A major cyber incident in Russia: two groups, Cyber Partisans & Silent Crow, took credit for a cyber attack on Aeroflot, claiming they destroyed its internal IT systems. Aeroflot didn't acknowledge the attack but canceled nearly 100 flights & delayed some more due to an 'outage'
Russia's Office of Prosecutor-General said that the incident was caused by a hacker attack & opened a criminal case under art. 272 of the Criminal Code (illegal access to computer info)
It remains to be seen how soon the airline will recover & whether it would face legal consequences
Cyber Partisans formed in fall 2020 on the backdrop of the protests following presidential elections in Belarus. Initially it mostly targeted Belarusian gov't & organizations, but starting in 2022 also hit Russian targets
Silent Crow emerged on Telegram in January & leaked several datasets allegedly stolen from Russian firms (at least 2 cases were confirmed in court: t.me/cyberguerre/29…, t.me/cyberguerre/32…). Acc. to @bizone_en researchers, Silent Crow is rebranded DumpForums
The alleged attackers have already collaborated before: in late March they claimed a hack of the Belarusian national CERT, apparently exaggerating the impact of the attack
The document expands the scope of states whom Russia seeks to deter. In addition to states with nukes and other WMD nuclear deterrence is now also aimed at states that provide land, air, sea & resources under their control for preparing and carrying out aggression against RU
2/
An aggression by any ally against Russia is considered an aggression by the whole alliance. An aggression by a non-nuclear state with the participation or support of a nuclear states is considered as their joint attack
3/
Came across a story that illustrates the tension in the USSR between smuggling computers & maintaining security. Translation in ALT, short summary below
In 1984, Lithuania was planning to import a Siemens 7536 computer — apparently, in some shady way — to be used at Gosplan
The Lithuanian KGB learned from its agent nicknamed
(sic!) "Vilnius" that Siemens, a West German firm, knew long in advance where this computer would be installed & operated. Not only did the Germans assemble it, under the contract they would independently repair it
This, from the KGB perspective, created the possibility that "intelligence tools" could be implanted into the computer to intercept secret data about Lithuania's economic situation — Gosplan, the State Planning Committee, would be the best plan to do just that
New cyber conflict-related criminal cases in Russia. Two men were separately arrested by the FSB in Tomsk & Kemerovo Oblast for their involvement w/ Ukrainian hackers. Notably both were charged with state treason (article 275) rather than computer crimes
Previously, 3 men were separately sentenced to 2-3 years & fines for participating in DDoS attacks launched by pro-Ukrainian hackers early in the war. Each was convicted for unlawful interference with critical infrastructure (article 274.1)
Recently, a Western colleague raised a question, with some skepticism: "Are there really any significant cyber incidents in Russia? Not defacements or websites taken down for a day or two"
It's hard to overstate how different the situation has been since the start of the war
I wouldn't say that nothing was happening before, but as far as publicly known incidents are concerned they weren't plenty
Now, almost every other day there's a data breach or some kind of attack that would have deserved nation-wide coverage before; now everyone got used to them
Even with many stories unreported, there is so much activity that it's kind of overwhelming. There are different opininions in the Russian infosec community, but many people describe the current situation as cyber war and Russia as a testing range for all kinds of attacks
Probably the most remarkable change is in para 26: an explicit mention that in the event of an unfriendly acts by foreign states or their groups including the use of modern ICT Russia would consider it lawful to respond in symmetrical or asymmetrical manner
This is significant because previously neither the Foreign Policy Concept nor other strategic document explicitly stated that the use of ICT against Russia could trigger a response