Fabian Eberhard and Simon Marti
While bombs are falling in Ukraine, another war is raging in Europe. It’s a silent war waged on the Internet. Russian hacker gangs are attacking Western governments and critical infrastructure across the continent.
Cyber attacks have intensified in recent weeks. All pro-Ukraine countries are in their sights, including Switzerland. SonntagsBlick research shows: Pro-Russian hackers have attacked the foreign department (EDA). This emerges from a confidential situation report by the Federal Intelligence Service (NDB) on June 24.
Attempted attack with phishing emails
The hackers used so-called phishing emails for their attack on Switzerland. The Internet criminals use fake messages to present themselves as trustworthy communication partners with the aim of obtaining sensitive data. However, according to the situation report, the e-mails were recognized and rendered harmless.
Research Notes
Do you have any leads on explosive stories?
Write to us: recherche@ringier.ch
Do you have any leads on explosive stories?
Write to us: recherche@ringier.ch
What exactly the hackers were up to is unclear. Was it just commercially motivated fraud or was it espionage? In a general assessment, the FIS writes in the situation report: “After successfully penetrating a computer system for espionage purposes, this access can also be used for sabotage (especially data deletion).”
Confronted with the phishing attack on the FDFA, the federal government blocked it. “For security reasons, the FDFA does not disclose any details on attempted attacks,” says Andreas Heller, spokesman for the foreign department.
Increased cyber threat
At the National Center for Cyber Security (NCSC), they don’t even want to know about a “qualified” attack. Spokeswoman Manuela Sonderegger: “Since the start of the Ukraine conflict, the NCSC has not observed any targeted cyber attacks against the federal government that could be clearly linked to the context of the conflict.” The fact that the FIS explicitly places the phishing attack in its confidential report in the context of Russian cyber espionage against pro-Ukraine governments does not change the answer.
Finally, the intelligence service itself assures that the situation is being closely monitored. According to spokeswoman Isabelle Graber, the war in Ukraine has so far “not directly” led to an increase in cyber attacks on Switzerland. But she admits: “The cyber threat has increased.”
The topic is sensitive – and the timing even more sensitive. High-ranking politicians from all over the world are traveling to Lugano TI on Monday. The Ukraine reconstruction conference is taking place there. The Kremlin should be very interested in knowing what the western friends of Ukraine are discussing behind the scenes.
State and private hackers work together
Last week, the federal intelligence service released its annual activity report. In it he classifies cyber espionage against Switzerland as a result of the Ukraine war as “very likely”. “Malicious software flies further than rockets,” writes the FIS.
It is often difficult to clearly assign cyber attacks to a sender. In the case of attacks from Russia, state and private authors become blurred. The Kremlin is increasingly working with criminal hacker gangs. The most recent example: the Killnet group, the Russian equivalent of Anonymous.
The Five Eyes, an intelligence alliance from Australia, Canada, New Zealand, Great Britain and the USA, classify the troupe as online criminals who act primarily for financial reasons, but can also occasionally be harnessed for Russian government interests.
Attacks on several countries
In the past few weeks, Killnet has attacked numerous countries in Western Europe. An attack on Lithuania, where the group paralyzed authorities and companies, caused a stir. On the messenger service Telegram, Killnet boasted about the attack and threatened further attacks. The reason for this is that Lithuania has adopted EU sanctions and is blocking the transport of goods such as steel to the Russian enclave of Kaliningrad.
Killnet is also on the radar of the Swiss intelligence service. In his confidential situation report he mentions the Russian group. On Telegram, Killnet is thanked for supporting cyber attacks on Lithuania’s infrastructure, according to the FIS.
It is not clear whether the Putin hackers are also behind the attacks on the federal government. What is certain, however, is that they will soon strike again – somewhere in Europe.