours and any ransomware payments made must be reported within 24 hours. These reports will further the government’s understanding of attacks on critical networks and infrastructure and improve the ability to mitigate damage from attacks.
In January 2023, the US Justice Department shared that a global law enforcement operation destroyed hacker group Hive after it had already targeted more than 1,500 victims in over 80 countries, including businesses and public health agencies. While the operation sends a clear message that cybercriminals will be held accountable, group members are likely to join other groups or rebuild.
ENISA, the European Union Agency for Cybersecurity, along with the European Commission (DG CNECT) has taken a more active stance against OT security and has disclosed major recent cyber attacks. The agency updated existing cybersecurity legislation and proposed the Cyber Resilience Act that would impose cybersecurity requirements on hardware and software manufacturers.
The EU’s updated legislation on cybersecurity, the NIS2 Directive, outlines legal measures to increase the level of cybersecurity throughout the Union. The directive’s broadened scope addresses energy, healthcare entities, digital infrastructure service providers, public administration, the food sector, and waste management. The passage of cybersecurity legislation such as the EU’s NIS2 and America’s Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) mean that industrial manufacturers and critical infrastructure organizations have greater obligations to protect themselves.
Experts warn that cyber attacks on critical infrastructure are likely to continue and spread to Asia-Pacific countries due to political and military support for Ukraine from countries like Australia and South Korea.
The US issued an alert regarding Russian-sponsored cyber attacks on critical infrastructure in April 2022. In the alert, cybersecurity authorities in the US, Canada, the UK, Australia, and New Zealand “urge critical infrastructure network defenders to prepare for and mitigate potential cyber threats – including destructive malware, ransomware, DDoS attacks, and cyber espionage – by hardening their cyber defenses and performing due diligence in identifying indicators of malicious activity.”
Agencies in the UK have also issued warnings about the threat, urging that critical infrastructure owners and operators take steps to protect themselves and their businesses. In light of the war between Ukraine and Russia, OT security in industries worldwide is at risk.
The events of the past year make it clear that critical infrastructure organizations must be proactive about improving their security posture. Malicious attacks have been brought to the fore by the recent conflict between Russia and Ukraine, and their proliferation makes it clear that these threats are not going away anytime soon.