Defending Ukraine:
Early Lessons from the Cyber War

June 22, 2022

Defending Ukraine: Early Lessons from the Cyber War

Foreword

Brad Smith, President
and Vice Chair, Microsoft

The recorded history of every war typically includes an

As much as anything, this captures the importance ofaccount of the first shots fired and who witnessed them.

stepping back and taking stock of the first several months

Each account provides a glimpse not just into the start of aof the war in Ukraine, which has been devastating for thewar, but the nature of the era in which people lived.

country in terms of destruction and loss of life, including

Historians who discuss the first shots in America’s Civil War
in 1861 typically describe guns, cannons, and sailing ships
around a fort near Charleston, South Carolina.
Events spiraled toward the launch of World War I in 1914
when terrorists in plain view on a city street in Sarajevo used
grenades and a pistol to assassinate the archduke of theAustrian-Hungarian Empire.
It would take until the Nuremberg war trials to fully
understand what happened near the Polish border 25 years
later. In 1939, Nazi SS troops dressed in Polish uniforms
and staged an attack against a German radio station. Adolf
Hitler cited such attacks to justify a blitzkrieg invasion thatcombined tanks, planes, and troops to overrun Polish cities

innocent civilians. While no one can predict how long
this war will last, it’s already apparent that it reflects atrend witnessed in other major conflicts over the past two
centuries. Countries wage wars using the latest technology,
and the wars themselves accelerate technological change.
It’s therefore important to continually assess the impact of
the war on the development and use of technology.
The Russian invasion relies in part on a cyber strategy that
includes at least three distinct and sometimes coordinatedefforts—destructive cyberattacks within Ukraine, network
penetration and espionage outside Ukraine, and cyber
influence operations targeting people around the world.
This report provides an update and analysis on each ofthese areas and the coordination among them. It also offersand civilians.

ideas about how to better counter these threats in this war

Each of these incidents also provides an account of thethe private sector to work better together.

technology of the time—technology that would play a rolein the war that ensued and the lives of the people who lived

and beyond, with new opportunities for governments and

The cyber aspects of the current war extend far beyond

through it.

Ukraine and reflect the unique nature of cyberspace. When

The war in Ukraine follows this pattern. The Russian

speed of light. The internet’s global pathways mean thatmilitary poured across the Ukrainian border on February

cyber activities erase much of the longstanding protection

24, 2022, with a combination of troops, tanks, aircraft,provided by borders, walls, and oceans. And the internet

and cruise missiles. But the first shots were in fact fired

itself, unlike land, sea, and the air, is a human creation

hours before when the calendar still said February 23.

that relies on a combination of public and private- sector

They involved a cyberweapon called “Foxblade” that wasownership, operation, and protection.

launched against computers in Ukraine. Reflecting thetechnology of our time, those among the first to observe
the attack were half a world away, working in the UnitedStates in Redmond, Washington.

Forewordcountries send code into battle, their weapons move at theThis in turn requires a new form of collective defense. Thiswar pits Russia, a major cyber-power, not just against an
alliance of countries. The cyber defense of Ukraine relies

1Defending Ukraine: Early Lessons from the Cyber War

critically on a coalition of countries, companies, and NGOs.
The world can now start to assess the early and relative
strengths and weaknesses of offensive and defensive cybercompromising hundreds of computers and then spreading
malware designed to destroy the software and data on
thousands of others.

operations. Where are collective defenses successfully

Russian cyber tactics in the war have differed from thosethwarting attacks and where are they falling short? What

deployed in the NotPetya attack against Ukraine in 2017.

types of technological innovations are taking place? And

That attack used “wormable” destructive malware thatcritically, what steps are needed to effectively defend

could jump from one computer domain to another andagainst cyberattacks in the future? Among other things, it’shence cross borders into other countries. Russia has been

important to base these assessments on accurate data andcareful in 2022 to confine destructive “wiper software”

not be misled into an unwarranted sense of tranquility fromto specific network domains inside Ukraine itself. But thethe external perception that the cyberwar in Ukraine has

recent and ongoing destructive attacks themselves havenot been as destructive as some feared.

been sophisticated and more widespread than many

This report offers five conclusions that come from the
war’s first four months:
First, defense against a military invasion now requires formost countries the ability to disburse and distributedigital operations and data assets across borders and into
other countries. Russia not surprisingly targeted Ukraine’s
governmental data center in an early cruise missile attack,and other on premises servers similarly were vulnerable
to attacks by conventional weapons. Russia also targeted
its destructive “wiper” attacks at on-premises computer
networks. But Ukraine’s government has successfully
sustained its civil and military operations by acting quickly
to disburse its digital infrastructure into the public cloud,
where it has been hosted in data centers across Europe.
This has involved urgent and extraordinary steps fromacross the tech sector, including by Microsoft. While thetech sector’s work has been vital, it’s also important tothink about the longer-lasting lessons that come from

reports recognize. And the Russian army is continuing toadapt these destructive attacks to changing war needs,
including by coupling cyberattacks with the use of
conventional weapons.
A defining aspect of these destructive attacks so far has
been the strength and relative success of cyber defenses.
While not perfect and some destructive attacks have beensuccessful, these cyber defenses have proven stronger thanoffensive cyber capabilities. This reflects two importantand recent trends. First, threat intelligence advances,including the use of artificial intelligence, have helped makeit possible to detect these attacks more effectively. And
second, internet-connected end-point protection has madeit possible to distribute protective software code quickly
both to cloud services and other connected computing
devices to identify and disable this malware. Ongoingwartime innovations and measures with the Ukrainian
government have strengthened this protection further. But
continued vigilance and innovation will likely be needed tothese efforts.

sustain this defensive advantage.

Second, recent advances in cyber threat intelligence andThird, as a coalition of countries has come together

end-point protection have helped Ukraine withstanda high percentage of destructive Russian cyberattacks.
Because cyber activities are invisible to the naked eye, they
are more difficult for journalists and even many military
analysts to track. Microsoft has seen the Russian military
launch multiple waves of destructive cyberattacks against48 distinct Ukrainian agencies and enterprises. These
have sought to penetrate network domains by initially

Foreword

to defend Ukraine, Russian intelligence agencies have
stepped up network penetration and espionage activities
targeting allied governments outside Ukraine. At
Microsoft we’ve detected Russian network intrusion efforts
on 128 organizations in 42 countries outside Ukraine. While
the United States has been Russia’s number one target,
this activity has also prioritized Poland, where much of thelogistical delivery of military and humanitarian assistance2

Defending Ukraine: Early Lessons from the Cyber War

is being coordinated. Russian activities have also targeted
Baltic countries, and during the past two months there has
been an increase in similar activity targeting computer
networks in Denmark, Norway, Finland, Sweden, and Turkey.
We have also seen an increase in similar activity targetingthe foreign ministries of other NATO countries.

characteristic of current times.
As the war in Ukraine has progressed, Russian agencies arefocusing their cyber influence operations on four distinct
audiences. They are targeting the Russian population withthe goal of sustaining support for the war effort. They
are targeting the Ukrainian population with the goal of

Russian targeting has prioritized governments, especially

undermining confidence in the country’s willingness andamong NATO members. But the list of targets has alsoability to withstand Russian attacks. They are targeting

included think tanks, humanitarian organizations, IT

American and European populations with the goal ofcompanies, and energy and other critical infrastructure

undermining Western unity and deflecting criticism of

suppliers. Since the start of the war, the Russian targeting

Russian military war crimes. And they are starting to

we’ve identified has been successful 29 percent of the time.

target populations in nonaligned countries, potentially in

A quarter of these successful intrusions has led to confirmed

part to sustain their support at the United Nations and in

exfiltration of an organization’s data, although as explained

other venues.

in the report, this likely understates the degree of
Russian success.

