Special Report: Ukraine

An overview of Russia’s
cyberattack activity in Ukraine

Digital Security Unit

April 27, 2022

Cyberattacks in Ukraine
This interim report details the cyber activity Microsoft has
observed as part of the war in Ukraine, and the work we havedone in collaboration with Ukrainian cybersecurity officials

Russian Military Views on Information Warfare

and private sector enterprises to defend against cyberattacks.

The Russian military defines information warfare as

Microsoft’s ongoing, daily engagement establishes that the“confrontation in the information space with the goalcyber component of Russia’s assault on Ukraine has beenof causing damage to critical information systems,

destructive and relentless. The purpose of this report is toundermining political, economic, and social systems,

provide insights into the scope, scale, and methods of

psychologically manipulating the public to destabilize theRussia’s use of cyber capabilities as part of the largescalestate and coerce the state to make decisions to benefit“hybrid” war in Ukraine, to acknowledge the work of

the adversary party”, according to public Defense Ministryorganizations in Ukraine defending against persistent

documents.1 The collective comments2 of several former

adversaries, and to provide strategic recommendations

Russian military officials, including a former Chief of theto organizations worldwide.

General Staff, suggest a view that operations to degrade

Throughout this conflict, we have observed Russian
nation state cyber actors conducting intrusions inconcert with kinetic military action.

troop morale, discredit the leadership, and undermine
the military and economic potential of the enemy via
information means can at times be more effective than
traditional weapons.

At least six Russian Advanced Persistent Threat (APT) actors
and other unattributed threats, have conducted destructive
attacks, espionage operations, or both, while Russian militaryforces attack the country by land, air, and sea. It is unclear
whether computer network operators and physical forces
are just independently pursuing a common set of priorities
or actively coordinating. However, collectively, the cyberand kinetic actions work to disrupt or degrade Ukrainian
government and military functions and undermine thepublic’s trust in those same institutions.

Destructive attacks have been a prominent componentof Russian cyber operations during conflict.

Based on Russian military goals for information warfare, theseactions are likely aimed at undermining Ukraine’s political will
and ability to continue the fight, while facilitating collection of
intelligence that could provide tactical or strategic advantages
to Russian forces. Through our engagements with customers
in Ukraine, we have observed that Russia’s computer-enabled
efforts have had an impact in terms of technical disruption ofservices and causing a chaotic information environment, but
Microsoft is not able to evaluate their broader strategic impact.

A day before the military invasion, operators associatedwith the GRU, Russia’s military intelligence service, launcheddestructive wiper attacks on hundreds of systems in Ukrainian
government, IT, energy, and financial organizations. Since
then, the activity we have observed has included attempts todestroy, disrupt, or infiltrate networks of government agencies,
and a wide range of critical infrastructure organizations, which
Russian military forces have in some cases targeted withground attacks and missile strikes. These network operations
have at times not only degraded the functions of the targetedorganizations but sought to disrupt citizens’ access to reliable
information and critical life services, and to shake confidence
in the country’s leadership.

1

Conceptual Views of the Armed Forces of the Russian Federation’s Action in Information Space, 20112https://ria.ru/20170222/1488617708.html

Page 02 of 20

Microsoft’s engagement
Microsoft security teams have worked closely with Ukrainian
government officials and cybersecurity staff at governmentorganizations and private enterprises to identify andremediate threat activity against Ukrainian networks. In
January, the Microsoft Threat Intelligence Center (MSTIC)
discovered wiper malware in more than a dozen networks inTracked malware families levereged for
destructive activity• WhisperGate / WhisperKill

Ukraine. We alerted the Ukrainian government and published• FoxBlade aka Hermetic Wiper

our findings.3 Following that incident, we established a secure• SonicVote aka HermeticRansom

line of communication with key cyber officials in Ukraine to• CaddyWiper

be sure that moving forward, we were working with trusted
experts to help Ukrainian government agencies, enterprises,
and organizations defend against attacks.

• DesertBlade• Industroyer2• Lasainraw aka IssacWiper

This focused engagement combined with our unique view
into affected systems has offered insights into Russian cybertargets, tactics, and procedures so far, and provided new
insights on how to approach network defense for customers
embroiled in military conflict.
Based on our observations, known and suspected Russian
nation-state actors are working to compromise organizations
in regions across Ukraine. These actors use a variety oftechniques to gain initial access to their targets, including• FiberLake ka DoubleZero
WhisperGate, FoxBlade, DesertBlade, and CaddyWiper,
are all files that overwrite data and render machines
unbootable. FiberLake is a .NET capability being used fordata deletion. SonicVote is a file encryptor sometimes usedin conjunction with FloxBlade. Industroyer2 specificallytargets operational technology to achieve physical effects
in industrial production and processes.

