Ukraine at D+665: Reprisals for the Kyivstar hack.
the cyberwire logoDec 21, 2023

Ukrainian hacktivist auxiliaries undertake reprisals for the Kyivstar hack, and Russian disinformation tacks toward a narrative of the Russian World as it takes advantage of technological advances.

Ukraine at D+665: Reprisals for the Kyivstar hack.

The Kyiv Independent reported this morning that Russian forces shelled six villages in the Sumy Oblast, roughly 10 km from the Russian border. Artillery and drone strikes hit other Ukrainian towns overnight. Al Jazeera reports attacks against Kherson and Kharkiv, as Russian forces push, again, into Avdiivka, where they've advanced about a kilometer and a half at the cost of heavy casualties. Russian ground forces are now engaged in a large number of smaller assaults, by Ukrainian estimates some eighty-nine, with thirty-one of those around Avdiivka. For its part, Ukraine continues to dig in, improving field fortifications.

Influence differing more in style than substance.

The Institute for the Study of War (ISW) contrasts a recent address by Russian Orthodox Patriarch Kirill with recent remarks by President Putin. The ISW portrays the Patriarch as xenophobic and divisive, the President as irenic and inclusive.

"Head of the Kremlin-controlled Russian Orthodox Church Patriarch Kirill made a series of anti-migrant and xenophobic remarks that directly contradict Russian President Vladimir Putin’s ongoing efforts to reestablish the inclusive Russian World (Russkiy Mir) ideology," the ISW writes. "During the Moscow Diocesan Assembly on December 20, Kirill blamed migrants for increasingly threatening interreligious and interethnic peace in Russia by refusing to integrate into Russian society and forming criminal and extremist organizations. Kirill added that life for the ethnically Russian 'indigenous population' is almost unbearable in some areas, including Moscow, claiming that if such trends continue then the Russian Orthodox people will 'lose Russia.' Kirill’s statements contrast with Putin’s recent efforts to present himself as a centrist figure and to reestablish the concept of the Russian World, which includes all people of different ethnicities and religious affiliations who have lived or are living in geographical areas that belonged to Ancient Rus (Kyivan Rus), the Kingdom of Muscovy, the Russian Empire, the Soviet Union, and the contemporary Russian Federation. Putin notably also stated during the Meeting of the Council of Legislators on December 20 that the Russian constitution and government are trying to ensure harmony in a diverse and large Russia – reemphasizing his efforts to present Russia as an inclusive and harmonious multicultural Russian state."

The ISW is worth quoting at length, its discussion thoughtful as usual, but what they see as a substantial difference may be more one of style than substance. The Russian World has not been notably pluralistic. It was built with a great deal of cultural, religious, and (especially) linguistic assimilation, and these all figure prominently in its present version. The linguistic assimilation has been especially prominent, with even languages as closely related to Russian as Ukrainian being too far apart for official comfort.

"Putin, on the one hand, has been increasingly reimagining himself as a modern tsar who is defending Russian sovereignty to justify his war in Ukraine and to appease his ultranationalist constituencies who tend to have more intolerant views on religion and Russian identity. But Putin has, on the other hand, been trying to seem to be an inclusive leader to incentivize all religious and ethnic groups to support his regime and war efforts. ISW assessed on November 28 that Kirill’s anti-migrant and xenophobic rhetoric is more closely aligned with Russian government policies towards migrants and non-Russian ethnicities in Russia than Putin’s more inclusive rhetoric in the context of the Russian World. These narratives and policies are thus contradictory and may ultimately complicate Putin’s efforts to appease different constituency groups in Russia and may trigger further interethnic and interreligious conflicts."

While the characterization of Mr. Putin as a new tsar is surely apt, the rhetorical difference between the Patriarch and his Presidential master seems unlikely to represent a deep fissure in substance. Future influence operations can be expected to take both tracks, with the emphasis chosen on the basis of tactical expediency. There are minorities with strong and distinctive identities whom it's in Moscow's interest to placate as long as they're useful--think of Ramzan Kadyrov's Chechens--but how long their distinctive identities would be tolerated, let alone valued, in the event of Russian victory in Ukraine is an open question. (The Chechens represent an interesting case. They've been difficult to assimilate, and the attempt to do so has been a matter of centuries. Leo Tolstoi's novella Hadji Murat was based on the author's own experiences as a young officer fighting in that region.)

