Ukraine has seen other volunteer-organized cyberdefense and attack efforts leading up to and early in the war effort. Separately hacktivists, including the hacking group Anonymous, have claimed DDoS attacks against Russian targets and taken data from Belarusian weapons manufacturer Tetraedr. But the development of the IT Army, a government-led volunteer unit that’s designed to operate in the middle of a fast-moving war zone, is without precedent.
The IT Army’s tasks are being assigned to volunteers through a separate Telegram channel, Fedorov said in his announcement. So far more than 175,000 people have subscribed—tapping ‘Join’ on the public channel is all it takes—and multiple tasks have been dished out. The channel’s administrators, for instance, asked subscribers to launch distributed denial of service attacks against more than 25 Russian websites. These included Russian infrastructure businesses, such as energy giant Gazprom, the country’s banks, and official government websites. Websites belonging to the Russian Ministry of Defense, the Kremlin, and communications regulator Roskomnadzor were also listed as potential targets. Russian news websites followed.
Since then the IT Army channel has expanded its scope. On February 27, it asked volunteers to target websites registered in Belarus, one of Russia’s key allies. The channel has also told subscribers to report YouTube channels allegedly “openly lie about the war in Ukraine.”
Ukraine’s Volunteer ‘IT Army’ Is Hacking in Uncharted Territory
The country has enlisted thousands of cybersecurity professionals in the war effort against Russia.
www.wired.co.uk
“We already know that they are quite good at cyberattacks. But now we will find out how good they are in cyberdefense,” the former official says.
“For a country that’s facing an existential threat, like Ukraine, it’s really not surprising that this sort of call would go out and that some citizens would respond,” says J. Michael Daniel, the head of the industry group Cyber Threat Alliance and former White House cyber coordinator for President Barack Obama. “Part of it is also a signaling exercise. It’s signaling a level of commitment across the country of Ukraine to resisting what the Russians are doing.”
The impact of the IT Army is hard to gauge thus far. While thousands of members have joined the Telegram channel, there is no indication of who they are or their involvement in any response. The channel has shared screenshots of some Russian websites allegedly being taken offline, but it’s unclear how successful these efforts have been, or where they originated from.
Who exactly Ukraine recruits will have the most bearing on what tasks the IT Army takes on. But it’s likely to encompass the DDoS attacks that have been called for thus far, and potentially helping protect critical infrastructure. “The idea that you’re going to grab this ragtag group of folk, even if they have an extensive pen testing background, that they’re going to somehow hack into the Kremlin’s networks and get valuable intelligence that’s going to change the course, that’s fantasy,” says Jake Williams, an incident responder and former NSA hacker. “DDoS and defensive is probably more important for Ukraine right now than offensive.”
It will also be important for the group to avoid any misfires. Launching more sophisticated cyberattacks—such as a worm, which can self-propagate from one system to the next—would also risk spillover incidents, where the impact of a cyberattack goes well beyond its intended target. “You could take anything from emergency services, health care systems, or other things offline without meaning to. Which both has an immediate impact—you could hurt civilians inside Russia—and it could also inadvertently escalate things if the Russians perceive that as a direct order, the direct intent of the Ukrainian government, and they escalate and respond in kind,” Daniel says. That caution applies as well, and perhaps even more so, to independent hacktivist groups like Anonymous, which has vocally joined the fray. Russia-based ransomware group Conti has said it would use its “full capacity” to retaliate if the West attempted to target critical infrastructure in Russian or “any Russian-speaking region of the world.”