phishing campaigns, exploiting unpatched vulnerabilities in
on-premises Exchange servers, and compromising upstream
IT service providers. This initial access allows them to conduct
operations for destruction, data exfiltration, and persistence
for longer-term espionage and surveillance.
Threat groups with known or suspected ties to the GRU havecontinuously developed and used destructive wiper malware
or similarly destructive tools on targeted Ukrainian networks
at a pace of two to three incidents a week since the eveof invasion. From February 23 to April 8, we saw evidenceof nearly 40 discrete destructive attacks that permanently
destroyed files in hundreds of systems across dozens oforganizations in Ukraine.

https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/;
https://blogs.microsoft.com/on-the-issues/2022/02/28/ukraine-russia-digital-war-cyberattacks/

3

Page 03 of 20

Destructive attacks in Ukraine
More than 40% of the destructive attacks were aimed at

Acknowledging that there is ongoing activity that we cannot

organizations in critical infrastructure sectors that could havesee, we estimate there have been at least eight destructive

negative second-order effects on the government, military,

malware families deployed on Ukrainian networks, including

economy, and people. Thirty-two percent of destructive

one tailored to industrial control systems (ICS). If threat

incidents affected Ukrainian government organizations at

actors can maintain the current pace of development andthe national, regional, and city levels. Microsoft has also

deployment, we anticipate more destructive malware will beobserved that the threat actors are slightly modifying thediscovered as the conflict continues.

malware to evade detection with each wave of deployment.

Detected destructive cyberattacks in Ukraine by week

Week 1(February 23-March 2)

Destructive Malware: FoxBlade, Lasainraw (IsaacWiper),DesertBlade, malicious use of SecureDelete utility
Number of Destructive Incidents: 22

Week 2Distructive Malware: none
Number of Destructive Incidents: 0

Week 3

Destructive Malware: FoxBlade, malicious use of SecureDelete utility
Number of Destructive Incidents: 4(March 3-9)

(March 10-16)

Week 4(March 17-23)

Destructive Malware: DesertBlade, FiberLake, SonicVote,malicious use of SecureDelete utility
Number of Destructive Incidents: 6

Week 5

Destructive Malware: FoxBlade, SonicVote, malicious use of SecureDelete utility
Number of Destructive Incidents: 3

Week 6 and beyond

Destructive Malware: CaddyWiper, Industroyer 2.0
Number of Destructive Incidents 2(March 24-30)(March 31 – April 8)* Destructive incidents are counted by organization not by impacted systems. Malware may have destroyed data across multiple systems at a single organization,
but we count that as one destructive incident.
Known and suspected Russian threat actors deployed malware and abused legitimate utilities 37 times to destroy data on targeted systems.
Secure delete is a legitimate Windows utility that threat actors abused to permanently delete data from targeted devices.

Page 04 of 20

Russian preparation for war
Microsoft assesses that Russia-aligned threat groups werecoordination between disparate threat groups, combined,

pre-positioning for conflict as early as March 2021, when

their activities appeared aimed at securing persistent access forthreat actors that had sporadically targeted Ukraine in the past

strategic and battlefield intelligence collection or to facilitatestarted to conduct more actions against organizations inside

future destructive attacks in Ukraine during military conflict.

or allied with Ukraine. While we cannot speak to the level of

GRU

Unit 26165
RussiaSTRONTIUM

aka APT 28
Data theft
Phishing (Military targets)

Unit 74455
RussiaIRIDIUM

Aka Sandworm
Destruction: FoxBlade wiper;
CaddyWiper, Industroyer2*Suspected GRU
affiliation

RussiaDEV-0586

SVR

FSB

Destruction: WhisperGate wiper
Data theft
Influence operations

RussiaNOBELIUM

aka UNC2452/2652
Password spray, phishing(Ukrainian and NATO member
diplomatic targets)

RussiaACTINIUM

aka Gamaredon
Phishing
Data theft

Unit 71330
RussiaBROMINE

aka EnergeticBear
Data theft

RussiaKRYPTONaka Turla
Reconnaissance
Phishing

This graphic is a snapshot of Russian cyber threat actors MSTIC observed executing operations specifically against Ukrainian targets before the invasion and examples of
their activities. Ukrainian military and cyber responders have been dealing with Russian aggression since at least the first Russian invasion in 2014, making it difficult to
identify an exact time when long-term espionage may have shifted to support invasion preparation.

Page 05 of 20

Sought access to insights on Ukrainian defense andforeign partnerships. 

response to Russian military action. ACTINIUM launched spear-

In early 2021, when Russian troops first started to move en

foreign military advisors and humanitarian workers, in August.

masse toward the border with Ukraine, we saw efforts togain initial access to targets that could provide intelligenceon Ukraine’s military and foreign partnerships. Russian actor
NOBELIUM launched a large-scale phishing campaign against
Ukrainian interests involved in rallying international support
against Russian actions. Similarly, DEV-0257 (publicly known
as Ghostwriter) began phishing campaigns attempting to gain
access to Ukrainian military email accounts and networks.

