Sources tell me ~15 sites in Ukraine - all using October content management system - have been defaced, incl Min of Foreign Affairs, Cabinet of Ministers, Min of Ed, Emergency Services, Treasury, Environmental Protection. Attackers apparently used this: cvedetails.com/cve/CVE-2021-3… 
Screenshot in my previous tweet is Ministry of Foreign Affairs site. Site is currently down, but @ChristopherJM grabbed screenshot before it went down. In addition to defacements, Min of Veterans has been hit with DDoS campaign sources tell me.
There's currently no indication that the attacks went beyond defacement and DDoS, but it's too early to say.
Here's a description of the vulnerability in the October content-management system that sources tell me the hackers used to deface the Ukrainian sites👇
Sources tell me the attacks were done manually this evening - meaning they weren't automated attacks configured prior to this evening - and the attacker or attackers changed admin credentials and defaced the main page of the sites
Sources tell me be careful about interpreting what is meant by “destructive” in Ukraine story. At least 2 gov sites still down - one for registering vehicle insurance, other egov (passports etc). Volumes wiped, but not databases. Restoring from backup
reuters.com/world/europe/e…
reuters.com/world/europe/e…
When general public hears a cyberattack was “destructive,” they interpret it differently from how security community interprets it. Public thinks critical infrastructure is destroyed, things are broken or exploding. Security ppl know this generally means data/servers were wiped
• • •
Missing some Tweet in this thread? You can try to
force a refresh