Creating false personae and amplifying lies, with effect.

The BBC has an interesting story about how disinformation created and amplified by a bogus media operation resonated with some Republican members of the US Congress. "A website founded by a former US Marine who now lives in Russia has fuelled a rumour that Volodymyr Zelensky purchased two luxury yachts with American aid money," the report begins.

The story began in a little-followed YouTube channel, was picked up by the slightly more followed but still obscure "DCWeekly" site, which, as the BBC points out, is neither weekly nor based in Washington, DC. AI-generated stories (attributed to fictitious reporters, complete with credits and headshots culled from various corners of the Internet) spread Kremlin narratives under a vaguely plausible journalistic veneer. Clemson University researchers whose work the BBC cites put it this way: "Technological changes in digital publishing and AI have enabled an entirely novel strategy of integration—the de novo creation of a credible and (seemingly) mainstream media outlet to directly deliver the layered narratives to the target audiences. These technological changes mean the campaign described in this report distributes false narratives faster, at greater volume, and at lower costs than was the case with Soviet-era campaigns." That is, there's always a lot of Internet dreck out there, but the new Internet dreck is swallowed all the more readily than was propaganda back in radio days (and OG radio propaganda was bad enough).

The story about US aid being diverted to buy superyachts for Mr. and Mrs. Zelenskyy was easily debunked (the yacht brokers who own them say they're still up for sale, should you be interested) but it had legs that took it into the US Congress, where a Republican fringe mentioned it as they expressed reservations about renewing US aid to Ukraine.

Reports: Ukrainian reprisals for Russia's Kyivstar attack.

Ukrainian hacktivist auxiliaries claimed two reprisals for Russia's disruption of the Kyivstar telephone and Internet service.

Ukrainian hacktivist auxiliary BLACKJACK claimed, RBC-Ukraine reports, to have breached Russia's Rosvodokanal privately-owned water utility. RBC-Ukraine says the cyberattack was conducted with the support of Ukraine's SSU. The attack hit the utility's IT systems rather than its control systems, but BLACKJACK claims it disrupted operations nonetheless, specifically by accessing a large number of "documents," encrypting data on more than six-thousand computers, and deleting more than fifty terabytes of data "including internal document circulation, corporate mail, cybersecurity services, backups, etc."

Another cyberattack, according to Ukrainska Pravda, sought to inflict damage on Bitrix24, an IT service provider whose customer relations management (CRM) systems are used by many large Russian companies. The effects of the attack may extend beyond Russia proper to the Commonwealth of Independent States. The disruption of CRM services seems to be particularly serious, at least in the hacktivist auxiliary's reckoning. The IT Army of Ukraine said, in a Telegram post claiming credit for the attack: "Boom! Precision hit on the CIS portion of Bitrix24 servers! This means war sponsors like Rosneft are facing huge operational issues with their clients, just like over 40% of CRM system users in the aggressor country. This could mean tens or even hundreds of millions of dollars in losses for the enemy's economy, depending on how long we can hold them down. Who else has idle devices? It's time to turn them on." The nature of the attack isn't clearly specified, but the last sentences of the post suggest a distributed denial-of-service attack.

Poland provides more Starlink terminals to Ukraine.

Ukraine's Ministry of Digital Transformation has announced that Poland's government has donated an additional fifty-thousand Starlink terminals to Ukraine. The delivery constitutes a contribution to the resilience and redundancy of Ukrainian Internet service. "Thanks to Starlinks, communication is quickly restored to the de-occupied territories, and schools and hospitals continue to operate. I am grateful to the Polish government for another large-scale batch of 5,000 Starlinks. Out of 47,000 terminals operating in Ukraine, we received 19,500 thanks to our Polish partners,” Mykhailo Fedorov, Deputy Prime Minister of Ukraine for Innovation, Education, Science and Technology Development, and Minister of Digital Transformation of Ukraine, said in the statement. The announcement emphasized the role Starlink has played in sustaining civilian critical infrastructure.