Positioned themselves for third-party attacks on
networks in Ukraine and partner nations.
By mid-2021, Microsoft observed known and suspected
Russian threat actors separately targeting supply chain vendors
in Ukraine and abroad to secure accesses and pre-position for
future third-party intrusions against Ukraine and its partners in
NATO. DEV-0586, a previously unknown group with suspected
Russian military ties, had compromised the network of an IT

phishing campaigns to gain access to accounts of Ukraine-based
Around the same time, STRONTIUM attempted to compromise
defense-related organizations in Ukraine. ACTINIUM,NOBELIUM, BROMINE, SEABORGIUM, and DEV-0257 sought
persistent access to their particular interests among a total
target pool that included Ukrainian defense, defense industrial
base, foreign policy, national and local administration, law
enforcement, and humanitarian organizations.

Secured access to critical infrastructure for
future destruction.
Threat actors also established the access and persistence on
networks for future destructive attacks. In late 2021, suspected
Russian cyber actors positioned themselves in networks of
Ukrainian energy and IT providers that were later targets ofdestructive attacks, including Kitsoft, the IT service provider that
DEV-0586 compromised to facilitate destruction on the networks
of several clients in January 2022.4

firm that built resource management systems for Ukraine’s
Ministry of Defense and organizations in the communications
and transportation sectors.
NOBELIUM attempted to access IT firms serving government
customers in predominantly NATO member states, at times

Most targeted countries(July 2020 to June 2021)

successfully compromising then leveraging privileged
accounts to breach and steal data from Western foreign policy

Ukraine

19%

Other

11%

organizations. Beyond broader value derived from what
appear to be traditional espionage operations, persistentaccess to foreign policy organizations in NATO member states
could provide Russian leadership continuous insights onwhat to expect from the West in response to Russian actions
in Ukraine. Roughly 93% of all Russia-backed attack activity

United Kingdom 9%

observed in our online services was aimed at NATO member

BelgiumJapan
Germany
IsraelMoldova
Portugal
Saudi Arabia
United Statesstates, particularly against the United States, the United
Kingdom, Norway, Germany, and Turkey through 2021.

Sought access to insights on military and humanitarian
response capabilities.
As 2021 progressed, threat actors representing multiple Russian
government security services converged on Ukraine to surveil
or compromise organizations that could provide valuable
intelligence on a Ukrainian military, diplomatic, or humanitarian

3%
3%
3%
2%
2%
1%
1%
46%

The chart above represents the geographic distribution of customers notifiedof all nation state threat activity, not just Russian, between July 1, 2020, andJune 30, 2021. By June 2021, Ukraine was the second-most impacted country
we observed, reflecting 19% of all notifications of nation-state threat activity
that we provided to customers during that time, largely due to the ramp up
of Russian activity.

4
https://www.cnn.com/2022/01/14/europe/ukraine-cyber-attack-government-intl/index.html;
https://zetter.substack.com/p/dozens-of-computers-in-ukraine-wiped?s=r

Page 06 of 20

Destructive attacks signal imminent invasion
In early 2022, when diplomatic efforts failed to de-escalatemalware which sought and deleted selected file extensions

mounting tensions around Russia’s military build-up along

and then manipulated the Master Boot Record (MBR) to

Ukraine’s borders, Russian threat actors launched destructive

render targeted machines inoperable. This destructive malware

wiper malware attacks against Ukrainian organizations with

impacted a limited number of government and IT sector

increasing intensity. These efforts signaled that Russian actions

systems, which coupled with the defacement of Ukrainian

in Ukraine had entered a destructive phase that could escalate

government websites in February, may have served as

further. In early January, DEV-0586 launched WhisperGate

warnings intended to prompt Ukrainian concessions.

5

INVASION BEGINS

Political-Military events
January 13
Intensive
diplomatictalks between
Russia, US,
Ukraine, NATO,Europe fail.

February 1
President Putin says the US and NATOcompletely ignored Russian security
demands, after reviewing written
responses that the U.S. and NATO had
submitted to Russian demands.

February 17
Kremlin said it would be “forced to respond”
with military-technical measures if the UScontinued to ignore calls for guarantees thatUkraine will never be admitted to NATO but
denied plans to invade Ukraine.

January

January 13
DEV-0586 deploys
WhisperGate wiper
to limited numberof Ukrainian government
and IT sector systems.

February 21
President Putin recognizes
independence of Ukrainian  separatist “republics,” nullifying
terms of existing Minsk peaceagreements with Ukraine.

February 24
Russia invades
Ukraine.

February 23
IRIDIUM deploys FoxBladewiper to hundreds ofsystems in Ukrainian
government, IT, energy,
and financial sectors.

February 24
External reporting indicates that
the GRU launches a denial ofservice attack against Viasat,
disrupting broadband service
to tens of thousands of users in
Ukraine and throughout Europe.22

February

January 14
DEV-0586 defaces and an
unknown actor starts a
distributed denial of service(DDoS) attack on Ukrainian
government websites.

February 15–16
Russian military
intelligence (GRU)
DDoS attacks against
Ukrainian financial
institutions.

