close
close
Your Network of Tomorrow
Your Network of Tomorrow
Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.
          Experience Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            A Leader in SSE. Now a Leader in Single-Vendor SASE.
            A Leader in SSE. Now a Leader in Single-Vendor SASE.
            Netskope debuts as a Leader in the Gartner® Magic Quadrant™ for Single-Vendor SASE
              Securing Generative AI for Dummies
              Securing Generative AI for Dummies
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Modern Data Loss Prevention (DLP) for Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Modern SD-WAN for SASE Dummies Book
                  Modern SD-WAN for SASE Dummies
                  Stop playing catch up with your networking architecture
                    Understanding where the risk lies
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        The 6 Most Compelling Use Cases for Complete Legacy VPN Replacement
                        The 6 Most Compelling Use Cases for Complete Legacy VPN Replacement
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive Safeguards its "Intellectual Property” with Smart and Adaptable Data Protection
                          Colgate-Palmolive Safeguards its "Intellectual Property” with Smart and Adaptable Data Protection
                            Netskope GovCloud
                            Netskope achieves FedRAMP High Authorization
                            Choose Netskope GovCloud to accelerate your agency’s transformation.
                              Let's Do Great Things Together
                              Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Netskope Technical Support
                                  Netskope Technical Support
                                  Our qualified support engineers are located worldwide and have diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ensuring timely and quality technical assistance
                                    Netskope video
                                    Netskope Training
                                    Netskope training will help you become a cloud security expert. We are here to help you secure your digital transformation journey and make the most of your cloud, web, and private applications.

                                      Lessons Learned From a Year of Russo-Ukrainian Cyberwar

                                      Feb 24 2023

                                      February 24, 2023 marks one year since Russia invaded Ukraine, starting a conflict that has killed more than 8,000, injured more than 13,300, and displaced more than 14 million people in the past year, according to the UN. Physical warfare between Ukraine and Russia has been accompanied by cyberwarfare between the two countries. This blog post focuses on cyberwar, particularly what we can learn from the past year.

                                      Observations

                                      Attacks primarily target government agencies and critical infrastructure

                                      The majority of Russian attacks over the past year targeted military and government agencies and critical infrastructure, especially telecommunications providers and energy companies. Other attacks were more broadly targeted at companies and individuals in Ukraine and their allies throughout the world. Meanwhile, the majority of Ukrainian attacks were targeted at Russian government institutions, with attacks focused on taking down Russian websites, disrupting financial services, and disrupting misinformation campaigns.

                                      Phishing is the primary infiltration technique used for the majority of attacks

                                      The most common infiltration technique used in the cyberwar has been phishing, with both sides using targeted spear phishing campaigns, often accompanied by file-based exploits or other malicious payloads. Phishing is popular in cyberwar because it is simple, low-risk, effective, and versatile. A well-crafted and targeted phishing message delivered via messaging app, SMS, email, social media, or another channel can be used against practically any type of target. After a successful phish, attacks typically focus on espionage or sabotage. 

                                      Espionage and sabotage are the primary objectives

                                      In cyberwar, espionage and sabotage are the primary objectives. In the past year, espionage has typically taken the form of RATs and infostealers, while sabotage has typically taken the form of DDoS attacks, ransomware, and wipers. Throughout the year, many Russian wipers emerged to target Ukraine, including WhisperGate, HermeticWiper, IsaacWiper, and others. One recent ransomware attack used a new ransomware family, Prestige, to target logistics and transportation sectors in Ukraine and Poland.

                                      15% of attacks target other nations, primarily allies

                                      While approximately 85% of attacks have been targeted at individuals or organizations within Russia or Ukraine, the remaining 15% have been targeted primarily at allies throughout the world. Like the attacks within Russia and Ukraine, attacks on targets in other nations have also targeted critical infrastructure and government agencies.

                                      The most significant breakout attack of the Russo-Ukrainian war happened in 2017 with NotPetya, a Russian wiper targeted at Ukraine that ended up infecting systems throughout the world, including companies Maersk and Merck, and causing an estimated $10 billion in damages. In the year since the Russian invasion of Ukraine, we have yet to see a breakout attack of that scale. So far, attacks outside of Russia and Ukraine have been seemingly well-targeted. Some attacks, notably the early attack against Viasat, were less precisely targeted. While intended to interrupt network connectivity in Ukraine, the Viasat attack caused outages across Europe.

                                      Lessons

                                      • Anti-phishing controls and training are essential defenses during a cyberwar. Interrupting phishing attempts can help stop a cyberattack before it can cause any damage.
                                      • Government agencies and critical infrastructure are at the greatest risk during a cyberwar, warranting extra investment in cybersecurity defenses and the establishment of stricter cybersecurity controls to reduce risk surface.
                                      • Ransomware defenses, especially robust and well-tested backups, can also be effective defenses against some destructive wipers typically used during cyberwar.
                                      • The closer an individual or organization is to the conflict, either physically or through alliance, the more likely they are to be targeted. While most attacks are targeted at government agencies and critical infrastructure within the countries at war, anyone within those countries are common targets, as are individuals and organizations that are allied with either side.  

                                      Looking ahead

                                      As the physical conflict in Ukraine continues, so too will the cyberwar. The intensity of Russia’s physical attacks against Ukraine are expected to increase in the next year, and the cyberattacks will increase alongside them. The longer the conflict drags on, the more likely we are to see allies throughout the world targeted, and the more likely we are to see additional breakout attacks.

                                      author image
                                      Ray Canzanese
                                      Ray is the Director of Netskope Threat Labs, which specializes in cloud-focused threat research. His background is in software anti-tamper, malware detection and classification, cloud security, sequential detection, and machine learning.
                                      Ray is the Director of Netskope Threat Labs, which specializes in cloud-focused threat research. His background is in software anti-tamper, malware detection and classification, cloud security, sequential detection, and machine learning.

                                      Stay informed!

                                      Subscribe for the latest from the Netskope Blog