Anatomy of a Breach

Anatomy of a Breach: Russia-Ukraine — Cyber Warfare as a Component of Kinetic War

> series: anatomy_of_a_breach —— part: 158 —— event: russia_invades_ukraine —— cyber: viasat_wipers_ddos —— context: first_large-scale_cyber_war<span class="cursor-blink">_</span>_

Hedgehog Security 28 February 2022 15 min read

Missiles and malware. Simultaneously. Cyber warfare became real warfare.

On 24 February 2022, Russia launched a full-scale military invasion of Ukraine. Hours before the first missiles struck, a cyber attack targeted Viasat's KA-SAT satellite network — deploying 'AcidRain' wiper malware to satellite modems across Europe. The attack disrupted Ukrainian military and government communications at the moment they were most needed, and caused collateral damage to thousands of Enercon wind turbines in Germany that relied on the same satellite network for remote monitoring.

The satellite attack was one component of a broader cyber offensive that had begun weeks before the physical invasion. Multiple wiper malware variants — HermeticWiper, IsaacWiper, CaddyWiper, WhisperGate — were deployed against Ukrainian government agencies, banks, and infrastructure. DDoS attacks hit Ukrainian government websites. And disinformation campaigns targeted both Ukrainian and international audiences. The conflict represented the most extensive integration of cyber operations into conventional warfare ever documented — confirming the theoretical scenarios that had been debated since Stuxnet (2010) and the Ukraine power grid attack (2015).


Recommended

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

From theory to doctrine. Cyber is now a permanent component of military conflict.

Viasat: Collateral Damage Across Borders
The Viasat attack targeted Ukrainian communications but disrupted satellite services across Europe — including German wind turbines. Like <a href="/blog/anatomy-of-a-breach-notpetya">NotPetya</a> (2017), cyber weapons targeting one country cause collateral damage internationally. For UK organisations dependent on satellite communications, the Viasat attack demonstrated real-world impact. Our <a href="/penetration-testing/infrastructure">infrastructure testing</a> assesses communications resilience.
Wipers: Destruction, Not Ransom
The wiper malware variants deployed against Ukraine were designed for permanent destruction — not ransomware for profit. This continued the trend from <a href="/blog/anatomy-of-a-breach-saudi-aramco-shamoon">Shamoon</a> (2012), <a href="/blog/anatomy-of-a-breach-notpetya">NotPetya</a> (2017), and <a href="/blog/anatomy-of-a-breach-olympic-destroyer">Olympic Destroyer</a> (2018). Defence requires immutable backups and tested recovery procedures. <a href="/penetration-testing/infrastructure">Infrastructure testing</a> validates backup integrity.
Global Spillover Risk
The <a href="https://www.ncsc.gov.uk/news/ncsc-supports-government-response-to-russia-invasion-of-ukraine">NCSC issued guidance</a> to UK organisations to strengthen their cyber defences in response to the conflict, warning of potential spillover effects from Russian cyber operations. <a href="/cyber-essentials">Cyber Essentials</a> provides the baseline controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for indicators of nation-state activity. <a href="https://www.cyber-defence.io/services/threat-intelligence">UK Cyber Defence</a> provides threat intelligence on conflict-related cyber threats.
Ukraine's Cyber Resilience
Remarkably, Ukraine's critical infrastructure proved more resilient than many expected — partly due to years of experience defending against Russian cyber attacks since 2014, cloud migration (which moved data outside Ukraine), and international support. Resilience — not just prevention — proved to be the decisive factor.

The NCSC warned UK organisations to strengthen defences. Have you?

The Russia-Ukraine conflict created heightened cyber risk for UK organisations — particularly those in critical infrastructure, defence supply chains, financial services, and energy. The NCSC's guidance to strengthen defences was not theoretical — it reflected assessed threat intelligence about potential Russian cyber operations targeting Western countries. Cyber Essentials addresses the baseline controls the NCSC recommends. Our penetration testing validates these controls. SOC in a Box provides 24/7 monitoring at heightened alert levels. And UK Cyber Defence's threat intelligence provides awareness of conflict-related threats targeting UK organisations.


Russia-Ukraine made cyber warfare real. The NCSC warned UK organisations. Have you strengthened your defences?

<a href="/cyber-essentials">Cyber Essentials</a> provides the baseline the NCSC recommends. <a href="/penetration-testing">Penetration testing</a> validates controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors at heightened alert.

Next Step

Not sure where to start?

We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.

Free Scoping Call

Related Articles