“It ain’t what you don’t know that gets you into trouble. It’s what you know for sure that just ain’t so.”
—Attributed to Mark Twain
Twain's quote provides two key lessons: first, why double negatives in a sentence are a terrible idea, and second, how assumptions can lead one into trouble. Assumptions affect all levels of decision-making; however, when national leaders make assumptions, trouble can rapidly escalate to chaos and turmoil.
Russian President Vladimir Putin and his military suffered from chaos and turmoil throughout the first year of the war in Ukraine. These failures were driven by numerous factors, ranging from micromanagement of military decisions by Putin himself to limited resupply capabilities inside Ukrainian territory.[1] Before the conflict, one significant assumption existed in Russia’s favor: that its cyber and electronic warfare capabilities could exert enough influence to shape the war in their favor. Russian cyber warfare capabilities have been in the limelight since their Military Intelligence Directorate and Federal Security Service hackers infiltrated the Democratic National Convention servers during the 2016 U.S. Presidential elections.[2]
Russian President Vladimir Putin (Mikhail Metzel/AP)
These accomplishments led to Russian leadership assumptions regarding cyber and electronic warfare capabilities against Ukraine. These assumptions led to complacency, and that complacency killed Russian momentum in Ukraine. As a result, initial attempts at cyber warfare have produced minimal gains, and electronic warfare units have failed to downgrade Ukrainian capabilities effectively.[3] While Putin has succeeded on certain fronts, such as degrading the Ukrainian economy, his assumptions concerning cyber and electronic warfare's effectiveness have assisted in driving his Ukrainian offensive toward failure. [4]
First, by analyzing Russia’s past success in cyber and electronic warfare, this essay examines how Putin developed his assumption that Russian cyber operations would overwhelm Ukrainian cyber security measures. Second, it explores how these assumptions contributed to complacency and failure in the war in Ukraine. Finally, the essay discusses how Russia’s failures in Ukraine will shape the future of cyber and electronic warfare.
Russia: A Modern History of Hacking
Before the war in Ukraine, Russia's cyber network attack and exploitation capabilities were considered reputable following two successful ransomware and critical infrastructure attacks.[5] First, the successive industrial control system attacks on the Ukrainian electrical grid in 2016-17 reinforced the assumption that Russia would successfully integrate cyber warfare into its 2022 invasion of Ukraine. [6] Second, the 2017 NotPetya attack further illustrated the Russian intelligence community's advanced cyber and electronic warfare capabilities.[7]
In the winter of 2016-17, Russian cyber and electronic capabilities struck at the infrastructural stability of Ukraine. Russian-backed hacking organizations infiltrated Ukrainian industrial control systems that oversaw the electrical grid in Kyiv's neighboring cities.[8] The hackers used a specialized approach as they moved along the industrial control system cyber kill chain.[9] Unlike Russia’s future NotPetya attack, which self-replicated and spread throughout systems indefinitely, the 2016-17 Ukrainian electrical grid attacks illustrated the more meticulous hands-on approach Russian hackers could employ.
This attack demonstrated the vast array of damage cyber network attacks could entail. The Russians used a three-pronged approach to target the Ukrainian electrical industrial control system.[10] Initially, they manipulated the connections between the digital and physical breaker systems.[11] This manipulation allowed Russian malware to destroy the backup breakers when Ukrainian engineers attempted to reroute power.[12] Next, the Russians overwhelmed the Ukrainian help desks with robotic calls.[13] This type of attack is known as a denial of service, intended to reduce the Ukrainian population's confidence in their government's response abilities.[14] Finally, Russian cyber efforts promoted misinformation online, claiming the electrical industrial control system failures stemmed from aging infrastructure rather than a foreign-born cyber network attack.[15]
Later in 2017, the global financial system suffered from the most significant cyber network attack in history. Likely backed by the Russian Military Intelligence Directorate and Federal Security Service operatives, the attack originated from a malware system known as NotPetya.[16]
Screenshot of the splash screen of the payload of the original version of Petya (Wikimedia)
Through the covert international hacking organization known as the Shadow Brokers, Russian hackers acquired access to the leaked National Security Agency's EternalBlue penetration program, which at the time represented cutting-edge hacking capabilities.[17] EternalBlue found and implemented zero-day exploits, which are opportunities "when security teams are unaware of their software vulnerability, and they’ve had 0 (zero) days to work on a security patch or an update to fix the issue.”[18] These exploits expedite the cyber kill chain process, which originates with basic reconnaissance and typically finalizes with an attack or espionage.[19]
Traditionally, the reconnaissance and infiltration portion of the cyber kill chain can take months to complete. However, EternalBlue offered Russian hackers zero-day exploits in the form of backdoor entry into systems.[20] Backdoors are coding loopholes that create an "undocumented way of gaining access to computer system(s).”[21] EternalBlue identified these backdoors for Russian hackers, allowing them to rapidly move down the cyber kill chain directly to installation and action initiation.[22]
Lockheed Martin’s Cyber Kill Chain [23]
The endgame of the Russian hackers in the NotPetya attack was to cripple the internal tax and auditing system of Ukrainian banking. Instead, NotPetya began replicating uncontrollably and spreading to any system tangentially connected to the Ukrainian financial system.[24] The less concerning outcome of NotPetya was the cost to the global economy of over $10 billion.[25] The more significant concern was Russia's access to and use of EternalBlue, which allowed the Russians to continue implementing Zero Day exploits.
