russia has been launching
cyber attacks against the
ukrainian government's private industry
even critical infrastructure that truly
have no precedent in history these are
some of the most disruptive cyber
attacks we've ever seen i'm andy
greenberg i'm a senior writer with wired
and the author of the book sandworm and
i'm going to walk you through the
history of russia's cyber attacks
against ukraine
[Music]
right now of course there is an actual
full-scale russian invasion of ukraine
taking place ukraine is now the
epicenter of russia's conflict with the
west as it has been in some ways sort of
under the radar for the last almost
decade but it also is a country whose
recent history has these lessons
about the nature of cyber war and it's a
country where we can
look to understand
what russia is capable of in its
digital disruption and how to be
prepared for it
2014 russia hacks the ukrainian central
election commission
in 2014 ukraine has a revolution and it
pulls away from russia's sphere of
influence and then later that year as
it's having its first presidential
election russian state-sponsored hackers
break into its central election
commission and essentially try to fake
the results they plant
a spoofed image that seems to show that
this far-right candidate has won by a
landslide in fact he won like
single-digit percentages of the votes
now actually the central election
commission caught this fake results in
time and managed to foil this but
russian tv nonetheless broadcast those
fake results which kind of shows how
they were working
in league with these hackers putin and
the kremlin have always wanted to paint
the new ukrainian democratic government
as controlled secretly by neo-nazis and
so trying to spoof that the results
showed that the actual winner of the
election was this super far-right
candidate was just another kind of beat
in that campaign of this information
2015
russia hacks ukraine's power grid a now
notorious group of state-sponsored
hackers called sandworm takes over
russia's cyber warfare in ukraine
and they launch a whole series of
attacks that hits ukrainian media
government agencies
and then just before christmas they cap
all this off with a cyber attack on the
ukrainian power grid
which is the first time in history that
hackers actually trigger a blackout but
just to kind of add insults to injury
sandworm also destroyed hundreds of
computers inside of these utilities they
bombarded them with fake phone calls
just to add an extra layer of chaos and
they even turned off the backup power
supply to the control rooms themselves
so that these operators were thrown into
a kind of blackout in the midst of their
own blackout this blackout really only
lasted six hours or so before ukrainians
were able to manually switch the power
back on but i think it was intended to
have a kind of
terrorizing effect and it shocked the
world and it also kind of gave sand worm
this reputation as
perhaps like the most disruptive the
most cyber war oriented hacker group in
the world
2016
sand worm attacks ukraine's power grid
again this time in kiev about a year
after sand worms first attacks in
ukraine it returns with another even
more severe collection of cyber attacks
against ukrainian government agencies
it's ministry of defense and
infrastructure and finance the hackers
destroy terabytes of data on these
agency networks they actually wipe the
country's national budget for the year
this series of cyber attacks culminates
in an attack on the power grid causing
another blackout this time in the
capital of kiev the second blackout
only lasted an hour but in some ways it
was nonetheless kind of escalation of
what sand worm had inflicted the year
before they actually disabled safety
systems in this transmission station
with the intention that when the
ukrainian operators rushed to turn the
power back on they might have caused an
overload of currents on power lines or
even exploded a transformer truly
dangerous and physically destructive
effects of a kind that we had never seen
before inside of an electrical utility
and that only failed because of a tiny
misconfiguration in sand worms malware
2017
sand worm releases the not petty malware
that morning of june 27 2017 ukrainians
across the country began to see this
ransomware message appear on computers
in all sorts of networks from private
industry and banks to government
agencies hospitals it seemed to be
encrypting computers and demanding a
ransom in the ways that cyber criminal
hackers often do but even when you paid
the ransom you couldn't recover your
files it was actually a data destroying
piece of code
designed to cause maximum chaos and then
because internet worms do not generally
like stay within national boundaries it
spread to the rest of the world not
petya immediately hit companies like
maersk the world's largest shipping firm
and fedex and
mondelez which owns cadbury and nabisco
and merc the pharmaceutical giant in the
case of maersk for instance that meant
that tens of thousands of trucks were
lining up outside of terminals and ports
around the world and ships with
thousands and thousands of containers on
them are arriving at those ports and
nobody knows what is on them for merc it
meant they had to borrow their own hpv
vaccine from the center for disease
control because their manufacturing was
shut down in each of these cases these
companies lost hundreds of millions of
dollars more than a billion in some
cases all because of this
one cyber attack that had spilled out
from ukraine
what comes next
in the years after nonpatient sandworm
hit other targets around the world
including the 2018 winter olympics in
pyeongchang korea
to the nation of georgia where they shut
down television stations in 2019 but we
haven't seen sand worm reappear in any
obvious way in ukraine now just before
the full-scale physical russian invasion
of ukraine that occurred on february
24th we did see another round of cyber
attacks that destroyed hundreds of
computers in ukrainian governments and
military agencies
although we don't have any conclusive
evidence yet that it really was sand
worm this time
now in the midst of this invasion cyber
war has been a pretty secondary element
at best people are dying by the
thousands refugees are fleeing the
country that is of course the context in
which anything i say about cyber war has
to be framed it might even make
attacks on computer systems seem kind of
trivial but i think that now that we
understand russia's
cyber warfare playbook now that we see
what sandworm is capable of we have to
kind of reckon with those capabilities
russia is now in this conflict with the
west as a whole it's been isolated and
sanctions and we'll have to grapple with
the fact that russia can unleash these
sorts of cyber attacks on western
targets if it feels like it's been put
into a corner whether that's comes in
the form of data destroying malware or
attacks on power grids or even something
like not petya again