CERT-UA: Research and Technical Analysis of Large-Scale Cyber Attacks in Ukraine in 2021

### Overview Presented at FIRSTcon in Dublin, representatives from Ukraine’s State Service of Special Communication and Information Protection (SSSCIP) and CERT-UA shared operational insights into large-scale cyber warfare targeting Ukraine in 2022. While originally scheduled to cover 2021, the speakers pivoted to cover real-time technical analysis of cyberattacks unfolding during the Russian invasion, detailing wiper campaigns, defacements, DDoS attacks, supply-chain compromises, and phishing operations.

### Key Topics - **Incident Volume and Targeted Sectors:** CERT-UA registered 1,306 incidents by the time of the presentation, with roughly half classified as critical or high severity. The government sector was the primary target, followed by military organizations, financial institutions, commercial entities, energy, telecoms, and IT. - **January 14 Supply-Chain Attacks:** A major coordinated attack defaced and wiped dozens of government web servers via a compromised IT service provider that developed sites for multiple state agencies. - **Pre-Invasion Destructive Operations:** In the hours preceding the February 24 physical invasion, massive coordinated wiper deployments and DDoS attacks struck Ukrainian banks, government infrastructure, and media outlets. - **Threat Actor Activities:** Analysis of prominent threat groups targeting Ukraine, including Sandworm (destructive wipers), Gamaredon/Armageddon (phishing and espionage), APT29, and hacktivist-style groups like the "Cyber Army of Russia Reborn" (UAC-0107).

### Technical Details - **January 14 Attack Mechanics:** Although initial hypotheses pointed to an October CMS vulnerability, log analysis revealed threat actors manually accessed servers via SSH, established persistence with new user accounts, and removed `index.php` by hand. Concurrently, endpoints suffered destructive wiping via `stage1.exe` (identified by Microsoft as WhisperGate / BootPatch), executed through Impacket from compromised web servers. In several environments, actors logged directly into hypervisors and destroyed virtual machine configurations. - **Sandworm Wiper Playbook:** In nearly 99% of wiper incidents analyzed across roughly 15 organizations, Sandworm bypassed phishing entirely in favor of exploiting public-facing web applications, Microsoft Exchange servers, and VPNs (including instances where two-factor authentication had been disabled). For post-exploitation, attackers created SSH tunnels and proxy networks using Stowaway, alongside Impacket for lateral movement and command execution. - **Specialized Malware & ICS Targeting:** In an attack on a Ukrainian power plant, responders recovered CaddyWiper variants and Industroyer2, accompanied by custom wipers specifically engineered for Solaris, Linux, and industrial control systems. - **Phishing Tactics & Tooling:** Gamaredon frequently registered `.site` top-level domains (e.g., matching keywords like `military-ukraine` or `gov-ua`) and abused legitimate infrastructure such as Wix and Zimbra vulnerabilities (which allowed attackers to harvest hundreds of emails or inject malicious JavaScript to forward victim messages). In some campaigns, threat actors impersonated CERT-UA or abused CERT-UA's IP addresses by routing C2 traffic to cert.gov.ua to trigger global ISP blacklisting.

### Takeaways - **Cyber as a Domain of War:** Modern hybrid warfare tightly integrates pre-conflict and wartime cyber strikes with kinetic operations, targeting government continuity, civilian morale, and critical infrastructure. - **Process & Operational Resilience:** Under wartime conditions, CERT-UA and SSSCIP re-engineered operations, relocated personnel to ensure safety, and shifted to secure remote workflows. - **Global Collaboration:** Effective response and attribution rely heavily on real-time data sharing and technical support from international CERTs, cybersecurity vendors, independent researchers, and commercial IT partners.