Both NotPetya and the 2016-17 industrial control system attacks illustrate the hacking capabilities of the Russian intelligence community. With a definitive history of manufacturing and spreading misinformation, crippling the global economy, and conducting spoiling attacks on your enemy, why would Russia not assume they would roll over Ukraine in the cyber realm?
Complacency Kills
Russia has struggled to gain momentum throughout its invasion of Ukraine, including in the cyber domain. Like the wide physical front opened at the beginning of the war, the Russian intelligence community has attempted a broad cyber network attack and espionage campaign to cripple Ukrainian resistance.[26]
The Russian Military Intelligence Directorate and Federal Security Service units hacked into multiple Ukrainian nuclear power sites, claiming the Ukrainians were using said sites to manufacture chemical weapons and other illegal capabilities. [27] Multiple hacking organizations with close ties to the Russian intelligence community have penetrated the Ukrainian federal government and military readiness sites and installed Wiper malware.[28] This malware format permanently destroys critical data storage capabilities and has been further used on industrial control system sites throughout Ukraine during the invasion.[29]
The Russians have also targeted Ukrainian defense satellites and telecommunications firms, while also manufacturing bot farms to feed disinformation into Ukrainian public discourse. [30] However, due to two key points, most cyber network attacks have failed to meet their objectives.
First, foreign influence and assistance have improved the cyber defensive capabilities of Ukraine since the 2016-17 industrial control systems infiltration. Since the publication of the Cyber Security Strategy of Ukraine in March 2016, Ukrainian officials have been sponsoring Western foreign assistance in developing and maintaining defensive cyber capabilities.[31]
Private firms such as Microsoft and Wordfence have aided Ukraine since the beginning of the Russian invasion, providing protective measures unavailable during the 2016-17 industrial control system incidents.[32] Because Russia used the same cyber network attack methods from 2016-17, international private organizations had the opportunity to correct zero-day exploits and patch other software shortcomings.
Concurrently, the U.S. military aided the Ukrainian cyber defense buildup before the latest invasion began. A task force of U.S. Cyber Command soldiers and leadership arrived in Ukraine months before the invasion.[33] These efforts shored up flaws throughout the Ukrainian military’s cyber networks, limiting the infiltration ability of Russian intelligence groups.[34]
Ukraine’s increased defensive capabilities correspond with Russia's inability to coordinate cyber network attacks and espionage with actual kinetic attacks. As a result, the Russian military could not logistically support Putin's plan of taking Kyiv in under a month.
A lack of logistical planning was evident, with ineffective cyber network attacks and electronic warfare brigades unable to support forward combat arms units. Furthermore, electronic warfare units were unprepared to face the U.S.-provided single channel ground and airborne radio system (SINCGARS) radios and drone systems operating outside Russian jamming capabilities.[35]
Moreover, logistical failures led to unplanned and hasty retrogrades by the Russian military, with units leaving behind equipment they deemed inessential. This unaccounted equipment included the Krasuhka-4 and Leer-3 electronic warfare networks, which are Russia's premier unmanned aerial vehicle and wireless network jamming systems. Both systems have fallen into Ukrainian hands, which will minimize their long-term effectiveness in this war.
Krasukha-4 Ground-based Jammer (Vitaly V. Kuzmin)
The only notable example of cyber success for the Russians has been the jamming and destruction of a television tower in eastern Ukraine.[36] Without adequate forward progress on the physical front, cyber network attack operations have played a much less critical role than expected for the Russians.
Lessons Learned and Future Implications
With a contemporary history of cyber network attacks and espionage successes, the odds were in Russia’s favor for cyber and electronic warfare to steamroll Ukrainian defenses. Unfortunately, determining the precise cause of failure is complex, and it is impossible to evaluate nebulous concepts like complacency.
