Cyber attacks against Estonia (2007)

Date 	27 April until May 2007 (three to four weeks of malicious activities – the end is not sharply delineated).
Suspected actor	Group of hackers from around the world.J Davis, “Hackers Take Down the Most Wired Country in Europe”, (21 August 2014), Wired. Allegations have been circulating about the support by the Russian Federation to the attack, always denied by the Russian government.Wire Reports, “Kremlin denies involvement in cyber attacks on Estonia”, (18 May 2007), The Baltic Times.
Target 	The attacks were directed to both the Estonian public and private sectors. Public institutions including the websites of the Prime Minister, the Parliament and almost all of the country’s government ministries have been targeted by the attack. Private sector institutions such as banks, telecommunications operators and three of the country’s six big news organizations and two of the major Estonian banks have been targeted.I Traynor, “Russia accused of unleashing cyberwar to disable Estonia”, (17 May 2007), The Guardian.
Target systems 	Estonian essential infrastructures, telecommunications, name servers, web sites, e-mail, DNS.
Method 	Waves of DDoS (distributed denial-of-service) attacks overloading Estonian servers. According to the Estonian Defence Minister, Jaak Aaviksoo, the attackers commanded nearly a million “zombie” computers creating a huge world-wide network of bots in order to amplify the impact of the attack.A Blomfield, “Russia accused over Estonian 'cyber-terrorism'”, (17 May 2007), The Telegraph. The DDoS overwhelmed Estonian websites with massive requests of data, increasing traffic and overloading the servers to a standoff with ping flood scripts. The analysis of the DDoS attacks by Arbor’s Security Engineering & Response Team (ASERT), showed that the largest cyber attacks caused streams of 90 megabits of data a second, lasting up to 10 hours each. J Nazario, “Estonian DDoS Attacks – A summary to date”, (17 May 2007), Netscout.
Purpose 	The cyber attack seemed to have followed a political row in retaliation to the relocation of a Soviet “Monument to the Liberators of Estonia” from the center of Tallinn to a military cemetery on the outskirt of the city.P Finn, “Statue's Removal Sparks Violent Protests in Estonia”, (28 April 2007), The Washington Post. Since the monument represents the USSR’s victory over Nazism, the relocation has been considered by Moscow to be an outrageous act and sparked riots in the streets of the capital city involving mostly Russian nationalists. Following the removal, the Russian foreign Minister Sergei Lavrov said Moscow would “take serious steps” even though he never specified what kind of measures.N Adomaitis, “Estonian capital suffers second night of violence”, (27 April 2007), Reuters.
Result 	The attack caused email servers mainframes failures, DNS servers overloading, and damaging of routers. On 10 May, Hansabank, Estonia’s biggest bank, was forced to shut down its online service for more than an hour and blocked access to 300 suspect Internet addresses, causing a loss quantified at $1 million.M Landler, J Markoff, “Digital Fears Emerge After Data Siege in Estonia”, (29 May 2007), The New York Times. Due to the nature of the attacks, public and private entities defended themselves by blocking the access from sources that were outside the countries, resulting in the obscuration of their websites to the rest of the world.G Ahmad, “Politics on the Wire”, (12 June 2007), Symantec Official Blog. Although disruptive, the DDoS attacks did not create any physical damage and did not rise to the level of actual cyberwarfare.S Ranger, “What is cyberwar? Everything you need to know about the frightening future of digital conflict”, (7 September 2018), ZDNEt.
Aftermath 	Following the three-weeks-wave of cyber attacks, Estonia launched an investigation to find those responsible, with no success. Due to the nature of the attack, there has been no evidence connecting the Kremlin to the campaign.A Blomfield, “Estonia calls for Nato cyber-terrorism strategy”, (18 May 2007), The Telegraph. What is certain is that the act was highly coordinated and could not be the work of a single hacker, but rather a well prepared group.R Coalson, “Behind the Estonia Cyberattacks”, (6 March 2006), Radio Free Europe Radio Liberty. The Estonian government has not blamed the Russian authorities directly but its foreign ministry published a series of IP addresses originating from Russia.BBC Report, “The Cyber Raiders Hitting Estonia”, (17 May 2007), BBC.
Analysed in 	Scenario 05: State investigates and responds to cyber operations against private actors in its territory
Collected by: Samuele De Tomas Colatin
Category:Example
Category:2007
Category:DDoS