Cyber attacks

Pre-invasion timeline indicates Russian threat actors launched increasingly disruptive and visible cyberattacks against Ukraine on the heels of major diplomatic failures
related to the conflict.

Cyberattacks intensified on the eve of the Russian invasion,

FoxBlade deployment was tailored to specific environments

when IRIDIUM deployed Foxblade (aka HermeticWiper)

through labor-intensive preparation. Once deployed, itmalware to destroy roughly 300 systems across more than amoves quickly to impact all domain-joined devices within adozen government, IT, energy, agricultural, and financial sector

targeted organization.

6organizations in Ukraine. Unlike IRIDIUM’s NotPetya worm,

5

https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/6

https://blogs.microsoft.com/on-the-issues/2022/02/28/ukraine-russia-digital-war-cyberattacks/

https://www.washingtonpost.com/national-security/2022/03/24/russian-military-behind-hack-satellitecommunication-devices-ukraine-wars-outset-us-officials-say/;https://www.viasat.com/about/newsroom/blog/ka-sat-network-cyber-attack-overview/

22

Page 07 of 20

Russia invades Ukraine
The war begins.
Since the beginning of Russia’s invasion of Ukraine on February 24,
Microsoft has observed Russian cyber threat groups performing

A note on attribution:actions in support of their military’s strategic and tactical

MSTIC assesses with moderate confidence that IRIDIUM,

objectives. A timeline of military strikes and cyber intrusions

an activity group that the US Government has attributed toshows several examples of computer network operations

the GRU Main Center for Special Technologies (Unit 74455),

and military operations seeming to work in tandem against a

is linked to intrusion activity leading to the deployment ofshared target set, though it is unclear if there is coordination,

FoxBlade, CaddyWiper, and Industroyer2 in Ukraine.

centralized tasking or merely a common set of understoodpriorities driving the correlation. At times, computer network
attacks immediately preceded a military attack, but thoseinstances have been rare from our perspective. The cyber
operations so far have been consistent with actions to degrade,
disrupt, or discredit Ukrainian government, military, andeconomic functions, secure footholds in critical infrastructure,and to reduce the Ukrainian public’s access to information.

Military strikes

February 24
Russian tanks
advance into
Sumy city
centerMarch 1
Missile strikes
Kyiv TV tower

March 3
Widespreadelectricity outagesin Sumy, including
blasts at power
stations

February

February 14
Odessa-based
critical infrastructure
compromised bylikely Russian actors

March 3
Russia’s militaryoccupies
Ukraine’s
largest nuclear
power station

March 6
Russian forces
launch eight
missiles at
Vinnytsia
airportMarch 11First Russian
strikes in
Dnipro hit
governmentbuildings

March 16
Russianrockets
strike TV
tower inVinnytsia

March

February 17
Suspected
Russian actors
present on criticalinfrastructure
networks in Sumy

February 28
Threat actor
compromisesa Kyiv-based
media company

April 3
Russian airstrikes
hit fuel depots
and processing
plants around
OdessaApril

March 1
Kyiv-based
media companies
face destructive
attacks and data
exfiltration

March 2
Russian groupmoves laterally
on network of
Ukrainian nuclear
power company

Legend:Critical Infrastructure

Nuclear Energy

Media

Electrical Infrastructure

Transportation

Government

March 4
STRONTIUM
compromises
government
network in
Vinnytsia

March 11
Dniprogovernment
agency targetedwith destructive
implant

Cyber intrusions or attacks

Page 08 of 20

Multiple threat actors targeting Ukraine
At least six known or suspected Russian cyber threat groups

and data deletion. The multiple phases of their operationsin addition to other unattributed threat actors are engaged

suggest these actors are positioning themselves for continued

in activities that range from reconnaissance and phishingcompromises and impact on Ukrainian networks for thefor initial access to pervasive lateral movement, data theft,duration of this conflict and beyond.

Stages of Russian cyber operations in Ukraine since December

73

60

Observed
events

40
40

28
24
18

20

12
5

6

4

December 2021

14
11

2

January 2022

February 2022

March 2022

Legend:Tooling and Reconnaissance

Actions on Network

Actions on Objectives (Data Exfil/Destruction)

Russian cyber operations against Ukrainian organizations grew significantly leading up to and following Moscow’s invasion. That growth occurred across the full
spectrum of cyber operations from research and tool preparation (“Tooling and Reconnaissance”) to gaining access, establishing persistence, and lateral movement(“Actions on Network”) to exfiltration and destruction of data (“Actions on Objectives”), with 237 such events in total during this period. We did not include activity in
Russian-annexed Crimea in our analysis.

Page 09 of 20

Cyber operations complement kinetic action
Based on Microsoft’s direct engagement with impacted

as kinetic military events. Analysis of Microsoft signals withentities in Ukraine, we observed that cyber and kinetic

open-source kinetic attack data shows high concentrations ofmilitary operations appeared to be directed toward similar

malicious network activity frequently overlapped with high-military objectives. Threat activity groups often targeted theintensity fighting during the first six plus weeks of the invasion.

same sectors or geographic locations around the same time(see map of Kinetic and cyber activity).

