Pro-Ukrainian Hackers Strike Russian State TV on Putin's Birthday

Ukraine has claimed responsibility for a cyber attack that targeted Russia state media company VGTRK and disrupted its operations, according to reports from Bloomberg and Reuters.

The incident took place on the night of October 7, VGTRK confirmed, describing it as an "unprecedented hacker attack." However, it said "no significant damage" was caused and that everything was working normally despite attempts to interrupt radio and TV broadcasts.

That said, Russian media outlet Gazeta.ru reported that the hackers wiped "everything" from the company's servers, including backups, citing an anonymous source.

A source told Reuters that "Ukrainian hackers 'congratulated' Putin on his birthday by carrying out a large-scale attack on the all-Russian state television and radio broadcasting company."

The attack is believed to be the work of a pro-Ukrainian hacker group called Sudo rm-RF. The Russian government has since said an investigation into the attack is ongoing and that it "aligns with the anti-Russian agenda of the West."

The development comes amid continued cyber attacks targeting both Russia and Ukraine against the backdrop of the Russo-Ukrainian war that commenced in February 2022.

Ukraine's State Service of Special Communications and Information Protection (SSSCIP), in a report published late last month, said it has observed an increase in the number of cyber attacks targeting security, defense, and energy sectors, with 1,739 incidents registered in the first half of 2024 reaching, up 19% from 1,463 in the previous half.

Forty-eight of those attacks have been deemed either critical or high in severity level. Over 1,600 incidents have been classified as medium and 21 have been tagged as low in severity. The number of critical severity incidents witnessed a drop from 31 in H2 2023 to 3 in H1 2024.

Over the past two years, adversaries have pivoted from staging destructive attacks to securing covert footholds to extract sensitive information, the agency said.

"In 2024, we observe a pivot in their focus towards anything directly connected to the theater of war and attacks on service provider — aimed at maintaining a low profile, sustaining a presence in systems related to war and politics," Yevheniya Nakonechna, head of State Cyber Protection Centre of the SSSCIP, said.

"Hackers are no longer just exploiting vulnerabilities wherever they can but are now targeting areas critical to the success and support of their military operations."

The attacks have been primarily attributed to eight different activity clusters, one of which includes a China-linked cyber espionage actor tracked as UAC-0027 that was observed deploying a malware strain called DirtyMoe to conduct cryptojacking and DDoS attacks.

SSSCIP has also highlighted intrusion campaigns staged by a Russian state-sponsored hacking group dubbed UAC-0184, pointing out its track record of initiating communications with prospective targets using messaging apps like Signal with the goal of distributing malware.

Another threat actor that has remained laser-focused on Ukraine is Gamaredon, a Russian hacking crew that's also known as Aqua Blizzard (previously Actinium), Armageddon, Hive0051, Iron Tilden, Primitive Bear, Shuckworm, Trident Ursa, UAC-0010, UNC530, and Winterflounder.

"The intensity of the physical conflict has noticeably increased since 2022, but it's worth noting that the level of activity from Gamaredon has remained consistent – the group has been methodically deploying its malicious tools against its targets since well before the invasion began," Slovak cybersecurity firm ESET said in an analysis.

Notable among the malware families is an information stealer called PteroBleed, which also relies on an arsenal of downloaders, droppers, weaponizers, backdoors, and other ad hoc programs to facilitate payload delivery, data exfiltration, remote access, and propagation via connected USB drives.

"Gamaredon has also demonstrated resourcefulness by employing various techniques to evade network-based detections, leveraging third-party services such as Telegram, Cloudflare, and ngrok," security researcher Zoltán Rusnák said. "Despite the relative simplicity of its tools, Gamaredon's aggressive approach and persistence make it a significant threat."