Attack on Ukraine Telecoms Provider Caused by Compromised Employee Credentials

Russian hackers used compromised personnel credentials to launch the cyber-attack that severely disrupted internet solutions in Ukraine past 7 days, it has been claimed right now.

Kyrylo Honcharuk, CIO of Ukrtelecom, Ukraine’s nationwide telecommunications supplier targeted in the attack on March 28, said Russia accessed the account of an staff in a region “recently temporarily” occupied, despite the fact that the precise locale was not disclosed.

Once they acquired entry, the hackers then tried out to disable Ukrtelecom’s machines and servers to gain handle about its network and equipment. There was also an attempt to adjust the passwords of employees’ accounts and of logins to entry devices and firewalls.

The Condition Services of Particular Conversation and Facts Defense of Ukraine (SSSCIP), the nation’s technological security and intelligence provider, said the attack was detected within just 15 minutes, and “Ukrtelecom’s IT specialists promptly took measures to counteract” it.

The provider extra that the Russian hackers tried to compromise the qualifications of other Ukrtelecom workforce in the location. In addition, an try to analyze the telecom firm’s infrastructure was prevented by its SOC crew, according to SSSCIP.

SSSCIP also disclosed that Cisco, Microsoft and ISSP have been associated in remediating the incident.

Head of SSSCIP, Viktor Zhora, said: “The promptness of eliminating this threat testifies to the higher degree of the network’s dependability and to the professionalism of Ukrtelecom’s group.”

The incident led to significant internet outages across Ukraine, with network visitors dropping to 13% of pre-war amounts at one stage, in accordance to world wide internet check Netblocks. Ukrtelecom limited coverage to make certain there was no interruption to providers for the armed forces and critical infrastructure. Nonetheless, services had been little by little restored, with complete companies returning within just 15 hours of the initial attack.

The attack could indicate an maximize in the targeting of Ukraine’s critical infrastructure as the country’s conflict with Russia approaches 6 months. SSSCIP claimed that 65 cyber-attacks targeted Ukrainian critical infrastructure between March 23 and 29, five instances far more than in the preceding week.

“Ukrtelecom as aspect of Ukraine’s important information and facts infrastructure is in the target of hackers’ focus all the time. We’ve been observing the increase in the variety of cyber-attacks from our infrastructure considering that the extremely starting of the invasion. The attack on March 28 was effective and subtle,” commented Honcharuk.

Some pieces of this report are sourced from:
www.infosecurity-magazine.com