Kinetic and cyber activity

Legend:High Kinetic/High Cyber
High Kinetic/Low Cyber
Low Kinetic/High Cyber
Low Kinetic/Low Cyber

High kinetic:

Time Frame:

Regions which reflect more than 90% of daily reported

February 23rd through April 6th

Russian physical attacks in the data sources.

High cyber:
Regions which reflect more than 80% of daily detected andblocked actor indicators in Windows Defender Antivirus.

Data Sources:
Detected and blocked activity by Windows Defender Antivirus
based on known actor indicators; Open source data on kinetic
attacks from the Armed Conflict Location and Event Data
Project and the Centre for Information Resilience. Russianoccupied Crimea was excluded from this analysis.

Page 10 of 20

The war by week
The following week-by-week analysis provides a more granularfrom a limited dataset, and our understanding of the threat

view of the threat activity we observed in the context ofactors and their objectives is likely to change as the conflict

Russian military operations to highlight consistent cyber-and our investigations continue. This initial view should serve

kinetic congruence in the conflict. The insights are derived

as a starting reference for continued analytic work.

Sample set of targets by industry

Internet access & connection

2

Consumer Retail

2

Defense2

Nuclear3

Communications

3

Media

4

Energy4
7

IT Services

11

Other

19

National Government
0

2

4

6

8

10

12

14

16

18

20

This chart provides a sample of Ukrainian industries impacted by known or suspected Russia-aligned network intrusions or destructive attacks during the Russian invasionof Ukraine. National government organizations and critical infrastructure sectors were top targets. The “Other” percentage represents 11 other categories of impactedorganizations including regional and city-level government, agriculture, defense industrial base, healthcare, transportation, and finance, among others.

Page 11 of 20

WEEK 1 (Feb 23 -Mar 2):
Suspected Russian threat actors and Russian troops haveattempted to control the information environment in Ukraine
since the beginning of the conflict. During the first week of theinvasion, suspected Russian threat actors launched DesertBladeagainst a major broadcasting company on March 1, the same
day that the Russian military announced its intention todestroy “disinformation” targets in Ukraine and directed a
missile strike against a TV tower in Kyiv.7 DesertBlade actions
and the missile strike demonstrated cyber and kinetic impact
to a key source of information to the Ukrainian public.
•

The Institute for War and Peace Reporting reported
that the first thing that Russian troops did when theycaptured the southern city of Berdyansk on 27 February
was to occupy the TV tower8 and turn off all broadcasts,
underscoring broadcast and information control as a
key kinetic and cyber military objective. Attempts tocompromise and or stage destructive malware on media
companies is a trend that has continued throughout
this conflict.

IRIDIUM conducted operations against Ukrainian economic
targets, in line with Russian military objectives to degrade an
adversary’s economy.
•

Photo of tv tower after missile strike.

IRIDIUM staged a file encryptor on the network of an
agricultural firm, holding this entity at risk for future
destruction. Microsoft assesses that this was likely
targeting grain production, a major export commodity
in Ukraine’s economy. As of early April, the World Bank9
predicted the war would shrink Ukraine’s economy by
45.1% this year in part by destroying infrastructure andchoking of imports and exports.

7

https://web.archive.org/web/20220301133913/https://tass.com/defense/1414199

8

https://iwpr.net/global-voices/berdyansk-life-under-russian-occupation

9

https://www.worldbank.org/en/news/press-release/2022/04/10/russian-invasion-to-shrink-ukraine-economy-by-45-percent-this-year

Page 12 of 20

WEEK 2 (Mar 3 - 9):During this time, Russian military forces prepared for a major
offensive on Kyiv, while known and suspected Russia-aligned
threat actors attempted to compromise public information
sources and communications infrastructure and increase
insights into Ukrainian military operations.
•

Another suspected Russian threat actor conducted lateral•

DEV-0257 and STRONTIUM sought access to militaryand regional government accounts by directing phishingcampaigns against the Ukrainian military and government
employees in central Ukraine, respectively. The regional
government campaign was a shift toward tacticaltargeting by STRONTIUM, which has typically pursued
national-level organizations.

movement on a communications sector system andexpanded focused targeting of media organizations frombroadcast organizations to compromise systems belonging
to a digital media firm.

Weekly view of malicious cyber activity by region:

Week ofFebruary 23

Week of
March 2

Week of
March 9Week of
March 16

Week of
March 23

Week of
March 30

Legend:
High
Low

High:

Data source:

Regions which reflect more than 50% of detected and blocked

Detected and blocked activity by Windows Defender Antivirus

actor indicators in the given week.

based on known actor indicators.