Russian cyber influence operations are building on andare connected to tactics developed for other cyber

We remain the most concerned about government

activities. Like the APT teams that work within Russiancomputers that are running on premises rather than inintelligence services, Advance Persistent Manipulator

the cloud. This reflects the current and global state of(APM) teams associated with Russian government agencies

offensive cyber espionage and defensive cyber protection.

act through social media and digital platforms. They are

As the SolarWinds incident demonstrated 18 months ago,

pre-positioning false narratives in ways that are similar to

Russia’s intelligence agencies have extremely sophisticatedthe pre-positioning of malware and other software code.

capabilities to implant code and operate as an Advanced

They are then launching broad-based and simultaneous

Persistent Threat (APT that can obtain and exfiltrate“reporting” of these narratives from government-managed

sensitive information from a network on an ongoingand influenced websites and amplifying their narratives

basis. There have been substantial advances in defensive

through technology tools designed to exploit social media

protection since that time, but the implementation of these

services. Recent examples include narratives around biolabs

advances remains more uneven in European governments

in Ukraine and multiple efforts to obfuscate military attacks

than in the United States. As a result, significant collective

against Ukrainian civilian targets.

defensive weaknesses remain.

As part of a new initiative at Microsoft, we are using AI, newFourth, in coordination with these other cyber activities,

analytics tools, broader data sets, and a growing staff ofRussian agencies are conducting global cyber influence

experts to track and forecast this cyber threat. Using these

operations to support their war efforts. These combine

new capabilities, we estimate that Russian cyber influencetactics developed by the KGB over several decades with

operations successfully increased the spread of Russian

new digital technologies and the internet to give foreign

propaganda after the war began by 216 percent in Ukraine

influence operations a broader geographic reach, higher

and 82 percent in the United States.

volume, more precise targeting, and greater speed
and agility. Unfortunately, with sufficient planning andsophistication, these cyber influence operations are wellpositioned to take advantage of the longstanding opennessof democratic societies and the public polarization that is

Foreword

These ongoing Russian operations build on recent
sophisticated efforts to spread false COVID-19 narratives
in multiple Western countries. These included statesponsored cyber influence operations in 2021 that sought3

Defending Ukraine: Early Lessons from the Cyber War

to discourage vaccine adoption through English-language

New advances to thwart these cyber threats are needed,

internet reports while simultaneously encouraging vaccine

and they will depend on four common tenets and — at least

usage through Russian-language sites. During the last six

at a high level — a common strategy. The first defensive

months, similar Russian cyber influence operations sought

tenet should recognize that Russian cyber threats are being

to help inflame public opposition to COVID-19 policies inadvanced by a common set of actors inside and outside

New Zealand and Canada.

the Russian government and rely on similar digital tactics.

We will continue to expand Microsoft’s work in this field in
the weeks and months ahead. This includes both internal
growth and through the agreement we announced last
week to acquire Miburo Solutions, a leading cyber threat
analysis and research company specializing in the detectionof and response to foreign cyber influence operations.
We’re concerned that many current Russian cyber influence
operations currently go for months without proper
detection, analysis, or public reporting. This increasingly
impacts a wide range of important institutions in both the
public and private sectors. And the longer the war lasts in
Ukraine, the more important these operations likely will
become for Ukraine itself. This is because a longer war
will require sustaining public support from the inevitablechallenge of greater fatigue. This should add urgency tothe importance of strengthening Western defenses against
these types of foreign cyber influence attacks.
Finally, the lessons from Ukraine call for a coordinatedand comprehensive strategy to strengthen defenses
against the full range of cyber destructive, espionage,and influence operations. As the war in Ukraine illustrates,
while there are differences among these threats, theRussian government does not pursue them as separate
efforts and we should not put them in separate analyticalsilos. In addition, defensive strategies must consider thecoordination of these cyber operations with kinetic
military operations, as witnessed in Ukraine.

As a result, advances in digital technology, AI, and data
will be needed to counter them. Reflecting this, a second
tenet should recognize that unlike the traditional threats ofthe past, cyber responses must rely on greater public andprivate collaboration. A third tenet should embrace the needfor close and common multilateral collaboration among
governments to protect open and democratic societies.
And a fourth and final defensive tenet should uphold free
expression and avoid censorship in democratic societies, evenas new steps are needed to address the full range of cyberthreats that include cyber influence operations.
An effective response must build on these tenets withfour strategic pillars. These should increase collective
capabilities to better (1) detect, (2) defend against, (3)disrupt, and (4) deter foreign cyber threats. This approachis already reflected in many collective efforts to address
destructive cyberattacks and cyber-based espionage.
They also apply to the critical and ongoing work neededto address ransomware attacks. We now need a similarand comprehensive approach with new capabilities anddefenses to combat Russian cyber influence operations.
As discussed in this report, the war in Ukraine provides
not only lessons but a call to action for effective measuresthat will be vital to the protection of democracy’s future.
As a company, we are committed to supporting these
efforts, including through ongoing and new investments
in technology, data, and partnerships that will support
governments, companies, NGOs, and universities.

Brad Smith
President and Vice Chair

Foreword

4

Defending Ukraine: Early Lessons from the Cyber War

The Distribution of Digital Operations in Wartime

1

The war in Ukraine highlights in part the changes the 21st

transformation officers across the Ukrainian government

century has brought to governments around the world.

worked with the company to transfer to the cloud many ofIn the Second World War, as bombs fell on London, one

the central government’s most important digital operations

key to sustaining the British government was to move its

and data. Microsoft has committed at no charge a total ofcommunications equipment underground and into the$107 million of technology services to support this effort,

Cabinet War Rooms. Today, governments rely on digitalwhich has reached 20 ministries and more than 100 state

communications and data, and one key to sustaining theagencies and state-owned enterprises. (In total, Microsoft

Ukrainian government has been to disburse these digital

has provided $239 million in financial and technology

operations into the public cloud and outside the country itself.

assistance to support Ukraine, including support for the

Prior to the war, Ukraine had a longstanding Data
Protection Law prohibiting government authorities fromgovernment, businesses, nonprofits, and humanitarianassistance for refugees.)

processing and storing data in the public cloud. This meant

Fedorov’s urgency was prophetic. An early target of Russianthat the country’s public-sector digital infrastructure was

missile attacks was a Ukrainian government data center.

run locally on servers physically located within the country’s

And as discussed further below, the Russian military hasborders. A week before the Russian invasion, the Ukrainiantargeted the government’s on-premises computer networks

government was running entirely on servers located withinwith its destructive cyber “wiper” attacks. One reason thesegovernment buildings—locations that were vulnerable tokinetic and cyberattacks have had limited operational

missile attacks and artillery bombardment.

impact is because digital operations and data have been

Ukraine’s Minister of Digital Transformation, Mykhailo

disbursed into the public cloud.

Fedorov, and his colleagues in Parliament recognized theThis highlights a critical difference between protecting

need to address this vulnerability. On February 17, justpublic-sector data in a time of war instead of peace. Somedays before Russian troops invaded, Ukraine’s Parliament

governments around the world have pursued initiatives intook action to amend its data protection law to allow

recent years to centralize government digital operations ingovernment data to move off existing on-premises servers

so-called sovereign data centers that are more specialized,

and into the public cloud. This in effect enabled it tolocally controlled, and located within a country’s borders.

“evacuate” critical government data outside the country

While there are some factors that make this appealing fromand into data centers across Europe.

a national security perspective in times of peace, the last

Several tech companies rallied to help. At Microsoft,
we witnessed and supported the speed required forthis transition. Within 10 weeks, Ukraine’s Ministry of
Digital Transformation and more than 90 chief digital

1 | The Distribution of Digital Operations in Wartime

few months in Ukraine illustrate the very different defense
needs that prevail during a war. The key to a country’s
digital resilience in wartime is the ability quickly to movedata outside the country while still connecting to andrelying on it for a government’s digital operations.

5Defending Ukraine: Early Lessons from the Cyber War

The Evolution of Offensive Cyberattacks and Defensive Cybersecurity Operations

2
Innovation in offensive and defensive military technologies

cyberattacks that are invisible to the naked eye against

and tactics has been a constant, especially during the pastadvances in cybersecurity technologies and operations.

two centuries. Wars put these innovations to new tests.

