Intelligence Brief: Cyberattacks by Non-State Actors on Russian Media Outlets

Intelligence Brief: Cyberattacks by Non-State Actors on Russian Media Outlets

Email
Print

Our OSINT analysts prepared a brief overview of the media mention trends surrounding the cyberattacks on the Kremlin-controlled media outlets carried out by non-affiliated non-state actors, such as decentralized hacking collectives and hacktivist groups. This short analysis uses a small sample of data collected by our Media Mining System between February and March 2022 and covers selected topics, including Sentiment Analysis, Social Media Analysis, as well as visualizations of media mentions.

Background Information – Brief Overview

In February, the world stood witness to the Russian full-scale military invasion of Ukraine. In the form of a hybrid approach, the Russian government aims to destabilize Ukraine using cyberattacks and disinformation campaigns, coupled with kinetic warfare. The modern term of hybrid warfare first became associated with state actors in mainstream media after Putin’s 2014 annexation of Crimea.

However, the Kremlin-controlled media outlets were unexpectedly targeted by non-state actors, such as decentralized hacking collectives and hacktivist groups. Following the Russian military incursion into Ukraine, various hacker collectives, most prominently the hacktivist group Anonymous, declared a “cyber war“ against Russia. The group predominantly targeted state-owned and state-affiliated institutions and companies. The type of attacks range from Distributed Denial of Service (DDoS) attacks, which aim at overloading servers, to the hacking and leaking of internal data.

This Intelligence Brief highlights ways in which the HENSOLDT Analytics Media Mining System can be used to analyze cyber attacks, specifically in times of digital warfare.

Trend Analysis: Media Mentions of the Hacker Collective Anonymous

Through strategic mining of multi-media sources – including audio and text processing – it is possible to monitor and identify trends in real-time. The trend graph below shows mentions of the most discussed topics in relation to the keyword Anonymous in traditional and social media (16th of February to the 6th of March, 2022).

Trend Analysis Media Mentions of the Hacker Collective Anonymous v2
Trend graph generated by HENSOLDT Analytics' Media Mining tool

The graph reveals that media mentions of Cyberattack increase significantly on the 24th of February. The peak in media mentions correlates with the hacktivist group Anonymous declaring a “cyber war” against the Russian government. Anonymous, and other non-state actor hacking collectives, attacked various websites. Two of the targeted Russian state-affiliated media websites, Russia Today and TASS, will  be  discussed  in more detail.

Media Mentions of Cyberattacks

The globe widget below shows mentions of locations (e.g., Moscow) in correlation with mentions of the named entity cyberattack. Following the reveal by the hacker collective Anonymous that it is “officially in cyber war against the Russian government”, media mentions of Moscow and cyberattack increased significantly on the 24th of February.

Media Mentions of Cyberattacks ​
Visualisation generated by HENSOLDT Analytics' Media Mining tool

Word Cloud Analysis: Russia Today and TASS

The word cloud tool allows for visualising the most mentioned entities, or keywords. The size of the font represents the number of times an entity has been mentioned. The following high-level overview reveals the events most mentioned by the Russian media outlet Russia Today (or RT) and TASS (16th of February to the 2nd of March).

Word Cloud Analysis: Russia Today and TASS​
Visualisation generated by HENSOLDT Analytics' Media Mining tool

The word clouds indicate that the reporting of both news outlets is dominated by the topics of Western sanctions. While there are hardly any mentions of war in relation to the invasion of Ukraine, terms such as military operation or peacekeeping are more frequently used. This aligns with Putin’s interest in painting a different picture of the Russian invasion, facilitated by state-affiliated national news such as RT and TASS.

Trend Analysis: Cyberattacks on RT

Kremlin-affiliated Russia Today has become the frequent target of cyberattacks. Among other groups, Anonymous has carried out DDoS attacks on the RT servers with the aim of (temporarily) taking them offline. The graph below shows the most mentioned topics by RT in the period from the 16th of February to the 2nd of March.

Trend Analysis: Cyberattacks on RT​
Trend graph generated by HENSOLDT Analytics' Media Mining tool

While the coverage naturally fluctuates, multiple phases of media outage can be identified, starting from the 25th of February. DDoS attacks aim at overloading the digital infrastructure with a flood of internet traffic, meaning that the media outages can be credited to the DDoS attacks carried out by Anonymous. These attacks were countered by RT’s attempts to bring the servers back online, which explains the visible traffic in between attacks.

Trend Analysis: Cyberattacks on TASS

The state-affiliated national Russian news outlet TASS was also subject to an interrupted reporting at the end of February. TASS plays a central role in Russian reporting; it has been accused of strengthening the Russian narrative with the distribution of mis- and disinformation.

Looking at the graph, it can be observed that the cyberattacks on the TASS website took place from approximately the 26th to the 28th of February. In addition to DDoS attacks targeting the server infrastructure, the website was also hacked to display a message criticizing the Russia-Ukraine war.

Trend Analysis: Cyberattacks on TASS​
Trend graph generated by HENSOLDT Analytics' Media Mining tool

Future Prospects

The future significance of cyberwarfare for the outcome of the Russia-Ukraine conflict remains to be seen. While Russian cyberattacks are currently stagnating, Russian and Belarusian corporations are increasingly being targeted by international hacker collectives. Even though this development marks a new age of hybrid warfare where decentralized groups of non-state non-affiliated actors play an active role in an armed conflict between two countries, time will tell whether these groups will be able to impact the future of Ukraine.

Tightening its grip around the information domain in this multi-domain-battle, the Kremlin has clamped down on free speech and is increasingly censoring the Russian population by blocking social media outlets (e.g., Facebook) and restricting access to international independent media (e.g., the BBC). Any opposition or independent news reporting within Russia has effectively been criminalized, which is why several independent Russian media platforms were left with little choice but to shut down in the past week.

HENSOLDT Analytics will continue to monitor the media landscape around this issue. 

This is a brief and unbiased overview of the data collected by the HENSOLDT Analytics system and does not represent the entirety of the information gathered on the topic thus cannot be treated as singular and final analysis of the event(s).
HENSOLDT Analytics
HENSOLDT Analytics

HENSOLDT Analytics is a global leading provider of Open Source Intelligence (OSINT) systems and Natural Language Processing technologies, such as Automatic Speech Recognition, which are key elements for media monitoring and analysis.