Attribution to Russia for malicious cyber activity against European networks

Australia is committed to working with our partners and allies to shine a light on Russia’s ongoing unacceptable activity in cyberspace and condemns Russia’s destructive, disruptive and destabilising cyber activities against Ukraine. Today we join the US and the EU in attributing to the Russian government the following activity:

• Russian military cyber operators have deployed multiple families of destructive wiper malware, including WhisperGate, on Ukrainian government and private sector networks. These disruptive cyber operations began in January 2022 prior to Russia’s invasion of Ukraine.
• Russian government cyber actors have compromised a number of Ukrainian civilian entities since October 2021 that would be involved in crisis response activities, including networks related to emergency services, energy, transport and also communications. We have previously publicly highlighted Russia’s mid-February distributed denial of service (DDOS) attacks against certain Ukrainian banking-related services.
• Together with our partners, we assess that Russia launched cyber attacks in late February against commercial satellite communications networks to disrupt Ukrainian command and control during the invasion and those actions had spill-over impacts in other European countries. The activity disabled very small aperture terminals (VSAT) in Ukraine and across Europe. This included tens of thousands of terminals outside of Ukraine that, among other things, support wind turbines and provide internet services to private citizens.

These unacceptable activities are further examples of Moscow’s indiscriminate approach to cyber operations and blatant disregard for the effects of such operations on the public, including through the commercial sector.

In addition to shining a light on Russia’s actions, Australia is committed to imposing costs on state-based or state-sponsored malicious actors who seek to undermine an open, free, safe and secure cyberspace.

Australia does not tolerate activities in cyberspace that are detrimental to international peace and stability and that are contrary to the international framework for responsible state behaviour in cyberspace, which Russia and all members of the international community have agreed to.