Ukraine at D+377: Sabotage, and prospects of future cyberattacks.
N2K logoMar 8, 2023

Was the Nord Stream sabotage the work of anti-Putin freelancers? Prospects for cyber escalation in the war's next phases.

Ukraine at D+377: Sabotage, and prospects of future cyberattacks.

Russia is (still) pushing hard to take Bakhmut, and the issue is (still) in doubt. NATO General Secretary Stoltenberg, in the course of remarks meant to caution against underestimating Russian capabilities, said, the Guardian reports, that the city could fall in the next few days.

Russia's Defense Minister finally competes with Russia's shadow Defense Minister in frontline swagger

Russian Defense Minister Sergei Shoigu hasn't been seen in Ukraine much more than, say, any number of NATO heads of state, but he made a trip to the near-front over the weekend. The British Ministry of Defence reads the visit as Mr. Shoigu's reaction to being upstaged, macho-wise, by Wagner Group capo Prigozhin. The MoD is no friend of Messrs. Shoigu or Prigozhin, but on this one they've probably got a point. This morning's situation report says, "On 4 March 2023, the Russian Ministry of Defence released a video of a rare visit to Ukraine by Russian Defence Minister Sergei Shoigu. There is a realistic possibility that this was partially in response to recent footage of the owner of Wagner Group, Yevgeny Prigozhin, visiting his fighters on the front line. Wagner is in a high-profile dispute with the Russian Ministry of Defence and Shoigu is likely sensitive to being compared to Prigozhin." The visit might suggest renewed attention to Vuhledar, south of Bakhmut. "The only deployed Russian field commander shown in the video was Colonel General Rustam Muradov. It is notable that Muradov is responsible for the Vuhledar sector of Donetsk Oblast, where several assaults have failed in the last three months. Until recently, the Russian command likely saw a breakthrough at Vuhledar as a key way to achieve an operationally significant breakthrough in Ukraine’s lines. Russian planners are likely facing the dilemma of attempting another Vuhledar assault or supporting intense fighting further north near Bakhmut and Kremina."

Nord Stream sabotage may have been the work of an anti-Putin group.

The New York Times and others report a tentative conclusion sourced to the US Intelligence Community: an anti-Putin group may have sabotaged the Nord Stream pipeline in the early days of the war. The explosions that severed the pipeline during the early days of Russia's war have been controversial, with Russia claiming that a Western intelligence service--probably the CIA--was responsible, and with most Western observers seeing the sabotage as either a Russian provocation or demonstration of force. It now appears that a group hostile to President Putin's regime may have damaged Nord Stream in an anti-Russian action. The story says the US sees no Ukrainian government involvement in the operation, at least no involvement of senior officials. "The review of newly collected intelligence suggests they were opponents of President Vladimir V. Putin of Russia, but does not specify the members of the group, or who directed or paid for the operation." It's thought the saboteurs were either Ukrainian or Russian nationals, perhaps a mix of both.

Russia dismissed the story as a fabrication. "After this report was published, Russia attacked the credibility of the intelligence, complaining that it had been prevented from taking part in the investigations. 'This is obviously a coordinated spread of disinformation in the media,' Dmitry S. Peskov, a Kremlin spokesman, told the state-backed Sputnik news agency."

US Cyber Command head warns against underestimating Russia.

"Russia remains a very capable adversary," US Cyber Command and NSA chief General Paul Nakasone told the US Senate Armed Services Committee yesterday. C4ISRNet reports that he told the Senators US Cyber Command was monitoring the war "very carefully."

Representatives of General Nakasone's two commands were also forthright in sharing a warning (anonymously, and not for attribution) with the media. The Voice of America writes:

“'The weight of this conflict remains significant,' a spokesperson for U.S. Cyber Command told VOA, sharing information on the condition of anonymity due to the nature of the ongoing fight. 'We anticipate their cyber activities may become bolder and look at broader targets.' Officials at the National Security Agency have reached similar conclusions. 'If the conflict continues to not go well for Russia, there is some chance that Russia will be increasingly brazen in its cyberattacks on civilian infrastructure as we have already seen with their kinetic activity,' an NSA spokesperson told VOA, who like their Cyber Command counterpart spoke on the condition of anonymity."

Russian cyber operations have so far shown disappointing results, especially for the amount of effort evidently expended on them. The warnings from NSA and Cyber Command think, however, that Russian forces will seek to redress battlefield failure with cyberattacks, and especially cyberattacks against those countries that have provided Ukraine important support. “We anticipate that Russian actors will increasingly look outside of Ukraine's territorial borders when planning and conducting operations, be it related to aid that Western countries are giving to Ukraine or to try to undermine Western unity with disinformation as the conflict drags on,” the NSA spokesperson added.

So far such attacks haven't been destructive or even severely disruptive. Still, it's possible Russia's cyber operators are learning. While Russian forces have shown a surprising inability to organize combined arms operations, it would seem that cyberattacks might in principle be easier to coordinate than action with infantry, tanks, artillery, and attack aviation.

Lindy Cameron, head of the UK's National Cyber Security Centre, offered an appreciation quoted in ComputerWeekly:

“Both efforts [disruption and disinformation] have largely failed, thanks to the efforts of Ukrainian and western digital expertise within governments and the private sector,” she said at the time. “In many ways, the most important lesson to take from the invasion is not around the Russian attacks – which have been very significant and, in many cases, very sophisticated – it is around Russia’s lack of success. Try as they might, Russian cyber attacks simply have not had the intended impact.

“Russia has made Ukraine match fit over the past 10 years by consistently attacking them,” added Cameron. “We haven’t seen ‘cyber Armageddon’. What we have seen is a very significant conflict in cyber space – probably the most sustained and intensive cyber campaign on record.”