Page 13 of 20

WEEK 3 (Mar 10 - 16):WEEK 4 (Mar 17 - 23):

As military units captured nuclear power plants, and RussianThreat actors targeted logistics providers and regional

military and state-run media pushed disinformation thatgovernment organizations in advance of the Russian military’s

Ukraine was working to create chemical and biologicalannouncement of a strategic refocus12 on eastern Ukraine.

weapons, threat actors conducted operations to steal datafrom nuclear sector organizations that could assist those efforts.10•

IRIDIUM conducted a destructive attack on the networkof a transportation/logistics provider, the type of•A suspected Russian threat actor compromised anorganization that could be involved in moving Ukrainian

institution in Ukraine that was featured in false Russian

supplies to conflict hotspots. The firm is headquartered inweapons conspiracies in the past. IRIDIUM, an actor with

Western Ukraine, where much of the foreign military anda history of leaking documents to support disinformation

humanitarian assistance is entering the country.

narratives, conducted an intrusion into the same research
institution later in March.

•

The week prior, a suspected Russian actor deleted datafrom a regional government network in eastern Ukraine,•

On March 13, a suspected Russian nation state actor stole

disrupting government services there.

data from a nuclear safety organization that FSB-affiliatedactor BROMINE had compromised in December 2021.
BROMINE stole data from this entity from December

WEEK 5 (Mar 24 - 30):

through mid-March. In the first two weeks of the invasion,

Suspected Russia-aligned threat actors targeted Ukrainian

Russian troops seized the defunct Chernobyl nuclear

civilian support and communications sector organizations, as

power plant and the Zaporizhzhia Nuclear Power plant,

Russian and Ukrainian peace negotiators13 met in Turkey tothe largest in Europe, indicating a clear military interest in

discuss a resolution to the conflict.

nuclear energy targets.

11•

Unknown actors compromised and potentially destroyed
data at a portal that connects citizens to government
services and compromised the network of another major
media organization. Separately, Ukrainian authorities
reported14 that they brought down five “enemy” bot farms
that had been spreading disinformation about the Russian
invasion to the Ukrainian public since February 24.

•

Microsoft observed suspected Russia-aligned threat
actors attempt to escalate privileges in the network of acommunications provider network and broaden targeting
efforts to compromise a mobile communications provider.
Separately, Forbes15 reported that Ukraine’s largest fixedline telecommunications provider, Ukrtelecom, had

Ukrainian Foreign Minister Kuleba tweet highlights a potential danger of Russian
government narratives around chemical and biological weapons in Ukraine.

suffered a severe cyberattack, which NetBlocks claims
brought the service down to 13% of its pre-war levels.
This provides another data point on communications
sector targeting.

10

https://abcnews.go.com/Politics/russia-escalates-false-chemical-weapons-claims-us-ukraine/story?id=83366504

11

https://en.as.com/en/2022/03/07/latest_news/1646686014_463478.html

https://www.npr.org/2022/03/25/1088885299/russias-assault-on-kyiv-slows-as-it-shifts-focus-to-eastern-ukraines-donbas-regi?
msclkid=8b22cc7fba6a11ecac00492d4da8e1c3

1213

https://www.reuters.com/world/europe/ukraine-sets-ceasefire-goal-new-russia-talks-breakthrough-looks-distant-2022-03-29/

14https://www.zdnet.com/article/ukraine-takes-out-five-bot-farms-spreading-panic-among-citizens/

https://www.forbes.com/sites/thomasbrewster/2022/03/28/huge-cyberattack-on-ukrtelecom-biggest-since-russian-invasioncrashes-ukraine-telecom/?sh=2174fe777dc2

15

Page 14 of 20

WEEK 6 and beyond (Mar 31 - Apr 8):
This period saw an escalation of attacks on energy
infrastructure and targeted efforts to influence Ukrainians’
support for their government.
•

IRIDIUM and suspected Russian actors have been
conducting intrusions into Ukrainian energy company
networks since before the invasion started. During
this period, IRIDIUM took the next steps to launch a
destructive attack against the network of a regionalenergy provider.

Meanwhile, DEV-0586 launched a cyber-enabled influence
operation to try to turn Ukrainian citizens against government.
•

DEV-0586 sent emails masquerading as a resident inbesieged Mariupol that blamed the Ukrainian government
for abandoning them and suggested resisting thegovernment. There were no malicious links or attachmentsin the message further suggesting the intended objective
was influence operations. This was the first instance we had
observed such intense anti-government messaging in email.

This is a screenshot of the DEV-0586 email message totargeted Ukrainian citizens. A machine translation of themessage says:“In the light of recent events, our government capital has
finally spat on conscience and morality. . . If there is even adrop of Ukrainian patriotism in your soul, you are obliged
not to allow our common dream to dissolve into lies andpropaganda of these hypocritical clowns. I urge you to
fulfill your national duty, to defend the right to be called
the Ukrainian people and to put an end to this pack of
invertebrates.”
The messages were addressed to people by name(redaction above), raising the prospect that DEV-0586
stole this personal information from at least one of theirgovernment victims.

