Ukraine targeted by dangerous new malware

What do we know so far?

A dangerous new form of malware, named Cyclops Blink, has been identified in cyberattacks against Ukrainian networks and devices. Early reports are linking it to Russian-backed hackers.

According to US and UK officials, the organization behind the malware is Sandworm, a hacking group with close ties to Russia. The Cyclops Blink malware targets devices made by a company called Watchguard, which are typically used to protect computers and networks from hackers.

The new malware appears to be very effective, and can withstand common countermeasures like switching systems off and rebooting. With its capacity to target and neutralize firewall equipment, it could be used to clear the way for even more attacks.

Is Russia involved?

Western intelligence agencies claim that Sandworm is at least partially backed by Russian authorities, although such accusations are almost impossible to verify.

The timing could point to Russian involvement, however. As of writing, Russian military forces appear to have breached Ukraine’s borders, and many are sounding alarms over the potential for a full-scale invasion.

While the crisis is reaching new heights today, tensions between Russia and Ukraine have been mounting for months, with Russian troops massing on the border between the two countries.

Russia has often been accused of using cyberattacks to destabilize or intimidate geopolitical rivals. In 2008, for example, during a war with Georgia, Russia targeted Georgian government websites and communication tools as part of their campaign.

A pattern of aggression

The Cyclops Blink malware is just one part of a much larger cyber warfare operation against Ukraine.

In recent months, thousands of potential cyber attacks and online incursions have taken place. In early 2022, multiple official Ukrainian websites were hacked and defaced with sinister messages, warning Ukrainians to prepare for the worst.

And just this week, large-scale DDoS attacks were launched against a wide array of government websites and banking institutions.

DDoS (distributed denial of service) attacks involve hackers flooding websites and networks with waves of artificial traffic, making it impossible for genuine users to access them. It’s just one of the tools Russian hackers could be using to disrupt the Ukrainian response.

What can be done in response?

Every country, and every organization therein, has a different level of security and preparedness when it comes to cyberattacks.

A major challenge for large entities like governments and banks is dealing with the risks posed by human error. Many cyberattacks begin with hackers targeting individuals within an organization, tricking them into exposing login credentials and other sensitive data.

No matter how powerful a network’s security infrastructure is, it could still be compromised by the mistake of one individual.

That being said, Ukraine is taking all the steps it can to shore up its online defenses. In recent days, a cyber rapid-response team was set up to assist the country, consisting of digital security experts from The Netherlands, Poland, Lithuania, Estonia, Croatia, and Romania.

The bigger picture

As is always the case with such incidents, the appearance the Cyclops Blink malware cannot be directly attributed to Russian authorities. There is always the possibility that patriotic pro-Russian hackers are simply acting of their own volition.

However, the larger picture that emerges when looking at the cyber landscape in recent months paints a grim picture. In times of conflict, communication and the rapid spread of information is vital, both for the faction under attack, and for international observers.

What we’re seeing now could be cyberattacks used to supplement and assist an aggressive military campaign. This is relatively new territory, but it raises many disturbing possibilities for similar conflicts in the future.

Why is cyber warfare so dangerous?

Cyberattacks are a common part of modern life, with hackers and other online criminals continually targeting businesses and individuals. However, these same tactics can be used to devastating effect as part of a cyber warfare strategy.

Countries around the world are growing increasingly dependent on the Internet, with essential infrastructure like energy grids, water purification systems, and healthcare infrastructure all heavily integrated with online platforms. As a result, cyberattacks against these targets could be incredibly damaging.

While the situation in Ukraine is developing rapidly, the normalization of cyber warfare tactics may have long-term ramifications that will take years to manifest.