Russia's failure comprises many factors, ranging from micromanagement to logistical miscalculations. However, one clear, practical lesson the international community can take away from the war in Ukraine is the effectiveness of cyber and electronic warfare in a conventional fight.
First, while Russian cyber offensives may have failed in the first year of a haphazard campaign, the entire experience has been emblematic of what to expect in future conflicts. The main lesson is the potential scope of destruction by a robust cyber operation working in tandem with traditional kinetic means.
Second, Ukraine should expect Russian cyber operations to continue now that the war has become a grinding, drawn-out conflict rather than a dash for Kyiv. In addition, the U.S. and other nations must focus on the continued integration of cyber capabilities into conventional warfare, especially concerning advanced threats such as China.[37]
Finally, integrating corporations such as Microsoft into a public-private partnership with the Department of Defense will better equip both parties to enhance their security against future cyber offensives. Moreover, providing Cyber Command servicemembers and expertise to Ukraine before the conflict that began in 2022 proved effective in patching aged security measures and limiting any costly zero-day loopholes.
Overall, it is difficult to determine if Russian cyber capabilities were overhyped or underperformed in a new and unique environment. Nonetheless, what any nation can take away from Russia's struggles is to not remain complacent because "it's what you know for sure that just ain't so" that will get you in trouble.
Jonathan Beto is currently a Security Studies graduate student at Georgetown University’s Walsh School of Foreign Service. The views expressed are the author’s alone.
The Strategy Bridge is read, respected, and referenced across the worldwide national security community—in conversation, education, and professional and academic discourse.
Thank you for being a part of The Strategy Bridge community. Together, we can #BuildTheBridge.
Header Image: Untitled, 2021 (Anton Maksimov).
Notes:
[1] “Five Reasons Why Russian Forces Are Struggling in Ukraine,” n.d. Defense One, https://www.defenseone.com/threats/2022/03/five-reasons-why-russia-struggling-ukraine/362636/.
[2] Buchanan, Ben, 2020, The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics, Cambridge, Massachusetts: Harvard University Press, 214–239.
[3] Lewis, James, 2022, “Cyber War and Ukraine,” Www.csis.org, June 16, 2022, https://www.csis.org/analysis/cyber-war-and-ukraine.
[4] The World Bank, 2022, “Russian Invasion to Shrink Ukraine Economy by 45 Percent This Year,” World Bank, April 10, 2022, https://www.worldbank.org/en/news/press-release/2022/04/10/russian-invasion-to-shrink-ukraine-economy-by-45-percent-this-year.
[5] Buchanan, Ben, 2020, The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics, Cambridge, Massachusetts: Harvard University Press, 289–305.
[6] “Analysis of the Cyber Attack on the Ukrainian Power Grid Defense Use Case,” 2016, https://media.kasperskycontenthub.com/wp-content/uploads/sites/58/2016/12/21181126/E-ISAC_SANS_Ukraine_DUC_5.pdf.
[7] Greenberg, Andy, 2018, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” WIRED, August 22, 2018, https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/.
[8] “NERC | Report Title | Report Date I Modular ICS Malware,” 2017, https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt4f6cc0b6358c6883/607f235a6371c75a11ad9f5a/E-ISAC_SANS_Ukraine_DUC_6.pdf; “Analysis of the Cyber Attack on the Ukrainian Power Grid Defense Use Case,” 2016, https://media.kasperskycontenthub.com/wp-content/uploads/sites/58/2016/12/21181126/E-ISAC_SANS_Ukraine_DUC_5.pdf.
[9] “The Industrial Control System Cyber Kill Chain | sans Institute,” n.d. Www.sans.org. https://www.sans.org/white-papers/36297/.
[10] “NERC | Report Title | Report Date I Modular ICS Malware,” 2017, https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt4f6cc0b6358c6883/607f235a6371c75a11ad9f5a/E-ISAC_SANS_Ukraine_DUC_6.pdf.
[11] Ibid.
[12] Ibid.
[13] Ibid.
[14] Ibid.
[15] Ibid.
[16] Greenburg, Andy, 2018, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” WIRED, August 22, 2018, https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/.
[17]
[18] Ibid.
[19] Ibid.
[20] Buchanan, Ben, 2020, The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics, Cambridge, Massachusetts: Harvard University Press, 270–287.
[21] Nieles, Michael, Kelley Dempsey, and Victoria Yan Pillitteri, 2017, “An Introduction to Information Security,” An Introduction to Information Security, June, https://doi.org/10.6028/nist.sp.800-12r1.
