Ukraine hit by cyberattack as U.S. questions Russian troop pullback

KYIV/MOSCOW/WASHINGTON – Ukraine said it had been hit by a cyberattack on Tuesday, as Moscow’s statements about a partial troop pullback were met with Western skepticism.

Ukrainian officials did not say who it believed was responsible for the cyberattack, but a statement suggested it was pointing the finger at Russia.

U.S. President Joe Biden warned he would move with allies to respond to the cyber hacks and said a Russian physical attack remained a possibility.

Biden, speaking hours after Ukraine reported its defense ministry and two banks had been hacked, told reporters that Washington was coordinating closely with NATO allies and other partners to expand defenses against threats in cyberspace.

The attacks, believed by Western security experts to have been carried out by Russia, were not unexpected, U.S. and European officials said, requesting anonymity.

Russia’s Federal Security Service did not immediately reply to a request for comment from Reuters.

“The president has said we will respond to Russian actions short of a military invasion,” said one U.S. official. “But what is decided depends on the extent of the cyberattacks. There are so many ranges, it’s hard to go into specifics.”

One European diplomat said cyberattacks were a longstanding component of Russian strategy, and had been used by Moscow in past military confrontations with Georgia and Ukraine.

“It’s part of their playbook,” the official said, underscoring Western resolve to use concerted action to hold Moscow accountable for cyberattacks and other “misbehavior.”

While U.S., European and Canadian officials have worked out a detailed package of sanctions if Russian forces invade Ukraine, there is no similarly detailed plan for how to respond to cyberattacks, the sources said.

That is partly because it can take time to pinpoint who was responsible, especially in the case of distributed denial of service (DDOS) attacks, said the officials. DDOS attacks work by directing a fire hose of internet traffic from a multitude of sources against a server or other target.

More aggressive and damaging attacks are likely to draw a fiercer response. And some countries — including France — generally prefer to avoid publicly attributing blame for cyberattacks, said one of the European officials.

The response could involve actions other than sanctions, including physical or cyberattacks on servers involved, said one cyber expert familiar with Western planning.

Many Russians held responsible for past cyberattacks have appeared on sanctions blacklists, but more could be added, two of the officials said.

Negotiations between U.S. and European officials in recent weeks have focused more on finetuning the sanctions likely to be imposed in the event of a physical invasion — and their impact on Russia and the imposing countries — rather than mapping out a menu of options for cyberattacks, said one European official.

“There’s no detailed roadmap for what (to) do in the event of a cyberattack,” said one European diplomat. “That will depend on the specifics of the case.”

“It is not ruled out that the aggressor used tactics of dirty little tricks because its aggressive plans are not working out on a large scale,” said the Ukrainian Center for Strategic Communications and Information Security, which is part of the culture ministry.

“If Russia attacks the United States or our allies through asymmetric means like disruptive cyberattacks against our companies or critical infrastructure, we’re prepared to respond,” Biden said in televised remarks from the White House.

One European diplomat said the hacking was concerning because a full military attack on Ukraine would likely be preceded by a cyberattack.

“It could mean a physical attack is imminent, or it could mean Russia is continuing to mess with Ukraine,” the diplomat said, on condition of anonymity.

The cyberattack was marked by distributed denial-of-service attacks, in which hackers flood a network with unusually high volumes of data traffic to paralyze it. Such incidents are difficult to attribute but the European diplomat said there was no doubt that Russia was behind it.

Ukrainian bank Privatbank users reported problems with payments and a banking app, while Oshadbank said its systems had slowed down.

Meaningful de-escalation

On Tuesday, Russia published footage to demonstrate it was returning some troops to base after exercises. Biden said the United States had not verified the move. “Our analysts indicate that they remain very much in a threatening position,” he said.

U.S. Secretary of State Antony Blinken told Russian counterpart Sergey Lavrov during a call that there needed to be “verifiable, credible, meaningful de-escalation” by Moscow.

NATO’s chief welcomed signals from Russia in the past two days that it may be looking for a diplomatic solution but urged Moscow to demonstrate its will to act.

“There are signs from Moscow that diplomacy should continue,” NATO Secretary-General Jens Stoltenberg told reporters.

He said Russia often left military equipment behind after exercises, creating the potential for forces to regroup.

At a joint news conference with German Chancellor Olaf Scholz, Russian President Vladimir Putin referred only briefly to the troop moves and did not go into details.

Russia has always denied planning to invade Ukraine, saying it can exercise troops on its own territory as it sees fit. It has been pressing for a set of security guarantees from the West and wants to stop Kyiv from ever joining NATO.

Putin told reporters Russia would not be satisfied with talk that Ukraine was not ready to join the western military alliance any time soon and was demanding that the issue be resolved now.

“As for war in Europe … about whether we want it or not? Of course not. That is why we put forward proposals for a negotiation process, the result of which should be an agreement on ensuring equal security for everyone, including our country,” he said.

Russia’s show of force near Ukraine’s borders has prompted months of frantic Western diplomacy and drawn threats of severe sanctions if it invades, culminating in a crescendo of warnings in recent days that this could happen at any time.

The Kremlin sought to portray its moves as proof that Western talk of war had been both false and hysterical.

“Feb. 15, 2022 will go down in history as the day Western war propaganda failed. Humiliated and destroyed without a single shot fired,” Foreign Ministry spokeswoman Maria Zakharova said.

Russia’s defense ministry published footage showing tanks and other armored vehicles being loaded onto railway flatcars. Western military analysts said they needed more information to judge the significance of the latest troop movements.

Commercial satellite images taken on Sunday and Monday showed a flurry of Russian military activity at several locations near Ukraine.

Russian shares, government bonds and the ruble rose sharply on hopes the situation was easing, and Ukrainian government bonds rallied.