Like the bombers of 1940, some of the cyberattacks have

While the “fog of war” makes it more difficult to assess the

succeeded in reaching and disabling their targets. But at a

relative strength of offensive and defensive capabilities,

broader level, so far these attacks have failed strategicallyit also creates greater urgency for doing so. The war inin disabling Ukraine’s defenses. While part of the reason lies

Ukraine is no exception, including for cyberattacks andin the disbursement of Ukrainian digital operations into thecybersecurity protection.

cloud, discussed above, another reason has been the overall

It’s perhaps helpful to start with a historical analogy thatability of cyber defenses to successfully defeat these attacks.

is well understood. The Battle of Britain in 1940 pitted theIt’s important to take note of the destructive cyber tactics

use of an offensive technology—the bomber—against the

the Russian military has deployed in Ukraine. These

defensive use of two other technologies, more advanced

have three facets. The first aspect, which is also common

fighters, and the use of radar. The radar waves wereto ransomware and nation-state cyber espionage,

invisible to the naked eye, and their widespread use wasinvolves targeted phishing and similar efforts to enter aunknown to the public during the battle itself. But radar wascomputer network. This tactic reflects the determination,indispensable in enabling the Royal Air Force to detect thesophistication, and persistence long observed acrossoncoming bombers and direct fighters to combat them.

the cyber activities of Russia’s intelligence community

While bombers succeeded in dropping bombs on England,

and military. The second involves the planting of “wiper”

they failed strategically in establishing the air supremacy

malware designed to “wipe” computer hard disks andneeded to support an invasion.

destroy all their data. And the third has involved softwareThis history shares some important similarities with thecurrent day. The war in Ukraine has pitted offensivearchitecture that is designed to replicate or spread thismalware to other computers across a network domain,such as the network of an entire government ministry.

STRONTIUM
Data theft, phishing (military targets)

GRU

IRIDIUM
Destruction: FoxBlade wiper;
CaddyWiper, Industroer2
DEV-0586
Destruction: WhisperGate wiper,
data theft, influence operations

Russian government entities
responsible for cyberattacks

SVR
NOBELIUM
Password spray, phishing (Ukrainian andNATO member diplomatic targets)

FSB

ACTINIUM
Phishing, data theft
BROMINE
Data theft
KRYPTON
Reconnaissance, phishing

2 | The Evolution of Offensive Cyberattacks and Defensive Cybersecurity Operations

6

Defending Ukraine: Early Lessons from the Cyber War

While most reports state that the war in Ukraine started on

As the war has progressed, the Russian army has adapted

February 24 of this year, in fact the first cyberattacks wereits destructive cyberattacks to its changing war needs.

fired the day before. The first weapon to be fired was the

On several occasions the Russian military has coupled its

wiper software that we call “Foxblade.” Microsoft’s Threat

cyberattacks with conventional weapons aimed at the sameIntelligence Center (MSTIC) has detected its launch against

targets. Like the combination of naval and ground forces

19 government and critical infrastructure entities acrosslong used in an amphibious invasion, the war in Ukraine has

Ukraine. It was developed and launched by the same group

witnessed Russian use of cyberattacks to disable computerassociated with Russian military intelligence that developed

networks at a target before seeking to overrun it withand launched the NotPetya attack against Ukraine in 2017.

ground troops or aerial or missile attacks.

(At Microsoft we call this group Iridium, and it’s known byothers as Sandworm.)

For example, as we listed in the Special Report on Ukraine
published on April 27, the Russian military combined cyberThis initial attack was just the first salvo. Since the war

and conventional weapons in assaulting a nuclear power

began, MSTIC has detected multiple attempts to use

plant in early March. On March 2, MSTIC identified a Russian

eight distinct malware programs—some wipers and somegroup moving laterally on the nuclear power company’sother forms of destructive malware—against 48 different

computer network. The next day, the Russian military

Ukrainian agencies and enterprises. These have sought,

attacked and occupied the company’s largest nuclear

sometimes repeatedly, to penetrate network domains

power plant. During the same week, the Russian army

by initially compromising hundreds of computers andgroup MSTIC calls Strontium compromised a government

then spreading malware to thousands of others. The

computer network in Vinnytsia and two days later launched

CyberPeace Institute, an independent and neutral nonprofit

eight cruise missiles at the city’s airport. Similarly, on March

headquartered in Geneva and which Microsoft and many

11, Russian forces targeted a Dnipro government agency

others support, similarly has found a growing number ofwith a destructive cyberattack while also using conventional

wiper and other destructive malware attacks.

weapons against government buildings.

Russian malware families used for destructive attacks• WhisperGate / WhisperKill• SonicVote, aka HermeticRansom• DesertBlade• Lasainraw, aka IssacWiper• FoxBlade, aka HermeticWiper• CaddyWiper• Industroyer2• FiberLake, aka DoubleZero

WhisperGate, FoxBlade, DesertBlade, and CaddyWiper are all malware families that overwrite data and render machines
unbootable. FiberLake is a .NET capability being used for data deletion. SonicVote is a file encryptor sometimes used
together with FoxBlade. Industroyer2 specifically targets operational technology to achieve physical effects in industrial
production and processes.

2 | The Evolution of Offensive Cyberattacks and Defensive Cybersecurity Operations

7

Defending Ukraine: Early Lessons from the Cyber War

Coordinated Russian cyber and military operations in Ukraine

It’s important to recognize that Russian cyber tactics in the
war have been strategic and deliberate but are different
from the 2017 NotPetya attack. To date, the Russians haven’t
used destructive “wormable” malware that can jumpfrom one computer domain to another and thereby crossinternational borders to spread economic damage. Instead,they are designing attacks to stay within Ukraine. While
Russia has been careful to confine its destructive malware
to specific network domains located within Ukraine itself,
these attacks are more sophisticated and widespread thanmany reports recognize.
During the past month, as the Russian military moved toconcentrate its attacks in the Donbas region, the numberof destructive attacks has fallen. More recent destructive
cyberattacks have been coordinated with missile attacks andhave targeted Ukraine’s railways and transportation systems
transporting weapons and military supplies. For example,
when Russian missiles struck railway substations in Lviv on May
3—a key logistical center for the movement of military andhumanitarian aid—the military’s Iridium group was alreadyactive within the digital networks of these same agencies.
Since the war began in Ukraine, some observers haveexpressed surprise at the relative absence of Russian
destructive cyberattacks. To some degree, this is based on
a comparison to the international destruction wrought by
NotPetya, which Russia to date has avoided replicating.
But the more limited impact is attributable to other factors
as well. Because cyberattacks are invisible to the naked eye,they tend to be perceived by the public and reported byjournalists only when they succeed and computer networks
stop operating. And, to date at least, cyber defenses andoperations have withstood attacks far more often than they
have failed.
Cybersecurity threat intelligence has strengthened in thefive years since the NotPetya attack. In the private sector, anorganization such as MSTIC now has the benefit of visibility
created by 24 trillion signals that Microsoft receives daily fromdevices and cloud services across a global ecosystem. This
enormous global data set is an extraordinary resource that

2 | The Evolution of Offensive Cyberattacks and Defensive Cybersecurity Operations

8Defending Ukraine: Early Lessons from the Cyber War

makes it possible to detect new anomalies more quickly and

The second measure has been a wartime innovation

identify other customers and networks confronting the same

pursued with the collaboration and support of the Ukrainian

attack. Recent advances in AI-based cybersecurity protection

government. MSTIC recognized that Russian malware

are starting to augment this protection even further.

could be mitigated meaningfully by turning on a featureThis type of detection capability is especially helpful fororganizations using cloud services. For example, in March,
Russia’s Iridium unit aimed wiper malware at a shipping
company in Lviv where the malware was detected on asystem running Microsoft Defender with Cloud Protection
enabled. An ensemble of AI machine learning models used
a combination of signals across the client network andthe cloud to block this malware at first sight without any

in Microsoft Defender called controlled folder access. Thistypically would require that IT administrators access devices
across their organization, work made more difficult andpotentially even dangerous in wartime conditions. The
Ukrainian government therefore authorized Microsoft
through special legal measures to act proactively andremotely to turn on this feature across devices throughout
the government and across the country.

human intervention. While this level of AI-based detection

Ultimately, all this illustrates three features that characterizecurrently cannot be applied outside cloud services, it

the state of cybersecurity protection as we approach thehighlights both the importance of broader recent threat

second quarter of the 21st century. The first is the role

intelligence and analysis and the opportunity for future

the private sector now plays in protecting a country in a

investments and improvements.

time of war. Unlike land, sea, and air, cyberspace is owned

A second set of innovations is equally important. These
involve internet-connected end-point protection thatmakes it possible to distribute through the internet
protective software signature code back to devices to
identify and disable destructive malware. In a sense, this isa bit like the role radar played in 1940, detecting malware
attacks and directing defensive forces to thwart them.

and operated in part by companies. This makes the war
in Ukraine different from major wars of the past. And it
imposes a heightened responsibility on tech companies to
use the best technology available and sometimes to takeextraordinary measures to help defend a country fromattack (even at no charge, in the case of Microsoft’s support
for Ukraine).