Page 15 of 20

Microsoft assistance to defend Ukraine
Microsoft has consistently acted to notify organizations andorganizations enable controlled folder access16, an existing

enterprises that we observed being threatened or attacked

Windows Defender feature that is disabled by default. This

as described in this report. As the war commenced, we usedfeature meaningfully mitigated some of the damage done by

the secure communication channels we had established withdestructive wiper malware. We have continuously integrated

Ukrainian government cyber security officials to provide

intelligence gained by tracking threat activity into new productreal-time threat intelligence and guidance to assist Ukrainian

detections to block malicious use of certain tools againstorganizations’ efforts to find and defeat cyberattacks.

Ukraine-based infrastructure.

Leveraging RiskIQ’s outside-in approach to illuminating attack
surfaces, we provided our liaisons with actionable information

We observed firsthand how customers running endpoint

about Ukrainian government systems that remained

detection and response (EDR) solutions were able to respondunpatched against known vulnerabilities that would likely be

to alerts and remediate intrusions before a destructive attack

targeted by attackers. Microsoft respects and acknowledges

was launched. As Microsoft customers, our Ukrainian partners

the tireless efforts of Ukrainian network defenders and thewere using Microsoft Defender for Endpoint, but alternate EDR

unwavering support provided by CERT UA to protect theirsolutions could also provide much needed observability andnetworks and maintain service to their customers during thisdetection capabilities.

extraordinary and challenging time.
We have kept the US Government advised of relevantWith the consent and cooperation of the Ukrainian

information and have established communications with NATOgovernment, we have helped to proactively update systems

and EU cyber officials to communicate any evidence of threatwith cyber countermeasures against the types of attacks weactor activity spreading beyond Ukraine.

have observed. Specifically, we recommended that Ukrainian

16

https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/controlled-folders

Page 16 of 20

Outlook: Continued destructive attacks in Ukraine may increase in severity
As of this report’s drafting, Microsoft and cybersecurity

Exploring implications of wartime cyber
operations for global cybersecurity

firm ESET worked with Ukrainian authorities to identify and

The dynamic nature of the armed conflict will introduce

the industrial control system infrastructure of a Ukrainiana level of uncertainty not seen since the annexation ofenergy company.17 The targeting of ICS was an escalation

Crimea in 2014. As the war progresses, actors with a vested

beyond what we had observed up to early April in that it wasinterest in the conflict will operate under increasingly

intended to produce physical effects on critical infrastructure.

urgent requirements to fill critical intelligence gaps and

On April 12, Russian President Vladimir Putin said that peaceachieve specific tactical objectives. How cyber operators

talks with Ukraine were dead and that his “military operation”

choose to meet these requirements may pose significant

would continue until objectives were achieved18, setting

risk to the global cyber security landscape.

expectations for protracted military engagement.

We assess that such an environment of urgency may

Given cyber operators’ demonstrated conduct of actions

incentivize the use of sensitive capabilities that willthat mirror and augment military actions and the gradualallow threat actors to gain assured access to networks or

expansion of targets of destructive attacks, cyberattacks will

manipulate aspects of information systems to achieve

probably continue to escalate as conflict rages. In addition

strategic objectives. Highly reserved capabilities such as

to the energy sector, the communications sector in Ukraine

zero-days, critical infrastructure attacks, supply-chain

may suffer future destructive attacks, based on several known

attacks, and other novel techniques will almost-certainly

and suspected actors’ continued pursuit of compromises inbe showcased in the medium-term.

that sector. Microsoft observed IRIDIUM, STRONTIUM, andmitigate the impact of an IRIDIUM wiper attack against

unknown but suspected Russian nation state threat actors
As Microsoft and the greater security community increases

pursue compromises or expand on existing access in thetheir outreach in Ukraine, the community will inevitablycommunications sector in April, targeting IT infrastructure

identify and mitigate previously unknown vulnerabilities

that supports the sector and a major ISP.

and attack chains, forcing an already diverse ecosystemof well-resourced actors to reverse patches and carry out“N-day attacks” tailored to underlying vulnerabilities. Thiscat and mouse cycle almost guarantees that discovered
capabilities will proliferate across multiple categories of
threat actors, creating a long tail of incidents stemmingfrom or modeled on the conflict in Ukraine. Organizations
worldwide must acknowledge and prepare for the realitythat such events will not occur in a vacuum and areunlikely to stay limited to a specific domain.

