Brandefense Academy
Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover Now
Your trusted hub for learning, developing, and mastering the skills that shape tomorrow's digital defense.
Discover NowMARCH 29, 2022
The deployment of new technology that allows changeable intensity and strategies in combat has resulted in a reformulation of both the philosophy and art of war, according to analyses of geopolitical and geostrategic contexts. When these new approaches are integrated with classic conflict and security understandings, they are referred to as “hybrid warfare”.
The notion of hybrid warfare, which combines conventional and unconventional/irregular warfare and extends beyond the battlefield to include economic, diplomatic, cyber, and political warfare, is not new.
These increasingly sophisticated cyber-attacks represent a new type of warfare aimed at disorganizing and even destroying a nation’s economy. This has been called “hybrid warfare.” These attacks Are a mixture of conventional and unconventional methods used against a much stronger adversary that aims to achieve political objectives that would not be possible with traditional warfare.
The problem is often identifying the culprits. In hybrid warfare, the state responsible for the actions will often use non-state actors, which allows it to deny responsibility. But over the past two decades, many cyber-attacks targeting Western state institutions and businesses have been far more sophisticated than a couple of tech-savvy individuals operating as “lone wolves” and bear the hallmarks of actions taken with the support or approval of a hostile government.
The scale of cyber-attacks is conducted at a military level signals the involvement of state actors behind the scenes to organize or encourage these attacks. Russia has emerged as one of the international actors that have developed a sophisticated cyber warfare strategy.
On the morning of 24 November 2015, the news that the Turkish F16s had dropped a Russian Su-24 airplane that violated the airspace had a shocking effect worldwide. This event deepened quickly and reached serious proportions between Turkey and the beginning of the RF, which has created political tensions. This political tension moved into a new phase with the Distributed Denial of Service (DDoS) attacks against Turkey on 14 December 2015, at 12:00. The attacks have caused deepening political tension in relations between the two countries.
On 23 December 2016, a video was broadcast by the Anonymous Hacker Group about the attack. Posted Videos claimed that Turkey supports the Islamic State of Iraq and Syria (DAESH), Turkey gets oil illegally from DAESH, and terrorists from DAESH are being treated in Turkey. It is also claimed that this disclosure is part of the false flag operation1 planned by the Russian Service Services (RIS).
It is still quite difficult to make a clear assessment of the damage caused by the attacks. For example, it is common for Western countries to make public statements about the agencies involved in dealing with the cost of the damage resulting from such attacks or virus outbreaks. However, there is not yet an institution to carry out such a study in our country. After the attacks, it should be noted that in December 2015, when attacks continued, 10% of visitor losses were reported on sites with high visitor traffic “com.tr”
The fact that the attack has a capacity of 276,000 different addresses and 30-40 GB size from time to time, considering this huge capacity, it can be easily evaluated that this DDoS attack can be planned with just support from a state organization.
Also, at least 400,000 websites were affected by these attacks, and these sites just belonged to the e-government system, public universities, and financial institutions. At that time, there was ongoing high tension between RF and Turkey because of the shooting down Russian SU-24. Also, This cyber-attack did not target the entire internet system in Turkey; only official internet sites were targeted by these attacks.
The Russian-Ukrainian cyberwar is an offshoot of the conflict between Russia and Ukraine since the collapse of the Soviet Union in 1991. The first attacks on Ukraine were seen during the mass protests in 2013. The series of attacks, called Operation Armageddon, is thought to have been made to aid Russia on the battlefield. Between 2013 and 2014, some information systems of Ukrainian government agencies were affected by a computer virus known as Snake or Turla. In February-March 2014, when Russian troops entered Crimea, communication centers were raided, and Ukraine’s fiber optic cables were destroyed, cutting off the connection between the peninsula and Ukraine. In addition, Ukrainian Government websites, news, and social media were shut down or targeted in DDoS attacks, mobile phones of many Ukrainian parliamentarians were hacked. Experts stated that after this incident, the Russia-Ukraine cyberwar started. The targets of Russian cyberattacks were Ukrainian state institutions, the EU, the USA, defense institutions, international and regional defense and political organizations, think tanks, media, and Russian dissidents. Researchers have identified two Russian hacker groups active in the Russian-Ukrainian cyberwar after 2015: APT29 (also known as Cozy Bear, Cozy Duke) and APT28 (Sofacy Group, also known as Tsar Team, Pawn Storm, Fancy Bear). More than a dozen Ukrainian government websites were hijacked or crashed in attacks thought to have originated from Russia during the 2021–2022 Russo-Ukrainian crisis. According to Ukrainian officials, about 70 government websites were hacked, including the Ministry of Foreign Affairs, the Cabinet, and the Security and Defense Council.
Just before Russia began invading Ukraine on 24 February, it targeted Ukrainian government websites with distributed denial-of-service (DDoS) attacks. Cyber security firms announced that they had detected the distribution of malware called HermeticWiper, which targets devices in Ukraine.
This series of attacks followed shortly after the DDOS and WhisperGate attacks on Ukrainian government websites distributed as phishing software.
Considering that the US and EU have come together to support Ukraine, it is thought that the scope of cyberwar may expand. Large-scale cyber conflicts can become global due to spillover effects. Officials in both the US and UK have warned businesses to be alert to suspicious activity on their networks from Russia.
As the Russia-Ukraine crisis escalates, countries around the world have taken notice and begun preparations. Proactive measures and warnings have come from the highest levels of government, indicating that the threat of cyberwarfare is imminent.
As we can see through the example of Russia-Ukraine, cyber-attacks are seen as gradual attrition. It was observed that the planned attacks on the countries’ critical infrastructures, especially before the attack, left the countries in a difficult situation. Considering all these, it is seen that the need for institutions for cyber intelligence data will increase.
Authors:
Uğur Ateş
Mehmet Fatih Okuyan
Cemal Tiryaki
Take control of your digital security with an exclusive demo of our powerful threat management platform.
