Ukraine at D+370: Swapping drone strikes.
N2K logoMar 1, 2023

Russia and Ukraine exchange drone strikes and hacktivist action.

Ukraine at D+370: Swapping drone strikes.

A strategic withdrawal from Bakhmut remains a possibility, but Ukrainian forces continue to deny the city to Russian attacks, the Guardian reports.

Reports of drones, presumably Ukrainian craft, operating over Western Russia yesterday led President Putin to order increased air defense and other defensive measures at the border. The AP reports that at least one drone was sighted within 100 kilometers of Moscow. Little damage was reported, according to the Washington Post, apart from a fire at an oil refinery near Krasnodar, east of the Kerch Strait near the Black Sea coast. The apparent target of the drone that approached Moscow was a Gazprom gas compression station, the Guardian reports.

Shahed drones return to the air over Ukraine.

The UK's Ministry of Defence looks at reports of a new wave of Iran-supplied Shahed drones over Ukraine. Most were shot down, but their use seems more intended to stress Ukrainian air defenses than it does to do serious damage to targets on the ground. "On 27 February 2023, the Ukrainian Ministry of Defence confirmed it had shot down 11 Shahed one-way attack uncrewed aerial vehicles (OWA UAVs) out of 14 launched overnight. Serhii Popko, head of Kyiv City Military Administration, reported nine of these were shot down in the vicinity of Kyiv airspace. Three additional Shahed UAVs were reportedly shot down in Chernhiv Oblast, northern Ukraine. Prior to this 26 February 2023 attack, there have not been any reports of OWA UAVs being used in Ukraine since around 15 February 2023. This decrease in OWA UAV attack tempo likely indicates that Russia has run down its current stock: it will likely seek a resupply. Due to the vector of the attack, these Shahed-UAVs were highly likely launched from the Bryansk Oblast, Russia. Previously, the only observed launch site since mid-December 2022 was from the Krasnodar region, across the Sea of Azov. A second launch site would give the Russians a different axis of attack, closer to Kyiv. This is likely to decrease time in the air over Ukraine and an attempt to further stretch Ukrainian air defences."

An overview of hacktivist auxiliaries in Russia's war against Ukraine.

GroupSense's Cyber Warfare Report, a look at the first eight months of Russia's war against Ukraine, offers a useful overview of the role hacktivist auxiliaries have played in that war. "Interestingly," the report notes, "more hacktivist groups are openly pro-Ukraine than pro-Russia. Russia tends not to report on external cyber activities, so it is not known how effective these groups have been. However, we do know that there are more pro-Ukrainian groups than pro-Russian ones." GroupSense counts forty-two hacktivist actors working in the Ukrainian interest as opposed to thirty-six acting on behalf of Russia. The most prominent Ukrainian groups have been the IT Army of Ukraine, AgainstTheWest/BlueHornet, Network Battalion ‘65, DoomSec, and GhostSec. Russian auxiliaries of note include Killnet, Zarya, NoName057(16), Beregini, and Nemezida. XakNet represents an ambiguity. The group claims to be an independent patriotic hacktivist organization, but most observers suspect that it's in fact a unit of one of Russia's intellgence services.

The auxiliaries' most typical activities have been distributed denial-of-service (DDoS) attacks, but they've also been seen engaged in doxing and various forms of influence operations. Some of them have assisted with intelligence collection, and, on the Russian side, some hacktivist auxiliaries have deployed wiper malware against Ukrainian targets. Some of the wipers appear to have been delivered by ransomware gangs, which suggest the source of some of the talent present in the Russian auxiliaries.