17

https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/https://www.wsj.com/livecoverage/russia-ukraine-latest-news-2022-04-12/card/putin-says-peace-talks-have-reacheddead-end-vows-war-will-go-on-pstQwRdkQV1WiLl9kwAH

18Page 17 of 20

Outlook: Expansion of cyberattacks outside of Ukraine
As the conflict persists and countries provide more military

Microsoft has observed to date suggests threat actors DEV-

assistance to Ukraine and take more punitive measures against

0586 and IRIDIUM are operating with restraint in the execution

the Russian government, Russian nation state threat actorsof destructive attacks by limiting malware deployments tomay be tasked to expand their destructive actions outside of

specific target networks, Russia-aligned nation state actors

Ukraine in retaliation. WhisperGate actor DEV-0586 has alreadyare actively pursuing initial access to government and criticalcompromised IT providers that serve government customers

infrastructure organizations worldwide.

in Latvia and Lithuania, two countries on NATO’s eastern flank.
Based on WhisperGate’s use of IT providers as access points to

Microsoft encourages all organizations that are directly or

facilitate intelligence collection and destructive attacks against

indirectly associated with the conflict in Ukraine to proactively

Ukrainian government organizations downstream, the actor may

protect themselves from the threats described in this reportbe prepositioning for future such operations in those nations.

and actively monitor for similar actions in their environment.
Any organization that may be faced with defending their

Microsoft has notified these customers of the malicious activity

systems in future conflicts can follow the same generaland provided information that may aid in identifying andguidance to improve their defense against malicious cyber

mitigating the threat on their networks. While much of what

activity during conflicts.

Recommendations
Microsoft has observed throughout our engagement that•

Use of known publicly available offensive capabilities,

Russia-aligned cyber operations use several common tactics,

sometimes obfuscated using actor specific methods totechniques, and procedures to execute their intrusions. We

defeat static signatures

have been able to turn these observations into actionableguidance for network defenders and security teams. Some of•

the most common intrusion techniques include:“Living off the land” during system and network discovery,
often utilizing native utilities or commands that are
non-standard for the environments•

Exploitation of public facing applications or
spear-phishing with attachments/links for initial access•

Use of destructive capabilities that access raw file systems
for overwrites or deletions•

Credential theft and use of valid accounts throughout theattack lifecycle, making “identities” a key intrusion vector.
This includes within Active Directory Domain and throughVPNs or other remote access solutions•

Use of valid administration protocols, tools, and methods
for lateral movement, relying on compromised identities
with administrative capability

Page 18 of 20

Based upon these observations, we recommend taking thefollowing actions:

Minimize credential theft and account abuse:

Enable investigations and recovery:In the case you detect or are notified of a threat to yourenvironment, it is critical to have auditing of key resources
to enable investigations. Customers are urged to have andProtecting the identities of your users is a key requirement toexercise an incident response plan to prevent any delays or

secure your network and resources from attackers. Microsoft

decrease dwell time for destructive threat actors. Customers

recommends enabling multi-factor authentication andare urged to have a backup strategy that accounts for the risk

identity detection tools. Additionally, customers are urged toof destructive actions and prepare to exercise recovery plans.

apply least privilege access and secure the most sensitive andprivileged accounts and systems.

Secure internet-facing systems and remote
access solutions:

Defend against destructive attacks:
Destructive attacks observed in Ukraine have similar
characteristics and mitigations to Ransomware scenarios that
Microsoft has identified worldwide in recent years. We haveInternet facing systems should be secured against external

comprehensive guidance to help safeguard your organization

attacks by ensuring they are updated to the most secure levels,

against destructive attacks by leveraging features within

regularly evaluated for vulnerability, and audited for changes

Defender such as Attack Surface Reduction (ASR)

to the integrity of the system. Anti-malware solutions andand Controlled Folder Access (CFA). These features haveendpoint protection should be enabled for detection andbeen successful in defeating destructive attacks in Ukraine

prevention of attackers. Legacy systems should be isolated

and elsewhere.20

to prevent them from being an entry point for persistent
two-factor authentication and be patched to the most

Review and implement “best practices” for defense
in depth:secure configuration.

We have developed extensive resources and best practices forthreat actors. Remote access solutions should require

Leverage anti-malware, endpoint detection, andidentity protection solutions:customers of Microsoft solutions that provide clear actionableguidance for security-related decisions. These are designed tohelp improve your security posture and reduce risk whether

A combination of defense-in-depth security solutions,

your environment is cloud-only, or a hybrid enterprisepaired with trained and capable personnel, can empower

spanning cloud(s) and on-premises data centers. Microsoft’s

your organization to identify, detect, and prevent intrusions

Security Best Practices covers topics such as governance,

impacting your business. Enabling cloud-protections19 allows

risk, compliance, security operations, identity and access

identification and mitigation of known and novel threats tomanagement, network security and containment, information

your network at scale.

protection and storage, applications, and services.21

19
https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-cloud-protection-microsoftdefender-antivirus?view=o365-worldwide20

https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware

All the materials, including videos and downloadable presentations, can be found here:
https://docs.microsoft.com/en-us/security/compass/compass

21

Page 19 of 20

Contributors
This report is prepared by Microsoft’s Digital Security Unit,
leveraging the intelligence and findings of the Microsoft
Threat Intelligence Center. Together with security teams across
Microsoft, we continue our work to protect customers in
Ukraine and share insights and protection recommendations
with the world.

©2022 Microsoft Corporation. All rights reserved. This document is provided “as-is.” Information and views expressed in this document,
including URL and other Internet Web site references, may change without notice. You bear the risk of using it. This document does notprovide you with any legal rights to any intellectual property in any Microsoft product.

Page 20 of 20