Ukraine has said all evidence points to Russia being behind a massive cyberattack that knocked out key government websites and defaced them with menacing messages, as Microsoft warned the hack could be far worse than first thought.
Kyiv accused Moscow of continuing to ‘wage a hybrid war’ and said the attack was part of a plot to ‘destablise the situation in Ukraine’.
It comes amid heightened tensions between the rival nations, as Russia held sniper drills for its troops today, with up to 100,000 stationed on the border with Ukraine.
The US also accused Russia of sending saboteurs trained in explosives to stage an incident that could be the pretext to invade its pro-Western neighbour.
Ukraine’s SBU security service said the cyberattacks, conducted in the early hours of Friday, had targeted a total of 70 government websites.
The messages left on the Ukrainian websites on Friday were in three languages: Ukrainian, Russian and Polish. The message read: Ukrainian! All your personal information has been uploaded to the general network. All data on the computer is destroyed, it is impossible to destroy them. All the information about you has become public, be afraid and expect the worst. This is for you past, present and future. For Volhynia, for the OUN UPA, for Galicia, for Polissya and for historical lands.’
It comes amid heightened tensions between the rival nations, as Russia held sniper drills for its troops today, with up to 100,000 stationed on the border with Ukraine
The website of the foreign ministry for a time displayed a message in Ukrainian, Russian and Polish that read: ‘All information about you has become public. Be afraid and expect the worst.’
The Ukrainian digital transformation ministry said: ‘All evidence points to Russia being behind the cyberattack. Moscow is continuing to wage a hybrid war.’
The ministry said the purpose of the attack ‘is not only to intimidate society. But to also destabilise the situation in Ukraine, halting the work of the public sector and crushing Ukrainians’ trust in the authorities’.
The Kremlin has insisted there was no evidence Russia was behind the attack.
‘We have nothing to do with it,’ President Vladimir Putin’s spokesman Dmitry Peskov told CNN. ‘Ukrainians are blaming everything on Russia, even their bad weather in their country,’ he said.
Kyiv said late Friday it had uncovered the first indications that Russian security services could have been behind the cyberattack.
The messages left on the Ukrainian websites on Friday were in three languages: Ukrainian, Russian and Polish.
The message read: Ukrainian! All your personal information has been uploaded to the general network. All data on the computer is destroyed, it is impossible to destroy them.
‘All the information about you has become public, be afraid and expect the worst.
‘This is for you past, present and future. For Volhynia, for the OUN UPA, for Galicia, for Polissya and for historical lands.’
The message referred to Volhynia and Eastern Galicia, where mass killings were carried out in Nazi German-occupied Poland by the Ukrainian Insurgent Army (UPA). The episode remains a point of contention between Poland and Ukraine.
A laptop screen displays the warning message that appeared on the official website of the Ukrainian Foreign Ministry after a cyberattack
Within hours of the breach, the security service said access to most affected sites had been restored and that the fallout was minimal.
But Microsoft warned Sunday that the cyberattack could prove destructive and affect more organisations than initially feared.
The US software giant said it was continuing to analyse the malware and warned it could render government digital infrastructure inoperable.
‘The malware, which is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom,’ Microsoft said in a blog post.
The number of affected organisations could be larger than initially thought, Microsoft warned.
But Rick Holland, Chief Information Security office at San Francisco-based Digital Shadows, said this kind of attack was part of the Russian playbook.
‘Whether Russia encourages other actors or directs cyber operations themselves, Russia seeks to disrupt government and private institutions of their geopolitical opponents.’
John Bambenek, of US cybersecurity firm Netenrich, said: ‘Recovery depends on each entity, but Ukraine has a long history of responding to and recovering from sabotage attacks from Russia.’
Snipers started the shooting training at the Kadamovsky training ground in the Rostov region
Russian troops from the western military district in tank ambush drills
Russia has amassed tanks, artillery and tens of thousands of troops near the border of Ukraine and demanded guarantees that its neighbour will never join NATO.
Putin’s troops held sniper drills in Russia’s Rostov region, which borders Ukraine, in a show of strength amid the escalating tensions between the two countries.
Video shows the latest shooting exercises while separate new footage highlights the alleged transfer of two deadly mobile short-range ballistic missile systems 9K720 Iskander thousands of miles across Russia towards the conflict zone.
This comes amid warnings from the West that war is ‘inevitable and imminent’ while a leading Russian newspaper Moskovsky Komsomolets stressed that Putin has ‘raised the game’s stakes so much that bluffing is no longer an option’.
And there are claims from Ukrainian military intelligence that leaking ammonia at a chemical plant in pro-Russian rebel-held Horlivka may be intended as a pretext to accuse Kyiv of a chemical weapons attack, and a trigger for invasion.
The sniper drills involving 100 servicemen were held at Kadamovsky training ground, some 37 miles from the Ukraine border.
Special forces of the Western military district, which borders Ukraine, conducted drills using Arbalet-2 and Malva guided parachute systems in the Tambov region
This follows live fire tank training at Mulino in Nizhny Novgorod region at a time when Putin is reported to have 100,000-plus troops and heavy military equipment close to the Russian border with Ukraine.
More than 300 servicemen were involved in these special tactical exercises.
Russian troops from the western military district in tank ambush drill
Russian troops from the western military district in tank ambush drills
Elsewhere in Voronezh region, which borders Ukraine, crews of T-72B3 tanks were drilled in ‘the skills of night driving combat vehicles in heavy snowfall and a blizzard at the Krinitsa training ground’.