MSTIC on repeated occasions has been able to develop

Second, this role also places a high responsibility on the

new signatures in just a few hours and distribute them backtech sector to keep investing in ongoing innovation toto devices across Ukraine and more globally. These haveensure that defensive protection not only keeps pace withplayed a critical role in halting the movement of destructive

but exceeds innovations in offensive cyber-attack tactics

malware that otherwise could have spread widely acrossand capabilities. While it’s encouraging to witness theorganizations’ network domains.

relative success of defensive cyber-security protection in

Ongoing wartime measures and innovations with the
Ukrainian government have strengthened this protection

the first four months of the war in Ukraine, in no way can
defensive innovations afford to stand still.

further. In terms of Microsoft’s direct participation, two

Finally, there are important lessons from the war in Ukraine

such measures have been the most important. The firstfor the cybersecurity protection of all other organizations

has been the use of technology acquired from RiskIQ

and individuals around the world. The US Cybersecurity andthat identifies and maps organizational attack surfaces,

Infrastructure Security Agency, or CISA, has captured thisincluding devices that are unpatched against known

well in its now-famous phrase “Shields Up.” More than ever,vulnerabilities and therefore are the most susceptible tocybersecurity features such as multifactor authentication

attack. This information has been shared with the Ukrainianneed to be used by everyone, everywhere. Tech companies

government free of charge to enable it to accelerate thelike Microsoft will need to continue to make features likestrengthening of cyber-defenses. Ukrainian network

these easier for people to use and apply. And organizations

defenders worked tirelessly with the constant support of theand individuals alike will need to make good use of them.

CERT UA within the government to use this information toprotect computers across the country.

2 | The Evolution of Offensive Cyberattacks and Defensive Cybersecurity Operations

9Defending Ukraine: Early Lessons from the Cyber War

Russian Network Penetration and Cyber Espionage Activities Outside Ukraine

3
Destructive cyberattacks represent one part of a broader

Ukraine. These represent a range of strategic espionage

effort by the Russian government to put its sophisticatedtargets likely to be involved in direct or indirect support

cyber capabilities to work to support its war effort. As aof Ukraine’s defense, 49 percent of which have beencoalition of countries has come together to defend Ukraine,

government agencies. Another 12 percent have been NGOs

Russian intelligence agencies have stepped up their networkthat most typically are either think tanks advising on foreign

penetration and espionage activities targeting governments

policy or humanitarian groups involved in providing aid to

outside Ukraine. Not surprisingly, this increase appears to

Ukraine’s civilian population or support for refugees. The

be most focused on obtaining information from inside theremainder have targeted IT companies and then energy

governments that are playing critical roles in the West’sand other companies involved in critical defense or other

response to the war.

economic sectors.

Since the war began, MSTIC has detected Russian network
intrusion efforts on 128 targets in 42 countries outside

Countries outside Ukraine targetedby Russian cyber espionage since thestart of the war in Ukraine

3 | Russian Network Penetration and Cyber Espionage Activities Outside Ukraine10Defending Ukraine: Early Lessons from the Cyber War

While these targets are spread around the globe, 63 percentof military and humanitarian aid is coordinated. The Balticof this observed activity has involved NATO members. Basedcountries of Latvia and Lithuania represent a combined 14

on MSTIC’s observations, Russian cyber espionage efforts

percent of total intrusions outside Ukraine. (In contrast, inhave focused on targets in the United States more than any

Estonia, the third Baltic border country, where the country

other country, with American targets representing 12 percent

has adopted cloud services, we’ve detected no Russian cyberof the global total outside Ukraine.

intrusions since the onset of the Ukraine war.)

This focus on the United States has been followed closely

Russian cyber activities have also actively targeted Denmark,by activity targeting NATO members that geographically

Norway, Finland, and Sweden. These collectively represent

are the closest to Ukraine. At the top of this list is Poland,nearly 16 percent of all the observed Russian attacks globally.

with 8 percent of intrusions, where the delivery of a majority

Recent Russian network penetration and cyber espionage operations outside Ukraine
Russian network intrusion targets
Russian network intrusion targets
Government
Government
agencies
agencies
49%49%

IT IT
sectorsectorenterprises
enterprises
20%

20%

128
42
29%

CriticalCriticalinfrastructure
infrastructureorganizationsorganizations
19%
19%

NGOs
12%

NGOs
12%

Since the start of the war in Ukraine, MSTIC’s detections
have found that Russian actors have been successful
29 percent of the time. In a quarter of these successful
intrusions, MSTIC identified incidents that led to theRussian network intrusions

Countries

Success rate

In most instances the victims were operatingon premises, not in the cloud.

the extent of Russian cyber espionage success.
All this reflects the current and global state of offensive
cyber espionage and defensive cyber protection. As

successful exfiltration of an organization’s data.

the SolarWinds incident demonstrated 18 months ago,

Microsoft notifies customers when we observe a nation-

capabilities to implant code and operate as an APT thatstate attack against them, regardless of whether the attack

can obtain and exfiltrate sensitive information from a

was successful. These efforts to promptly notify victims of

network on an ongoing basis. There have been substantial

these breaches likely led to the successful defense of theiradvances in defensive protection since that time, especially

networks. But in most instances the victims were operating

in cloud services and cloud security technology, but

on local servers, not in the cloud. As a result, our visibility

the implementation of these advances remains uneven,into the total number of attacks, the success rate, and in

especially among European governments. As a result,particular the extent of data exfiltration, likely understatessignificant collective defensive weaknesses remain.

3 | Russian Network Penetration and Cyber Espionage Activities Outside Ukraine

Russia’s intelligence agencies have extremely sophisticated11Defending Ukraine: Early Lessons from the Cyber War

Russian Cyber Influence Operations

4

Russian information operations in the 1980s

The war in Ukraine has brought into bold relief a third
connected aspect of Russia’s sophisticated cyber operations.
In addition to destructive cyberattacks and cyber espionage
efforts, Russian agencies are deploying cyber influence
operations that are designed to support its war aims. These
involve sophisticated and coordinated efforts to use digitaltechnologies and the internet to create and spread false
narratives to advance multiple goals. The longer the war lasts,
the more pronounced and important these operations likely
will become, especially if they can be used successfully toundermine help Western unity and support.
Foreign influence operations are not new. Nations haveused propaganda to further their goals for centuries.
The Soviet Union long invested in and even excelled insowing doubt, chaos, or confusion in other countries. Oneof numerous examples involved work in the early 1980s
to blame the United States for the spread of AIDS. For
example, in July of 1983, an anonymous letter appearedin The Patriot, an obscure Indian newspaper. The letter’sheadline was “AIDS may invade India: Mysterious diseasecaused by US experiments.” The author purported to bea “well-known American scientist and anthropologist”
who claimed that the AIDS epidemic was the result of anexperiment at the Pentagon. The letter stated that theUnited States was moving its lab operations to Pakistan,

From: History, Philosophy, and Newspaper Library at the University of
Illinois at Urbana Champaign

thus putting the Indian people at greater risk.
The letter was later traced back and attributed to the KGB.

plausible. This is part of the recipe for what has long madeIt was part of a broader campaign that became known as

for effective Russian influence operations. They are carefully“Operation Infektion.” It became one of the most effectiveplanned to support a broader government strategy, executed

foreign influence operations in history. Unaware of thewith operational patience, take advantage of a specific public

letter’s origin, it led to panic by readers who found enoughissue or concern, and build narratives that combine enoughaccurate information in it to believe the entire premise wastrue facts to make a false narrative seem plausible.
And all this was before the internet.