[22] Hutchins, Eric, Michael Cloppert, and Rohan Amin, 2011, “Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains., https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf.
[23] Ibid.
[24] Greenberg, Andy, 2018, “The Untold Story of NotPetya, the Most Devastating Cyberattack in History,” WIRED, August 22, 2018, https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/.
[25] Ibid.
[26] “An Overview of Russia’s Cyberattack Activity in Ukraine Special Report: Ukraine Digital Security Unit,” 2022, https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4Vwwd.
[27] Heilman, Greg, 2022, “Why Is Russia Interested in Controlling Nuclear Power Plants in Ukraine?” Diario AS, March 7, 2022, https://en.as.com/en/2022/03/07/latest_news/1646686014_463478.html; News, A. B. C. n.d. "Russia Escalates False Chemical Weapons Claims about U.S., Ukraine by Bringing Them to U.N.," ABC News, https://abcnews.go.com/Politics/russia-escalates-false-chemical-weapons-claims-us-ukraine/story?id=83366504.
[28] Team, Microsoft 365 Defender Threat Intelligence, 2022, “Destructive Malware Targeting Ukrainian Organizations,” Microsoft Security Blog, January 16, 2022, https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/.
[29] “Digital Technology and the War in Ukraine,” 2022, Microsoft on the Issues, February 28, 2022, https://blogs.microsoft.com/on-the-issues/2022/02/28/ukraine-russia-digital-war-cyberattacks/; “Industroyer2: Industroyer Reloaded,” 2022. WeLiveSecurity, April 12, 2022, https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/.
[30] Nakashima, Ellen, 2022, "Russian Military behind Hack of Satellite Communication Devices in Ukraine at War's Outset, U.S. Officials Say," Washington Post, March 24, 2022, https://www.washingtonpost.com/national-security/2022/03/24/russian-military-behind-hack-satellite-communication-devices-ukraine-wars-outset-us-officials-say/; Brewster, Thomas. n.d. “‘Most Severe’ Cyberattack since Russian Invasion Crashes Ukraine Internet Provider,” Forbes, Accessed March 18, 2023, https://www.forbes.com/sites/thomasbrewster/2022/03/28/huge-cyberattack-on-ukrtelecom-biggest-since-russian-invasion-crashes-ukraine-telecom/?sh=381c15037dc2; “Ukraine Destroys Five Bot Farms That Were Spreading ‘Panic’ among Citizens,” n.d. ZDNET, Accessed March 18, 2023, https://www.zdnet.com/article/ukraine-takes-out-five-bot-farms-spreading-panic-among-citizens/.
[31] "CYBER SECURITY STRATEGY of UKRAINE 1 General Provisions," n.d. https://ccdcoe.org/uploads/2018/10/NationalCyberSecurityStrategy_Ukraine.pdf.
[32] “Ukraine Universities Hacked as Russian Invasion Started,” 2022, Wordfence. March 1, 2022, https://www.wordfence.com/blog/2022/03/ukraine-universities-hacked-by-brazilian-via-finland-as-russian-invasion-started/.
[33] Srivastava, Mehul, Madhumita Murgia, and Hannah Murphy, 2022, “The Secret US Mission to Bolster Ukraine’s Cyber Defences ahead of Russia’s Invasion,” Financial Times, March 9, 2022, https://www.ft.com/content/1fb2f592-4806-42fd-a6d5-735578651471.
[34] “CYBERCOM Sent a ‘Hunt Forward’ Team to Help Ukraine Harden Systems,” n.d. Www.meritalk.com, Accessed March 18, 2023, https://www.meritalk.com/articles/cybercom-sent-a-hunt-forward-team-to-help-ukraine-harden-systems/.
[35] “The Fall and Rise of Russian Electronic Warfare,” 2022, IEEE Spectrum, July 30, 2022, https://spectrum.ieee.org/the-fall-and-rise-of-russian-electronic-warfare.
[36] “Berdyansk: Life under Russian Occupation,” n.d. Iwpr.net, Accessed March 18, 2023, https://iwpr.net/global-voices/berdyansk-life-under-russian-occupation.
[37] Cancian, Mark, Matthew Cancian, and Eric Heginbotham, 2023, “The First Battle of the next War Wargaming a Chinese Invasion of Taiwan,” https://csis-website-prod.s3.amazonaws.com/s3fs-public/publication/230109_Cancian_FirstBattle_NextWar.pdf?VersionId=WdEUwJYWIySMPIr3ivhFolxC_gZQuSOQ.