Videos on TikTok analysed by Conflict Intelligence Team (CIT), a Russian group monitoring military movements, are said to show Iskander missiles moving from Ulan-dUe in Siberia and Birobidzhan, a town in the Russian far east.
The team claims the equipment is moving west towards Ukraine.
Russia has repeatedly denied any intention of invading Ukraine, and insisted it has the right to move military equipment and troops on its own territory.
An exercise in moving military equipment from the east of Russia was announced last week.
Ukraine has said citing OSCE monitoring evidence that 99 Russian units of military equipment have been recorded in rebel-held Donetsk and Luhansk regions.
This included three multiple launch rocket systems.
Ballistic missile Iskander-M launch at Kapustin Yar landfill in Astrakhan region, pictured in 2019
Putin’s spokesman Dmitry Peskov said at the weekend: ‘There’s a critical situation here. The critical situation is around the concerns, national concerns of Russia.’
He said ‘no-one is threatening anyone with military actions’ which would be ‘madness’, but added: ‘We will be ready to take counteractions.’
Senior Russian and Western officials held three rounds of talks in Geneva, Brussels and Vienna this last week without achieving a breakthrough to quell the tensions.
By the end of the week, Washington warned that Moscow could stage a false flag operation within weeks to precipitate an invasion.
US national security advisor Jake Sullivan said Sunday Washington would set out its next steps in the crisis after consulting with its partners in the coming days.
‘But the key point here is that we’re ready either way,’ Sullivan told CBS.
‘If Russia wants to move forward with diplomacy, we are absolutely ready to do that in lockstep with our allies and partners.
‘If Russia wants to go down the path of invasion and escalation, we’re ready for that too, with a robust response.’
Video filmed in Sverdlovsk region on January 13, allegedly shows Iskanders relocating to the West
On Sunday, NATO chief Jens Stoltenberg again called on Russia to de-escalate, adding that ‘we are ready to sit down and also listen to their concerns’.
Putin’s spokesman Peskov said that there were ‘some understandings between’ Russia and the West.
‘But in general, in principle, we can now say that we are staying on different tracks, on totally different tracks. And this is not good. This is disturbing,’ he told CNN.
Ukrainian Foreign Minister Dmytro Kuleba said Kyiv and its Western partners were working on a broad ‘package to contain Russia’ that would include ‘painful’ new sanctions and moves to ramp up defence cooperation with the West.
‘If Putin wants to know why neighbours are seeking to join NATO he only needs to look in the mirror,’ he said in remarks released by the foreign ministry on Sunday.
Ukrainian Foreign Minister Dmytro Kuleba said Kyiv and its Western partners were working on a broad ‘package to contain Russia’ that would include ‘painful’ new sanctions and moves to ramp up defence cooperation with the West
It comes as Ukraine’s former leader Petro Poroshenko returned to Kyiv from Europe despite the risk of arrest, as he vowed to help protect the ex-Soviet country from a possible Russian invasion.
Poroshenko, who served as president between 2014 and 2019, was placed under investigation for high treason and left Ukraine in December.
He said he would come home on Monday, stressing Ukraine could be facing the ‘greatest’ security risk in 30 years and adding he wanted to help the government of Volodymyr Zelensky despite their differences.
‘I return to Ukraine to fight for Ukraine, not to fight with Zelensky,’ Poroshenko told reporters in Warsaw on Sunday.
Ukraine’s former leader Petro Poroshenko has his passport checked after his arrival at an airport some 40 kilometres outside Kyiv on January 17, 2022
He said in a video address posted on Facebook earlier that he wanted to come home to help the government protect his country ‘from Russian aggression’.
Poroshenko was set to fly back to Ukraine from Warsaw, and his plane was expected to touch down in Kyiv at 0710 GMT on Monday.
Speaking to reporters in Warsaw, he said he did not expect authorities to detain him. ‘I see no reason for that,’ he said.
A court in Kyiv was to decide Monday whether to arrest Poroshenko, and the former leader said he would attend that hearing.
Poroshenko, 56, is one of the country’s richest men. He was elected president after Russia annexed the peninsula of Crimea and as fighting escalated between Kyiv troops and Moscow-backed separatists in the industrial east of the country.
In 2019, he was trounced in a presidential election by Zelensky, a comedian with no previous political experience at the time.
Ukrainian former President Petro Poroshenko speaks to an officer of the Ukrainian State Border Guard Service upon arrival at Zhulyany airport in Kyiv, Ukraine January 17
Poroshenko is now a member of parliament and leader of an opposition party, European Solidarity.
By returning home, Poroshenko would be following in the footsteps of Georgia’s former president Mikheil Saakashvili and Russian leader Vladimir Putin’s top enemy Alexei Navalny who both came back home in defiance of the authorities and are now in jail.
Authorities say they are investigating dozens of alleged crimes in which Poroshenko might be involved.
He is suspected of aiding the self-proclaimed Donetsk and Lugansk People’s Republics in selling around 1.5 billion hryvnia ($54 million) worth of coal to Kyiv between 2014 and 2015.
He faces up to 15 years in prison if convicted in the treason case.
Poroshenko has denied any wrongdoing and accused Zelensky, 43, of orchestrating the charges in order to deflect attention from his domestic and foreign policy failures.
In his video address on Facebook, Poroshenko accused Zelensky of not doing enough to protect Ukraine from Russia and offered his help.
‘We are ready to help the authorities. We are ready to share our thoughts and advice,’ he said, adding his party would support ‘all initiatives aimed at strengthening the defence potential of our state and the European direction of our country.’
Ukraine has been fighting pro-Russian separatists in the eastern Donetsk and Lugansk regions since 2014, in a conflict that has claimed more than 13,000 lives.