4 | Russian Cyber Influence Operations

12

Defending Ukraine: Early Lessons from the Cyber War

To support the war in Ukraine, the Russian government

conflict. They target the Ukrainian population with the goal

is deploying a new generation of technology and tactics

of undermining confidence in the country’s willingness andto support cyber influence operations. These combine

ability to withstand Russian attacks. They target American

traditional tactics with the use of digital technologies andand European audiences to diminish Western unity andthe internet to give foreign influence operations a broader

deflect criticism of Russian military war crimes. And theygeographic reach, higher volume, more precise targeting,target nonaligned countries to support Russian efforts at theand far greater speed and agility. And, unfortunately,

United Nations and in other venues, combining longstanding

especially when pursued with patience and persistence,narratives demonizing democracy and Western intentions

these cyber influence operations are almost perfectly

and with emerging efforts to blame the west for potential

positioned to take advantage of the longstanding openness

food shortages.

of democratic societies and the public polarization that ischaracteristic of current times.

Agencies across the Russian government are targeting
each audience in textbook fashion through cyber influence

The Russian government currently is deploying an

operations. These use some tactics that are like those

expanding cyber influence operation to support its war

Microsoft has long observed in other Russian cyber activities.

efforts in Ukraine. These appear to be focused on four

As a result and as discussed below, it has become apparent

distinct audiences. They target the domestic Russianthat it will take new digital technologies and the advanced

population with the goal of sustaining support for theuse of data to better detect and counter these operations.

war by portraying Ukraine’s military as responsible for theRussian government’s cyber influence operations

MFA
Presidential
Administration
GRU

SVR• Media initiatives & branding• State media control• Funding

FSB

Diplomatic accounts
Interaffairs
Rossotrudnichestvo• Agenda setting• Global outreach

InfoRos
Donbass Tragedy
Anonymous social media• Leveraging cyber• Flooding the zone

Strategic Culture
Odna Rodyna
New Eastern Outlook
Oriental Review• Historical revisionism• Think tanks & academia

NewsFront
SouthFront
PolitNavigator
Antifascist• Near-abroad focus• Establishing new media
environment

ZvezvdaWar correspondents

MOD

4 | Russian Cyber Influence Operations• Frontline communications• Providing access forpreferred media

13

Defending Ukraine: Early Lessons from the Cyber War

A few examples help illustrate ongoing Russian tactics.

This approach was applied beginning in late 2021 to support

Like the patient pre-positioning of malware within an

the Russian false narrative around purported bioweaponsorganization’s computer network, Russian cyber influenceand biolabs in Ukraine. This narrative was first uploaded

operations pre-position false narratives in the public

on to YouTube on November 29, 2021, as part of a regulardomain on the internet. This pre-positioning has long

English-language show by a Moscow-based American

helped more traditional Russian cyber activities, especially

expatriate who claimed that US-funded biolabs in Ukraine

if IT administrators scan their most recent network activity.

were connected to bioweapons. The story went largely

Malware that sits dormant for an extended time on aunnoticed for months. On February 24, 2022, just as Russian

network therefore can make its subsequent use moretanks crossed the border, this narrative was sent into battle.

effective. And false narratives that sit unnoticed on the

A data analytics team at Microsoft has identified 10 Russian-internet can make subsequent references to them seem

controlled or influenced news sites that simultaneously

more credible.

published reports on February 24 pointing back to “lastThis approach is part of the reason cybersecurity experts
refer to Russian and other intelligence agencies as APTs.
In a similar way, Russian agencies operate through APM

year’s report” and seeking to give it credence. Russiansponsored teams then worked to amplify the narrative onsocial media and internet sites more broadly.

teams first to plant and subsequently spread their narratives.

In recent months, we have used data analytics and new data

These teams are pre-positioning false narratives, launchingsets to better track the flow and impact of Russian cybercoordinated campaigns to report narratives throughinfluence operations. Using these techniques, the Microsoft

government-backed and influencer outlets and channels,

team identified more than 300 Russian-sponsored websites

and amplifying narratives through tools designed to exploitthat published within two weeks stories promoting thesocial media and the internet.

biolabs narrative.

Bioweapons campaign timeline

November 29, 2021

4 | Russian Cyber Influence Operations

February 24, 2022

March 11, 2022

14

Defending Ukraine: Early Lessons from the Cyber War

Russian teams subsequently have used these tactics in similar

webhosts. The Lab has also developed AI tools to detect

ways, albeit on a rushed wartime basis that reflects less time to

new propaganda sites as they appear, using data fromplan. As illustrated in an additional example, on March 7, 2022,

a wide variety of internet sources and other identifying

the Russians published online with the Permanent Mission

characteristics to determine and forecast which newof the Russian Federation to the UN a claim that a maternity

domains may be candidates for foreign cyber influence

hospital in Mariupol had been emptied and was now being

operations. This technology is used in conjunction withused as a military site. On March 9, two days later, the Russian

sources from third-party reviewers, such as NewsGuard,

military bombed the hospital. When UN officials reacted withand the Global Disinformation Index (GDI) to help us define

concern, a Russian representative immediately tweeted thatwhich sites are known purveyors of state-sponsored media.   

the concern was “fake news,” citing the prior report.

Using these techniques, the RPI can be used to chart the

Looking beyond these examples, it’s possible to track

consumption of Russian propaganda across the internet

and calculate the creation and consumption of Russianand in different geographies on a precise timeline. The two

propaganda more broadly. Microsoft’s AI for Good Lab hasgraphs below show that consumption of narratives fromcreated a Russian Propaganda Index (RPI) to monitor the flow

Russian-controlled and -sponsored sites across the internetof of news from Russian state-controlled and -sponsoredrose sharply in both Ukraine and the United States in the initialnews outlets and amplifiers. This index measures the

weeks after the war began. The surge in Ukraine represents

proportion of this propaganda flow to overall news traffic on

an increase of 216 percent, while the spread of Russian

the internet, and is enabled for geographical regions, online

propaganda in the United States increased by 82 percent.

channels, and infrastructure providers such as registrars andRussian propaganda consumption in Ukraine

Russian propaganda consumption in the US• Starting in the last week of February, Russian
Propaganda Index went up 216% in Ukraine.

• Starting in January 2022, we saw a significant increasein traffic to Russian propaganda websites.

• Propaganda peaked on March 2 and has been going
down, but is still higher compared to before the war.

• The amount of Russian propaganda consumption
peaked on February 24 with an increase of 82%.
• Even after all efforts to reduce traffic to Sputniknews
and RT.com, consumption of Russian propaganda is still
higher than before the war (~60MM per month in theUS, on par with the WSJ).

4 | Russian Cyber Influence Operations

15

Defending Ukraine: Early Lessons from the Cyber War

Using internet data and these techniques, it’s also possible to identify the social media, search, and other sites that are being
used to encourage and channel traffic to these stories. And it’s possible to identify, as shown below, the specific reports andnarratives that attain the highest consumption levels in specific geographies and time periods.

Top 5 Russian propaganda articles in the US based on visits (February)
Article justifying the attack on February 24.
“The escalation follows years of unsuccessful talks, broken ceasefire
agreements, and a standoff between Russia and the West linked to the 2014
coup that overthrew the government in Kiev.”

Article about 12k volunteer Chechen soldiers ready to fight in Ukraine.
“On Friday, 12,000 local volunteers amassed on the central square of the regional
capital, Grozny. Kadyrov informed the publication ‘Chechnya Sevodnya’ of theirrally, which was organized in order to show their support for the Kremlin and theirreadiness to aid its objectives.”

Article about terms of surrender from Ukraine.
“According to Peskov, Russian President Vladimir Putin has expressed his
preparedness to engage in discussions with his Ukrainian counterpart, with afocus on obtaining a guarantee of neutral status and the promise of no weapons
on its territory.”

Article about how Ukraine’s revolution led to war.
“A motley crew of militant Ukrainian nationalists and pro-Western activists wanted
to change their democratically elected government. Eight years on, the results
look disappointing.”

Article about how the West will not help Ukraine.
“Accusing the West of leaving Ukraine to face Moscow alone, President Volodymyr
Zelensky said on Friday he was not afraid to negotiate an end to the Russian‘invasion,’ but would need security guarantees to do so.”

