In today's exploration of cyber security tech news.
We've all seen the pictures coming out of Ukraine, of normal ordinary people taking
up arms, making molotov cocktails to defend themselves from the advancing Russian forces.
But what you probably haven't heard of is the "IT Army Of Ukraine" - set up just a few
days ago by the Ukrainian government, it's made up entirely of volunteers - volunteers
which aren't just Ukrainians, but people all over the world - with one mission - to disrupt
the computer systems of Russian organisations and the Russian government itself.
In this video I want to explore how Ukraine's IT army came into existence, and the other
hacktivist organisations working alongside them.
So how did this "IT Army" come to be?
Well, in a recent video I reported on the Ukrainian government openly calling on the
"hacker underground to defend against Russia" - pleading with cyber criminals to put use
their skills to good use and volunteer for the Ukrainian military's cyber unit.
Judging from the google forms application page, they were looking for people with skills
such as "social engineering", "malware analysis" and "threat intelligence.
Well - I can only imagine they were overwhelmed with responses, because the day after this
form went live - on day 3 of the invasion, a Ukrainian government official tweeted "We
are creating an IT army.
We need digital talents" , "We continue to fight on the cyber front".
He links a telegram channel, and this has essentially become a hub for the Ukrainian
government to dish out operations to the over 270 thousand people that have joined.
And, before we go any further I need to make it crystal clear as per youtube's community
guidelines I'm not encouraging you to join in on the operations and involve yourself
- I'm merely documenting what's going on here.
So let's proceed.
Their very first post says, "Task 1, We encourage you to use any vectors of cyber and DDoS attacks
on these resources.", then they list a bunch of targets, Russian "business corporations",
"banks", and "state" organisations.
Notice they're translating a lot of their posts into English, for "IT specialists from
other countries" - this raises some interesting questions as they're obviously encouraging
people from outside Ukraine to get involved.
Now, non-Ukrainians taking part - of which there will be many - are effectively breaking
hacking laws in their home countries.
And what happens if a damaging hack is traced back to someone in a Western country?
Will Russia see that as an act of aggression carried out by that country?
Who knows?
We're in uncharted territory here.
I've been in this Telegram channel for a few days now, and every few hours a new list of
targets is published.
Here they're listing a bunch of Belarusian websites - a few hours later, results.
Many of the websites were knocked completely offline.
But at the end of the day DDoSing isn't hacking, and taking random websites offline just isn't
going to end the war.
So what's the real goal here?
Well, it seems to be as simple as, cause as much chaos and inconvenience as possible.
Just like many Russian sports teams have been banned from competing in tournaments, and
many companies like Apple have promised not to do business with Russia - screwing with
Russian websites is yet another thorn in Russia's backside.
This cyber guerrilla warfare isn't going to change anything on its own, but perhaps all
the inconvenience cumulatively adds up and gets the attention, maybe not of Putin himself,
but rather ordinary Russians.
But it isn't all just DDoSing.
A bug bounty website, "hacken proof" has launched an interesting bug bounty program, on behalf
of Russian companies and government organisations.
They're encouraging people to find critical vulnerabilities in Russian "hosting providers",
"Telecoms", "Aerospace", "infrastructure", and so on.
Their list of steps to get involved is simple, "select a Russian propaganda or infrastructure
website", "find critical vulnerabilities", "submit a report".
And then hackenproof will use their contacts to get the vulnerability into the "good hands
of Ukrainian cyber forces" - who can then use those vulnerabilities in their own anti
Russian operations.
So far over 300 reports have been made.
Now, bug bounty programs often have monetary incentives, but this is purely voluntary.
Other than this bug bounty program and the "IT army of Ukraine", several hacktivist groups
have joined the fight.
I've covered several attacks from Anonymous here on this channel - and there's always
some confusion in the comments whenever the topic of Anonymous comes up, so I just want
to make it crystal clear.
Anonymous is not a group in of itself.
Anonymous is just a label hacktivists use when they don't want to create a group identity
of their own.
Think of it as an open source brand that anyone can use, and so, 2 Anonymous hacks could have
been carried out by completely different people who might not even speak the same language.
However there are some hacktivist groups with their own unique identities which have joined
the cyber front.
Here's a list of all of them that we know of - I'll of course link the source of this
list in the description.
You'll notice most are on the Ukrainian side, but some are pro Russian.
In fact, I recently interviewed two groups on this list, the pro Russian group "The Red
Bandits" and the pro Ukrainian group "Against The West".
Now, I'll have a full video on those interviews coming soon, make sure to subscribe so you
don't miss that, but I want to give you a quick bio of the pro Ukrainians, and more
importantly the people behind it.
"Against the west" or "ATW" is a pro Ukrainian, and pro Nato group - I realise the name is
kinda confusing, they aren't "against the west" in the literal sense, but after pwning
an organisation, they say you were targeted because you're against the west - that's the
idea.
The group of 6 was founded after they lost their jobs due to covid.
Now, they were careful with what they told me, but several of their members have experience
in working for western intelligence agencies, however they insist that they are not actively
state sponsored.
In the past they've focused on targeting China, however since the war in Ukraine kicked off,
that's where they've been focusing their efforts, targeting large Russian companies and leaking
numerous data dumps to their Telegram channel.
In the past day or so they were suspended from twitter, and have since re-branded under
"BlueHornet".
This whole cyber situation is incredibly strange, government backed cyber operations have always
been top secret, but now we have telegram channels run by governments listing enemy
targets and saying, give them hell.
We really are breaking new ground here.
If you find these updates on the Ukrainian situation useful and insightful do make sure
to drop me a sub as I'm putting these updates out every 2 days now.
This video was made possible by PlexTrac, the cybersecurity reporting and workflow management
platform that empowers continuous assessment and effective collaboration between teams
to ensure you win the right security battles.
Create assessment reports in half the time and collaborate throughout the remediation
lifecycle.
Centralize your remediation efforts across all scans, assessments, and audits with powerful
risk visualizations, scanner and ticketing integrations, and enhanced analytics.
Communicate risks clearly across your team and in real-time, working more efficiently
and effectively with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
Thanks for watching, and you know the drill, tickle that notification bell and follow me
on the instagrams for behind the scenes updates.
And I'll see you in the next video, have a good one.