Originally published 2022-02-27.
Left: a still from an Anonymous video statement. Right: Russian President Vladimir Putin.
Within hours of Russia's full-scale invasion of Ukraine on 24 February 2022, Twitter accounts linked to the hacktivist collective Anonymous announced that it was "officially in cyber war against the Russian government." Soon afterwards the website of the state-funded broadcaster RT went offline, and Anonymous accounts took credit. Over the following days the group also claimed to have hacked Russian TV channels to show footage of the war. Some of these effects were real and widely observed; who caused them, and how much they changed, is much harder to establish.
What Anonymous claimed
The declaration came from accounts such as YourAnonNews, one of the best-known voices associated with the collective. It was quickly followed by a post saying Anonymous had taken down RT's website. RT itself acknowledged that its sites had come under heavy distributed denial-of-service (DDoS) attacks, and several Russian government sites, including the Defence Ministry's, were also unreachable at times in those first days.
In the weeks that followed, people acting under the Anonymous banner claimed a long list of operations: hijacking Russian state TV and streaming services to play Ukrainian music and uncensored news, leaking around 200 GB of emails from the Belarusian arms maker Tetraedr, broadcasting feeds from hundreds of Russian surveillance cameras, and, through the leak site DDoSecrets, publishing large data sets said to come from Russian companies and state bodies. Some of the TV incidents were filmed by viewers and reported by major media; many other claims were never independently confirmed.
What a DDoS attack actually does
Most of the early action was DDoS: flooding a website with so much junk traffic from many computers at once that real visitors cannot get through. It is noisy and visible, and it can embarrass a target, but it is usually temporary. Once the flood stops or is filtered, the site comes back, and no data is stolen.
That is very different from breaking into a network, stealing documents or taking control of a broadcast. When reading about cyber operations, it helps to ask which of these actually happened. A site being down does not, on its own, prove who was responsible or that anything was "hacked" in the deeper sense.
Who, or what, is Anonymous?
Anonymous is not an organisation with members, leaders or a headquarters. It grew out of the imageboard 4chan in the mid-2000s, where users posted without names, and turned into a loose label that anyone can adopt. That makes it hard to say who is behind any given action, and equally hard to hold anyone to a claim.
Its first big public campaign, Project Chanology in 2008, targeted the Church of Scientology with prank calls, DDoS attacks and street protests in more than 140 cities. Protesters wore the Guy Fawkes mask from the film V for Vendetta, and the mask has been the group's symbol ever since. Later operations targeted the Ku Klux Klan in 2014 and 2015 and the so-called Islamic State after the Paris attacks of November 2015.
Those campaigns also show why caution is needed. A list of supposed ISIS accounts published by Anonymous in 2015 included accounts belonging to Barack Obama and the BBC, and Twitter called the lists "wildly inaccurate." Former members have admitted to exaggerating their attacks to the press.
Cyberwarfare before and during the invasion
Cyber attacks were part of the conflict well before February 2022. In January, dozens of Ukrainian government websites were defaced, and destructive "wiper" malware was found on Ukrainian systems. In mid-February, DDoS attacks hit Ukraine's Defence Ministry and major state banks such as PrivatBank and Oschadbank, briefly disrupting online banking; the United States and United Kingdom publicly attributed those attacks to Russia's GRU military intelligence. On the morning of the invasion, an attack on the Viasat KA-SAT satellite network disrupted communications in Ukraine and knocked out internet links for thousands of users elsewhere in Europe.
Ukraine responded in its own way. On 26 February 2022, Digital Transformation Minister Mykhailo Fedorov announced an "IT Army of Ukraine", a volunteer force coordinated through Telegram that shared lists of Russian targets for DDoS attacks. It was the first time a government had openly invited civilians worldwide to join cyber operations, which raised legal and ethical questions about turning volunteers into participants in a war.
Censorship and why the TV hacks mattered
The point of interrupting Russian broadcasts was to reach people who heard little about the war from their own media. Russian television is dominated by state-controlled channels, and in early March 2022 Russia passed a law punishing the spread of "false information" about its armed forces with up to 15 years in prison. Independent outlets such as the radio station Ekho Moskvy and the TV channel Dozhd were shut down or suspended, and access to Facebook and other foreign platforms was restricted.
Against that background, even a few minutes of war footage on a state channel or a hacked streaming service could reach viewers who would never seek it out. How many people saw such messages, and whether it changed their views, is unknown.
What the hacktivist campaign achieved
Most security researchers judged that hacktivist attacks had a limited military effect. DDoS disruptions were short-lived, and leaked data sets were huge and often hard to verify. The most consequential cyber operations of the war were carried out by state agencies, not volunteers.
Their impact was mostly symbolic and informational: showing global opposition to the invasion, embarrassing Russian institutions, and creating material for journalists to investigate. There were risks too, from accidentally hitting civilian services to the chance that a volunteer could be seen as a combatant. In 2023 the International Committee of the Red Cross published rules for civilian hackers in armed conflict, and the IT Army said it would follow them.
The useful lesson for readers is to treat cyber war claims, from any side, as claims. Look for confirmation from the target, from independent security researchers or from reputable media before accepting that a hack happened as described.
Sources: Wikipedia: Anonymous (hacker group), Wikipedia: IT Army of Ukraine, Daily Mail (original report).
COMMENTS