Threats

Russians allegedly storm Ukrainian ISP, blackmail it to switch to Russian networks

Russia has hit Ukrainian satellite broadband services and Internet providers since the beginning of the war and recently began physically attacking Ukrainian Internet companies, according to the state information agency.

By Suzanne Smalley

May 16, 2022

The Kiev suburbs on May 16, after Russian forces had left the city. Russia has hit Ukraine with battlefield and cyber attacks. (Christopher Furlong/Getty Images)

Ukraine’s state communications agency said Friday that Russian forces had invaded a Kherson-based Internet company and disconnected all equipment, threatening to confiscate it if the company did not connect to Russian networks.

The incident is the latest in a string of attacks mounted against Ukrainian Internet providers and satellite broadband services.

“Free access to information is a major threat to the enemy in the occupied territories of our country,” a statement released by the State Service of Special Communications and Information Protection (SSSCIP) said. “As long as Ukrainians know about the true course of the war, Russian propaganda fails.”

Herb Lin, a senior research scholar for cyber policy and security at Stanford’s Center for International Security and Cooperation, said the attack is notable because of the fact that it involved physical force. He also said that denying Ukrainian people the ability to access accurate information about the war would bolster Russian disinformation efforts.

“This is an entirely different kind of cyberattack: This company is not being cyberattacked through the Internet. It is a cyberattack because its equipment is being commandeered by armed thugs.”
Herb Lin, Stanford’s Center for International Security and Cooperation

“This is an entirely different kind of cyberattack: This company is not being cyberattacked through the Internet,” Lin said. “It is a cyberattack because its equipment is being commandeered by armed thugs.”

Lin said this “more forceful” type of cyberattack will have a more “potent effect” by scaring people.

The Russian focus on disabling Ukrainian information equipment is due to their awareness that effective disinformation requires starving people of accurate information, Lin said.

“It’s significant because now Ukrainians can’t get better information from the West,” Lin said. “It’s not just adding .ru. It’s taking away .us. and .eu and cutting them off from accurate information.”

In its statement revealing the attack, SSSCIP said Russian forces are trying to “gain a complete control of any activity of Ukrainian users in the Internet.”

SSSCIP called the incident a “gross violation of the international law” and said it will introduce it as evidence in war crimes trials.

The news comes on the heels of announceement from the U.S., Canada, Estonia, Australia and European Union (EU) Tuesday that Russia is responsible for a cyberattack that took out Ukrainian satellite broadband services at the start of the war in February. The EU said this attack “facilitated the military aggression.”

Communication outages hit government websites and banks in Ukraine as a result of the Viasat satellite hack, and impacted several EU member states that also used the affected network.

The EU’s statement warned that similar cyberattacks on satellite broadband services could bleed into neighboring countries and put the “security of Europe’s citizens at risk.”

The Russians are focused on Ukrainian Internet providers in part because they know that networks under Russian control will block Facebook, Twitter, and Instagram in addition to external news sources, said Roman Osadchuk, a Ukraine-based researcher studying Eurasia for the Atlantic Council’s Digital Forensic Research Lab.

“These measures are aimed at the resistance of the occupied territories,” Osadchuk said via email. “The spread of disinformation on those territories by Russian sources might demoralize the opposition. For instance, during the recent shutdown of the internet in Kherson, Russians wrongly claimed that they occupied Mykolaiv and advanced further, according to a Member of the Kherson Regional Council.”

Osadchuk said Russia also created “several local Telegram channels named and focused on temporarily occupied cities. Of course, those channels provide a pro-Russian point of view and criticize Ukraine.”