Ukraine says ‘all evidence points to Russia’ in latest cyber attack

Ukraine said it has evidence a cyber attack against government websites on Friday was likely to have been carried out by Russia, amid fears that Moscow may be planning military action against the country after security talks with the US and Nato failed.

“At the moment we can say that all evidence points to Russia being behind the attack,” Ukraine’s digital transformation ministry said in a statement on Sunday. “Moscow continues to wage hybrid war and is actively growing its information and cyber space capabilities.”

But Kyiv said the investigation was still ongoing and has yet to formally attribute the attack to Russia.

Separately, Ukraine’s National Security Council said over the weekend that it suspected a hacking group tied to Belarusian intelligence had perpetrated the attack — suggesting Russia could have used its ally to create plausible deniability of its own involvement.

Belarus’s authoritarian government, which has spearheaded a rapprochement with Moscow after mass protests in the summer of 2020, has yet to comment on the allegations.

Ukraine’s western allies have warned that cyber attacks could be a prelude to further military aggression after Moscow amassed 100,000 troops near the border in recent months.

The cyber attack, which took down about 70 government websites on Friday, came as the White House warned Russia was positioning operatives in eastern Ukraine as part of a “false-flag operation” to create a “pretext for invasion”.

The US and EU have vowed to impose “crippling” sanctions against Russia on a far greater scale than after the annexation of Crimea if it renews its aggression against Ukraine. Russia seized controlled of the Ukrainian peninsula of Crimea in 2014.

Russia has denied it is planning to invade Ukraine, but warned of an unspecified “military-technical response” if the US does not meet President Vladimir Putin’s demands to roll back Nato’s eastward expansion and pledge never to admit former Soviet countries, including Ukraine.

Western officials have refused to give ground on the demands, while attempting to reach a compromise on issues such as arms control and military deployments.

Dmitry Peskov, Putin’s spokesperson, told CNN that the failure of the talks in Geneva, Brussels and Vienna was “disturbing” as Moscow and Nato remained on “totally different tracks”.

Peskov also refused to rule out that Moscow “would not deploy any offensive weapons on Ukraine’s territory”.

Though a cyber attack would probably meet the threshold for imposing sanctions, western officials have so far stopped short of directly implicating Russia in the attack while pointing to Moscow’s long history of electronic warfare operations.

Victoria Nuland, US under-secretary of state for policy, told the Financial Times that the cyber attack was a “tried and true part of the Russian playbook” and said the west was focused on “inflicting very sharp pain very fast if Russia makes this move in any form”.

The attack, which defaced websites such as those of Ukraine’s cabinet and several ministries, was intended to look like ransomware, but also left “destructive” malware “designed to render targeted devices inoperable”, Microsoft said in a blog post on Saturday.

Microsoft did not identify the actors behind the attack or their intent, but said that the incident had likely affected more victims than currently known and warned it represented “an elevated risk to any government agency, non-profit or enterprise located or with systems in Ukraine”.