US officials warned that a wave of debilitating cyberattacks could accompany Russia’s war on Ukraine. So far they haven’t materialized, and US and Ukrainian officials are contemplating why as they prepare for the next phase of the war.
There have been several hacks of Ukrainian organizations, but no reports yet of the sort of high-impact cyberattacks on transportation or electric infrastructure that some feared. The possible explanations for this, analysts say, range from disorganization in Russian military planning to hardened Ukrainian defenses, to the fact that bombs and bullets take precedence over hacking in wartime. The reason Russia has so far not flexed in cyberspace during the war may be unattainable — or require being inside the minds of Russian spy chiefs. But how US, European and Ukrainian officials perceive the situation shapes how they allocate resources to defend Ukrainian computer networks as the war continues. « What we have seen to date from Russia’s state cyber actors appears to reflect the same challenges seen in their conventional forces, » said a US cyber defense official, who spoke on the condition of anonymity because they were not authorized to speak to the press. « It is likely that inadequate preparation and bad assumptions have resulted in a haphazard performance that underplays their known capabilities. » Limited Russian cyberattacks Cyberattacks have played a supporting, not a central, role in the war and hacking incidents preceded and accompanied Russia’s bombardment of Ukraine: • February 15: Cyberattacks temporarily knocked the websites of Ukrainian agencies and big banks offline. The White House blamed Russia for the incident (the Kremlin denied involvement). • February 23: Hours before Russian airstrikes began hitting Ukraine, a cyberattack deleted data at multiple Ukrainian government agencies and private companies. • February 25: Ukrainian government officials accused hackers working for the Belarusian Ministry of Defense of trying to break into the private email accounts of Ukrainian military personnel. • March 10: Unidentified hackers caused disruptions at Ukrainian internet service provider Triolan, which has customers in big Ukrainian cities. Triolan blamed « the enemy » (a reference to Russia) for the incident but did not provide evidence to support the allegation. Gen. Paul Nakasone, the most senior military cyber official in the US government, offered a vague, multi-faceted explanation for the relatively muted Russian cyber activity to lawmakers this week.