From: February 1-28, 2022

4 | Russian Cyber Influence Operations

16

Defending Ukraine: Early Lessons from the Cyber War

In part, as shown above, the sharp rise in February appears

This reflects in turn the many years that Russian cyber

to reflect some months of planning for selected narratives.

influence operations have been growing. These are not

But as shown on the graphs above, the tech sector’s efforts

confined to a single issue or country. For example, using

in early March to curtail the amplification of narratives fromsimilar digital and AI tools and the use of broader data sets, it’s

RT and Sputnik likely helped reduce the spread of Russian

possible to look back and better assess the breadth and depth

propaganda back to pre-February levels. And, as mentionedof Russian cyber influence operations focused on COVID-19

above, the onset of war likely has led subsequently to more

vaccine and lockdown issues. Russian efforts include a broad

hurried Russian activities that are less planful and patient.

multilingual approach, with outlets such as RT and Sputnik

Notably, however, the broader RPI levels in the United States

publishing initial content in more than 20 languages.

and Ukraine both remain at pre-February levels. And these

The expanded use of public data illuminates thelevels, which reflect a steady flow of Russian cyber influence

extraordinary contrast in vaccine messaging on a site like

operations, remain substantial. For example, this reflects

RT. For example, the most widely accessed relevant story

an estimated average American consumption of Russian

on RT in Russian suggested that lockdowns and booster

propaganda 60 million to 80 million page views per month,shots prevent COVID-19 transmission, while the most widely

enough to make the collective placement resulting fromaccessed story in English asserted that vaccinations fail to

Russian cyber influence on par with a major publication likecurb transmission and are ineffective against new strains.

the Wall Street Journal in the United States. And this estimate

While democratic societies rely on the public to discernof Russian propaganda almost certainly understates its

what is true and what is false, logic makes plain that both

total reach, given the inability at this point to ascertain withthese stories cannot possibly be true at the same time.

confidence and include every outlet being used.

Russian COVID-19 messaging differs by language
Anti-vaccine propaganda targets non-Russian readers
Topics covered by top 10 most-viewed coronavirus stories on RT.com

Russian (Translated below to English)

English•••••• “Vaccinations fail to curb transmission and are
ineffective against new strains”• “Pfizer vaccine has dangerous side effects”• “Mass vaccination is politically motivated”• “Pfizer & Moderna conduct unregulated trials”“Lockdowns & boosters prevent transmission”“Russian public figures are testing positive”“Cases & deaths are increasing in Russia”“The Sputnik V vaccine is highly effective”“Vaccine proof needed on public transport”“Chief Physician of the Center for Public Health andMedical Prevention of the Yamalo-Nenets Autonomous
Okrug supported the idea of mandatory​​
vaccination
against COVID-19 for certain population groups.”
Source: https://ru.rt.com/iqtq“The most critical situation with mortality,
hospitalization, and the proportion of seriously ill patientson artificial lung ventilation is noted in the Kursk region…
Golikova said.” Source: https://ru.rt.com/jpge

Documents released by the Food and Drug Administration
reveal that drugmaker Pfizer recorded nearly 160,000
adverse reactions to its Covid-19 vaccine in the initialmonths of its rollout.” Source: https://on.rt.com/bmzd“Successful vaccine rollouts have failed to stop Covid
transmission, with new data showing the prevalence of thevirus increasing in fully jabbed individuals, according to a
medical study in The Lancet.” Source: https://on.rt.com/bm4s

From: October 1, 2021 – April 30, 2022

4 | Russian Cyber Influence Operations

17

Defending Ukraine: Early Lessons from the Cyber War

New ZealandThis comparison also reflects the global reach of Russian
cyber influence operations, with what appears to be more
localized planning and impact. For example, Microsoft’s
RPI numbers for New Zealand show a spike beginning in
December 2021 that exceeds the figures for Australia theUnited States.

Russian Propaganda Index (RPI), New Zealand vs Australia and US
Russian propaganda
consumption in New Zealand issimilar to Australia until the firstweek of December 2021.
After December, Russian
propaganda consumption
in New Zealand increasedby over 30% relative toconsumption in Australia
and the US.

4 | Russian Cyber Influence Operations

18

Defending Ukraine: Early Lessons from the Cyber War

An assessment of the stories driving Russian
consumption
in New
Zealandin late 2021, including below, shows
Top 5propaganda
propaganda
articlesin New
Zealanda clear focus on COVID-19 issues. The top
two stories,
for example,
drove narratives that questioned the efficacy of vaccines
basedon visits(October-December)and suggested that they had life-threatening side effects. While it would be premature to draw concrete conclusions at thispoint about cause and effect, this spike in Russian propaganda consumption in New Zealand preceded an increase in public
protests in early 2022 in Wellington, the nation’s capital.

Top 5 Russian propaganda articles in New Zealand based on visits (October-December)
Article questioning the value of vaccines.
“Amid a surge in Covid-19 cases, Gibraltar has canceled official Christmas eventsand ‘strongly’ discouraged people from hosting private gatherings for four weeks.
Gibraltar’s entire eligible population is vaccinated.”

Article about how those vaccinated suffer from increased riskof mortality.
“Are the current vaccines that they want to impose on us effective? Failure for 18
months of this so-called ‘health strategy’ based on false simulations, innumerable
lies, promises never kept, as well as the propaganda and fear campaign has
become unbearable.”

Article about ex-Pfizer scientist Michael Yeadon who became ananti-vaxxer.
“You don’t need vaccines and you don’t need any of the measures that have been
introduced… and yet governments and their scientific advisors have lied to us for ayear... And just produced mayhem.”

Article about Pfizer vaccine side effects and deaths.
“These reactions ranged from the mild to the severe, and 1,223 were fatal. The
majority of these case reports involved people aged between 31 and 50 in the
United States.”

Article claiming Pfizer admitted to using aborted fetal tissues in vaccines.
“For billions of faithful around the world, abortion is considered first-degree
murder, yet fetal tissue is being used to develop Covid vaccines. While some may
argue that ‘killing a life to save millions’ is fine, many disagree.”From: October-December 2021

4 | Russian Cyber Influence Operations

19

Defending Ukraine: Early Lessons from the Cyber War

CanadaA similar picture emerges from the RPI figures in Canada.
Not surprisingly, the trend lines in Canada and the UnitedStates typically move in tandem. But earlier this year they
diverged starting on January 18, with the reach of Russian
propaganda peaking in Canada on February 5.

Russian Propaganda Index (normalized) US vs Canada
Russian propaganda in Canada
had a similar trend comparedto the US until the last week ofJanuary.
Russian propaganda increased~20% in Canada relative to
the US from 1/20/2022 to
2/18/2022.

4 | Russian Cyber Influence Operations

20

Defending Ukraine: Early Lessons from the Cyber War

Microsoft’s data found that four of the five most widely read internet-based propaganda stories in Canada in thisperiod focused on COVID-related protests in Ottawa. These reflected in part on a propaganda narrative suggesting thatmainstream media coverage of these protests was inadequate or biased. The start of this surge preceded the arrival ofa large convoy of protestors in trucks in Ottawa on January 28. Protestors then occupied areas around the Parliamentbuilding the last week of January and the first week of February, and the protests expanded to the Canadian-US border anddisrupted trade on February 8, just after propaganda dissemination reached its peak.

Top 5 Russian propaganda articles in Canada based on visits (January 20 – February 7)
Article that describes when Ottawa declared state of emergency.
“Ottawa mayor Jim Watson has declared a state of emergency, citing ‘serious
danger and threat to the safety and security of residents,’ as Freedom Convoy
truckers and their pedestrian supporters continue to occupy the capital.”

Article states that protests in Canada received no mainstream
media coverage.
“With the Freedom Convoy converging on the Canadian capital Ottawa on
Saturday January 29th, however, the week-long media silence on the protest
disappeared only to be quickly replaced by widespread mainstream media
condemnation.”  

Article about mainstream media being biased.
“News organizations that promised not to allow democracy to ‘die in
darkness’ have instead become the very penumbra obscuring the truth.”

