Ukraine Attacked by Cyberspies During Kiev Protests

The United Kingdom-based defense contractor BAE Systems found that Ukraine was attacked by numerous cyberspies since January 2013 and that it has been worse in recent months due to the protests in Kiev. The attacks originated from the Moscow timezone, and a German software company said the software used in the attacks had Russian roots.

The spies used “snake” malware that allowed them to gain control of the computer systems of large organisations and steal information, according to the report from BAE’s Applied Intelligence unit. Snake’s design “suggests that attackers possess an arsenal of infiltration tools and bears all the hallmarks of a highly sophisticated cyber operation,” BAE said.

While the report released last week doesn’t name Russia as the source of the attacks, it suggests they originated in the time zone where Moscow is located.

G Data Software, based in Bochum, Germany, went a step further, saying that a variant of the snake software known as Uroburos has “Russian roots”. There are “strong indications” that the group behind Uroburos, the Greek word for an ancient symbol that shows a serpent eating its own tale, is the same one that attacked US military bases in 2008 with malware known as Agent.BTZ, G Data said.

The relationship between Ukraine, a former Soviet republic, and Russia have been tense since the fall of the Soviet Union, but tensions skyrocketed after Ukraine’s Russia-backed president Viktor Yanukovych rejected a trade deal with European Union for a $15 billion bailout from Russia in November. People took to the streets in Independence Square and did not stop until the new parliament deposed Yanukovych on February 22.

However, Crimea, an autonomous republic of Ukraine, which identifies more with Russia, kicked out its Kiev-appointed government and appointed pro-Russian officials. Russia has effectively taken control of Crimea, which strained its relationship with Ukraine even more. Crimea has a referendum on March 16 to decide if it wants to stay with Ukraine or join Russia. Ukrainian Prime Minister Arseniy Yatseuniuk said this referendum is illegal and Ukraine will not give up any land to Russia.

BAE found 56 cyber attacks since 2010. Ukraine was the target 32 times, Lithuania eleven, UK four, and the US, Georgia, and Belgium two. Lithuania and Georgia are also former Soviet republics; Russian President Vladimir Putin invaded Georgia in 2008.

Interfax-Ukraine reported that Ukrainian television channels are disrupted in Crimea while Russian stations work perfectly fine. Radio Free Europe reported at least five journalists and activists were apprehended in Crimea. There are many unconfirmed reports of journalists being held at checkpoints that Russia set up at the Ukraine/Crimea border.