CERT-UA: Research and Technical Analysis of Large-Scale Cyber Attacks in Ukraine in 2021
summary
CERT‑UA describes building the UA30 cyber center with a SOC, cyber range and free government services, and documents a campaign of 1,306 incidents in 2022 that involves 43 tracked threat actors. A large January 14 supply‑chain compromise hits ~37 government sites (22 only defaced) via public web vulnerabilities; attackers then use manual SSH access, create accounts, delete indexes and deploy payloads including stage1.xz / BootPatch (Whisper / TARG Viper) and multiple Linux/Solaris/ICS wipers. DDoS waves knock out banks and media; investigations show exploitation of public services rather than mass phishing for initial access.
AI-written summary · about
chapters (10)
- 0:00Introduction and context
- 2:53Structure of CERT-UA
- 6:23Cyber threat trends
- 9:56Case study of early attacks
- 17:22Escalation to full invasion
- 21:25DDoS and activist campaigns
- 25:01Technical attack analysis
- 29:58Phishing and attribution
- 37:12Lessons and collaboration
- 39:12Q&A and closing remarks
related talks
25mFirst world cyberwar: public & private in Ukrainian cyber defense
47mBear Necessities: Ukraine's Experience Facing APTs, Building Resilience
50mStronger Together: The US-Ukrainian Cyber Partnership
50mDroned Out: Surveilling the Noise in the Russian War in Ukraine
45mResilience Under Fire: Lessons from Cyber Defense in Ukraine
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
51mState of the Hack 2023
41mWhat We Can Learn from Ukraine's Cyber Defenders about Building a More Resilient Future