Article about support of Elon Musk and Joe Rogan to Canadian truckers.
“Tesla and SpaceX founder Elon Musk and podcaster Joe Rogan have spoken about
the Canadian truckers driving across the country to protest the government’s
Covid-19 ‘Canadian truckers rule,’ Musk tweeted on Thursday afternoon.”

Article about the cancelation of American military assistance to Egypt.
“The US has announced that it is canceling $130 million in military aid to Egypt
over human rights concerns, with the move coming just days after the Biden
administration approved a $2.5 billion arms sale to the North African country.”

From: January 20 – February 7, 2022

4 | Russian Cyber Influence Operations

21

Defending Ukraine: Early Lessons from the Cyber War

All of this is indicative of the global reach of Russian cyberto support a longer war in Ukraine. The longer the war,

influence operations. These efforts rely fundamentally on

the more challenging it may become to sustain the unity

digital technology. They also rely on unintended action

and commitment of a broad international coalition. Justby enablers across the tech ecosystem. These include

as Russian operations focused during the past year oncompanies that register internet domains, host web sites,

COVID-19 fatigue, Ukraine and its NATO and other allies will

promote material on social media and search sites, andneed to prepare for Russian efforts to use cyber influence

channel traffic and help pay for these exercises throughoperations to undermine the support of their publics for

digital advertising. It therefore will be important to better

Ukraine. And as discussed below, like all the other threatsassess the role of the tech sector in connection with these

based on cyber technologies, the work to counter these

operations. There is a growing danger that Russian cyberthreats will require new innovations in both technology andinfluence operations will seek to exploit all these resources

public-private collaboration.

4 | Russian Cyber Influence Operations

22

Defending Ukraine: Early Lessons from the Cyber War

A Strategic Response to the Full Range of Russian Cyber Threats

5
Perhaps more than anything, the lessons from Ukraine

In fact, new advances in the defense of all these cyber

call for a coordinated and comprehensive multilateral andthreats will depend on some common tenets and, at least

multistakeholder strategy to strengthen defenses against

at a high level, a common strategy. The first defensive tenet

the full range of Russian cyber destructive, espionage, andshould recognize that Russian cyber threats are being

influence operations. It’s perhaps too easy for those outsideadvanced by a common set of actors inside and outsideof Russia to view these three areas as falling into separate

the Russian government that rely on similar digital tactics.

silos. But it’s helpful to recall the lessons that the British

For example, the same agencies play overlapping roles inauthor and journalist Gillian Tett documented more broadly

cyber destructive, espionage, and influence operations. And

in her book “The Silo Effect.” Notably, when people put

while it’s possible to find encouragement in either someproblems and issues in different categories, they more likely

Russian missteps or early triumphs of defensive technology,

will fail to connect the dots between them. In this case,the easiest and biggest mistake would be to declare aanalytical fragmentation creates the risk of tunnel visionpremature victory. Wars are won over time, setbacks canfor different cyber defenses and creates opportunities

be reversed, and Russian agencies have long invested infor foreign adversaries to exploit the seams between

sophisticated cyber tactics and techniques.

disconnected defensive efforts.

Four tenets to counter Russian cyber threats

Digital tactics

Public-private collaboration

Recognize that Russian cyber threats are being advanced
by a common set of actors inside and outside the Russian
government and rely on similar digital tactics. Use digitaltechnology and tactics to help counter them.

Recognize that unlike the traditional threats of the past,
cyber defenses require a unique level of public andprivate collaboration.

Multilateralism

Free expression

Embrace the need for close and common multilateralcollaboration among governments to protect open anddemocratic societies.

Uphold the importance of creativity and free expression
in democratic societies, even as new steps are needed toaddress the full range of cyber threats.

5 | A Strategic Response to the Full Range of Russian Cyber Threats23

Defending Ukraine: Early Lessons from the Cyber War

A second defensive tenet should recognize that unlike

world’s democracies share both common strengths andthe traditional threats of the past, cyber defenses rely

vulnerabilities. And the defense of these vulnerabilities willon a unique level of public and private collaboration.

increasingly require a common and united response.

The evolving threat landscape requires a whole-ofsociety approach. The private sector, particularly
technology companies, are on the front lines of cyber andinformation attacks. Likewise, civil society organizations
are key conveners that play a crucial role in engagement,
sometimes are involved in cyber data analysis, and are often
targets of these campaigns themselves.

A fourth and final defensive tenet should uphold theimportance of creativity and free expression in democraticsocieties, even as new steps are needed to address thefull range of cyber threats. The very definition of free anddemocratic societies is founded on freedom of expression
and the ability of people to create, share, and find content,
including material that sometimes reflects sharply

The fact that this report is authored by a company is clear

contrasting views. Democratic societies view this as aevidence of the inevitable role that the technology sector

strength rather than a weakness. And since the dawn of theplays in the cyber defense of nations in the world today.

first industrial revolution in the United Kingdom, freedom of

There is no ability to deny the importance of this role. There

thought has stimulated economic and technical innovationis only the question of whether it will be done well, and thisas well as new political currents.

requires both that leading technology companies adapt andthat governments work with the private sector in new ways.

An effective response must build on these tenets withfour strategic pillars. These should increase collective

A third defensive tenet should embrace the need forcapabilities to better (1) detect, (2) defend against, (3)close and common multilateral collaboration among

disrupt, and (4) deter foreign cyber threats. This approachgovernments to protect their open and democratic

is already reflected in many collective efforts to address

societies. While Russia’s destructive cyberattacks have been

destructive cyberattacks and cyber-based espionage.

confined to Ukrainian territory, the other cyber aspects ofThey also apply to the critical and ongoing work needed to

the war have a far wider reach. As this report shows, theaddress ransomware attacks. We now need a similar anddefense of Ukraine has depended critically on its ability

comprehensive approach with new capabilities and defenses

to move data while accessing it beyond its own borders.

when it comes to combatting the growing threat of foreign

When one considers the combination of cyber espionage

cyber influence operations. Here the work is less advanced,

and cyber influence operations, it’s apparent that thewhich is why this is discussed in additional detail below.

A comprehensive strategy to combat foreign cyber influence operations
DetectCollectively hunt, track, andinvestigate foreign cyber
influence operations—muchlike for other cyber threats.
Pull together and analyze
disparate efforts, currently
often in separate data
sets and in separateorganizational silos.

DefendReinvigorate traditional
journalism.
Develop and deploy
technology to help
consumers identify foreign
propaganda.
Advance civics education.
Educate the public about
how to be a sophisticatedinformation consumer.

5 | A Strategic Response to the Full Range of Russian Cyber Threats

Disrupt
Use the power oftransparency to alert the
public about new foreign
cyber influence operations.

Deter
Strengthen and extend
international norms toprotect against foreign
cyber influence operations.

Address the financial supply
to known foreign cyber
influence sites, including
through digital advertising.

24Defending Ukraine: Early Lessons from the Cyber War

The freedom of expression is of distinct importance in

Detection. As with cyber defenses, the first step indeveloping a strategic response to foreign cyber influence

countering foreign cyber influence operations is building

operations. This freedom inherently impacts and even limits

the capacity to detect them. For our part, Microsoft is

the role of democratic governments in addressing any issuebuilding on our already mature cyber threat intelligenceassociated with content on the internet. It’s an element that

infrastructure to develop a broader view inclusive of foreign

requires non-partisan discussion and considered thought.

influence operations.

The freedom of expression should also be of comparable

In addition to the digital, AI, and data advances discussed

importance to the role of tech companies, even as thisin the preceding section, last week we announced that we

differs in key respects from the role of governments.

entered into an agreement to acquire Miburo Solutions,

To support this, Microsoft has adopted four principles

a leading cyber threat analysis and research company

to anchor our work in this space. These start with a first

specializing in the detection of and response to foreign cyberprinciple that commits us to respect freedom of expression

influence operations. Miburo’s analysts will join Microsoft’sand uphold our customers’ ability to create, publish, andcybersecurity teams and play a vital role in expanding oursearch for information via our platforms, products, andthreat detection and analysis capabilities to address newservices. Second, we will proactively work to prevent ourcyberattacks and shed light on the ways in which foreign

platforms and products from being used to amplify foreign

actors use cyber influence operations in conjunction withcyber influence sites and content. Third, we will not willfully

other cyberattacks to achieve their objectives.

profit from foreign cyber influence content or actors. And
finally, we will prioritize surfacing content to counter foreign
cyber influence operations by utilizing internal and trusted
third-party data on our products.

