Ukraine says to review cyber defences after airport targeted from Russia
Ukrainian authorities were trying to determine if the malware was connected to “BlackEnergy”, malicious software that has been linked to other cyber attacks in the Ukraine, an airport spokeswoman said.
“Yesterday, the communications specialists established that one of the workstations at the Boryspil airport was infected by [the] Black Energy virus”.
There is no suggestion of Russian state involvement but it comes amid badly-strained relations over Ukraine’s separatist conflict.
Ukraine’s Computer Emergency Response Team (CERT-UA) warned on Monday of the threat of possible further virus attacks after malware was found in the IT system of Kyiv’s main airport over the weekend. The attacks come from 2007-09, so they pre-date the Obama-Xi agreement a year ago. She said there are signs this is the case.
The Ukrainian government is looking into the security of its computer systems after the country’s main airport in Kyiv suffered a cyber-attack launched from a server in Russian Federation. The incident was the first known power outage caused by a cyber attack, according to experts.
In part because of the presence of a variant of BlackEnergy-a piece of malware that has been used for cybercriminal campaigns, as well as attacks on engineering systems-one research group attributed the attacks to Russian Federation, and specifically the so-called “Sandworm” hacking group.
“Attention to all system administrators…”
On December 23rd, electricity was cut for six hours to about 80,000 people in and around Ivano-Frankivsk, a city of some 230,000 people about 200km from the Polish border.
A new model for attributing cyber attacks (from Thomas Rid and Ben Buchanan). The malware doesn’t appear to have been activated or done any tangible damage to the airport itself.
Tim Erlin, director of security and product management at Tripwire, told SC that cyber-attack attribution isn’t always easy to get right, and rarely does the technical evidence for assigning responsibility to a nation-state get presented publicly.
