Hacks and arrests as cyberwar fears swirl

Hackers yesterday temporarily shut down dozens of Ukrainian government websites, causing no major damage but adding to simmering tensions while Russia amasses troops on the Ukrainian border.

Separately, in a rare gesture to the United States at a time of chilly relations, Russia said it had arrested members of a major ransomware gang that targeted US entities.

The events, though seemingly unrelated, came during a frenetic period of activity as the US accused Moscow of preparing for a further invasion of Ukraine and creating a pretext to do so.

The White House said US intelligence officials had determined that Moscow had positioned operatives to conduct a ‘‘false flag operation’’ in eastern Ukraine, and was laying the groundwork through a social media disinformation campaign that framed Ukraine as an aggressor preparing an attack against Russian-backed forces in eastern Ukraine.

White House press secretary Jen Psaki said Russian operatives trained in urban warfare could use explosives to carry out acts of sabotage against Russia’s own proxy forces, blaming the acts on Ukraine.

Yesterday’s cyberattacks targeted about 70 websites of national and regional government bodies. Suspicion was cast on Russia, which has a history of peppering Ukraine with damaging cyberattacks.

Ukraine’s Security Service, the SBU, said the preliminary results of an investigation indicated the involvement of ‘‘hacker groups linked to Russia’s intelligence services’’. It said personal data was not leaked.

Meanwhile, the White House said it welcomed news of the arrests in Russia of alleged ransomware gang members, an operation Moscow said was done at the request of US authorities.

An official, who spoke on the condition of anonymity, said the

arrests were thought by the White House to be unrelated to the Russia-Ukraine tensions.

Russia’s past cyber operations against Ukraine include a hack of its voting system before 2014 national elections, and of its power grid in 2015 and 2016.

In 2017, it unleashed one of the most damaging cyberattacks on record with the NotPetya virus, which targeted Ukrainian businesses and caused more than US$10 billion (NZ$14.7b) worth of damage globally.

Ukrainian cybersecurity professionals, aided by more than US$40 million in US State Department assistance, have been fortifying the defences of critical infrastructure ever since.

Experts say Russian President Vladimir Putin could use cyberattacks to destabilise Ukraine and other ex-Soviet countries that wish to join Nato, without having to commit troops.

Tensions between Ukraine and Russia are high, with Moscow amassing an estimated 100,000 troops near its border with Ukraine.

The attacks follow a year in which cybersecurity became a top concern because of a Russiangovernment cyberespionage campaign

targeting US government agencies, and ransomware attacks launched by Russia-based criminal gangs.

Russia’s Federal Security Service (FSB) announced the detention of members of the REvil ransomware gang. The group was behind last year’s Fourth of July weekend supply chain attack targeting a software firm, which crippled more than 1000 businesses and public organisations globally.

The FSB claimed to have dismantled the gang, but REvil effectively disbanded last July. Cybersecurity experts say its members largely moved to other ransomware syndicates.

According to the FSB, the operation was conducted at the request of US authorities, who had identified the group’s leader.

It is the first significant public action by Russian authorities since US President Joe Biden warned Putin last year that he needed to crack down on ransomware gangs.

Experts said it was too early to know if the arrests signalled a major Kremlin crackdown on ransomware criminals, or if they were just a piecemeal effort to appease the White House.