Of course, no single company or organization can hopeto make progress in any of these areas by itself. New
and broader collaboration across the tech sector will be
important. And progress in analyzing and reporting foreign

Microsoft has adopted four principles to anchor our

cyber influence operations will heavily rely on the role ofwork in this space. These start with a first principle thatcivil society, including in academic institutions and non-commits us to respect freedom of expression and uphold

profit organizations.

our customers’ ability to create, publish, and search for
information via our platforms, products, and services.
Second, we will proactively work to prevent our platforms
and products from being used to amplify foreign cyber
influence sites and content. Third, we will not willfully
profit from foreign cyber influence content or actors.
And finally, we will prioritize surfacing content to counter
foreign cyber influence operations by utilizing internal andtrusted third-party data on our products.

Recognizing this role, researchers Jake Shapiro andAlicia Wanless at Princeton University and the Carnegie
Endowment for International Peace respectively havemapped out plans to launch the new “Institute for Researchon the Information Environment” (IRIE). With support fromMicrosoft, the Knight Foundation, and Craig Newmark
Philanthropies, this new institute will create an inclusive
multi-stakeholder research institution modeled after theEuropean Organization for Nuclear Research (CERN). It
will combine expertise in data processing and analysis to
speed up and scale new discoveries in this space. Findings
from this institute can be used to inform policy makers,
technology companies, and consumers more broadly.

5 | A Strategic Response to the Full Range of Russian Cyber Threats25

Defending Ukraine: Early Lessons from the Cyber War

Defense. The second strategic pillar should shore up

Journalists also need many other tools for their craft.

democratic defenses. This is a longstanding priority that

One is the ability to separate content from legitimate andneeds investment and is ripe for innovation. In part thisfraudulent sources. Technology is creating an ability toshould take account of the challenges technology has

falsify content and conceal their origin, and the ongoingcreated for democracy and the opportunities technology

development of AI that can be used to create “deep fakes”

has created to defend democratic societies more effectively.

risks making this problem much worse. This makes it

It’s appropriate to start with one of the great technologicalchallenges of our age, which is the impact of the internet
and digital advertising on traditional journalism. Since the1700s, a free and independent press has played a specialrole in supporting every democracy on the planet. This

important for the technology and media sectors to work
together, as they are through the Coalition for Content
Provenance and Authenticity (C2PA), to help create the firstversion of a technical standard that certifies the source andhistory of media content.

report appears 50 years and a few days after the Watergate

There is also a rapidly evolving need to help consumers

break-in. This makes it even more fitting to recognize

develop a more sophisticated ability to identify propaganda

the longstanding role of the free press in uncoveringthat comes from foreign cyber influence operations. Whilecorruption, documenting wars, and illuminating the largest

this may seem daunting, in some ways it resembles thesocietal challenges of this and every other time. But thework the tech sector has long pursued to combat otherinternet has gutted local news by devouring advertising

cyber threats. Consider the education of consumers to lookrevenue and luring away paid subscribers. Far too many

more carefully at an email address to help spot spam or

local newspapers have collapsed, and one of the manyother fraudulent communications. Countries like Finland

insights from our recent work has shown that Americanand Sweden have for decades educated consumers to help

counties that lack a newspaper are unknowingly andidentify Russian propaganda. Initiatives in the United States

inevitably exposed to a greater than average share oflike the News Literacy Project and the Trusted Journalism

foreign propaganda, especially from Russia.

Program are helping to develop better informed consumers

For these reasons, one of democracy’s critical defensive
prongs must strengthen traditional journalism and afree press, especially at the local level. This requiresof news and information. And globally, new technology likethe browser plug-in from NewsGuard can help move thiseffort forward much faster.

ongoing investment and innovation that must reflect theThis also should remind us that part of the foundation for

local needs of different countries and continents. The

democracy is an education in civics. As always, this needs

issues are not easy, and they require multi-stakeholder

to start in schools. But we also live in a world that requires

approaches, which Microsoft and other tech companies

that we all get ongoing civics education throughout ourincreasingly are supporting. They also increasingly involve

lifetime. The new Civics at Work pledge, led by the Centernew innovations in public policy, and this too deserves tofor Strategic and International Studies, seeks to reinvigorate

become an increasing public priority. This can include laws

civics literacy within corporate communities. It’s a goodthat enable publishers to negotiate ad revenue collectively

example of the breadth of opportunity to strengthen ourwith technology companies and legislation that provides

democratic defenses.

tax credits to relieve local newsrooms of a portion of their
payroll taxes for journalists they employ.

5 | A Strategic Response to the Full Range of Russian Cyber Threats26

Defending Ukraine: Early Lessons from the Cyber War

Disruption. In recent years, Microsoft’s Digital Crimes Unit

relating to Russia’s cyber influence operations. Reliable

has refined tactics and developed tools to help disrupt cyber

reports about newly discovered and well-documented

threats that range from ransomware to botnets and nation-

operations can help the public better evaluate what it reads,

state attacks. We’ve learned many critical lessons from thissees, and hears, perhaps especially on the internet.

experience, starting with the role that active disruption canplay to counter a broad range of cyberattacks.

To this end, Microsoft will build on and extend its existing
cyber reports and will release new reports, data, andAs we think about countering foreign cyber influence

updates related to what we discover about Russian cyber

operations, disruption may play an even more important

influence operations, including attribution statements whenrole. And the best approach to disruption is becoming

appropriate. And starting in late 2022, we will publish an

increasingly clear.

annual report that uses a data-driven approach to look

The best antidote to broad deception is more transparency.
There is an opportunity to counter foreign efforts to mislead
the public by providing the public with better information.

across the company at the prevalence of foreign information
operations on our platforms, the efficacy of our ongoing
efforts, and next steps to ensure incremental improvement.

(This is part of the reason independent journalism is so

It will become important to consider additional steps thatimportant). Efforts to promote transparency through more

can build on this type of transparency. The role of digital

information not only avoid the understandable concerns

advertising is especially important since ads can help fundand controversies that result from censorship; they build

these foreign operations while in the process helping tocredibility and confidence, especially when a track record

create an appearance of legitimacy for foreign-sponsoredgives people the opportunity to assess for themselvespropaganda sites. Like ransomware, the Russian government

information from trustworthy sources.

has helped foster a cyber influence ecosystem that pursues

We have put this type of transparency into action across a
range of cyberthreats. For example, it was only a few years

deception for profit, fueled in part by digital ad revenue. New
efforts will be needed to disrupt these financial flows.

ago at Microsoft that we debated internally and then took

Deterrence. Finally, we cannot expect nations to

the first decision to attribute a cyberattack to a nation-state.

change behavior if there is no accountability for(It’s perhaps not a coincidence that it involved Russia.) We’ve

violating international rules. Such accountability islearned that governments, tech companies, and NGOs

uniquely a governmental responsibility. But increasingly,

should attribute cyberattacks carefully and with ample

multistakeholder action is playing an important role inevidence. But the impact of such disruption is vital, and it has

strengthening and extending international norms. More thanthe potential to be even more helpful in disrupting foreign

30 online platforms, advertisers and publishers —including

cyber influence. Witness the US government’s information-

Microsoft—signed on to the recently updated European

sharing in the lead-up to Russia’s invasion of Ukraine,

Commission’s Code of Practice on Disinformation, agreeing

exposing Russian plans, including specific campaigns such as

to strengthened commitments to tackle this growing

a plot to use a fake graphic video, that put transparency into

challenge. Like the recent Paris Call, the Christchurch Call,effective action.

and the recent Declaration on the Future of the Internet,

Like the recent publication from the CyberPeace Institute in
Geneva on ongoing cyberattacks inside and outside Ukraine,
there is an opportunity for a broad range of civil society
and private-sector organizations to advance transparency

5 | A Strategic Response to the Full Range of Russian Cyber Threats

multilateral and multistakeholder action can bring together
the governments and public among democratic nations.
Governments can then build on these norms and laws toadvance the accountability the world’s democracies needand deserve.

27©2022 Microsoft Corporation. All rights reserved.