Cyber Incident Victim: Forbes Russia
Date:
Feb 2022
Location:
Russia
Summary
A cyberattack attributed to the Anonymous hacker group disrupted Forbes Russia's website, defacing it with an anti-war message urging Russians to oppose the invasion of Ukraine. The message, purportedly from concerned journalists within Russia, warned of repercussions for dissent while condemning the conflict as unnecessary. This incident formed part of a broader campaign targeting Russian state media outlets and government websites, including denial-of-service attacks that caused widespread access disruptions. Similar disruptions affected telecommunications providers, compounding the impact on digital services. The hacktivist actions aligned with public calls by Ukrainian officials to mobilize cyber capabilities against Russian targets during the military conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 28, 2022, the hacker collective Anonymous claimed responsibility for a series of cyberattacks targeting Russian state-aligned media outlets, including Forbes Russia. The attacks, which began around February 24 amid Russia’s invasion of Ukraine, involved website disruptions and unauthorized defacements. Anonymous compromised Forbes Russia’s website, replacing its content with a Russian-language message urging citizens to resist the war. The message, attributed to "concerned journalists of Russia," criticized the conflict’s futility and predicted severe societal consequences, stating, "In a few years we’ll live like in North Korea." It acknowledged the risks of retaliation against dissenting journalists, including dismissals and imprisonment. Similar actions affected state news agencies TASS and RIA Novosti, as well as newspapers Kommersant and Izvestiya. These incidents followed Anonymous’ February 24 disruption of RT (Russia Today) and weekend attacks against Russian government sites, including the Kremlin, Defense Ministry, and Duma, which experienced distributed denial-of-service (DDoS) barrages.
The cyberattacks caused operational disruptions across targeted entities, with visitors encountering altered content or inaccessible pages. NetBlocks reported collateral impacts on Russian telecommunications infrastructure, noting access delays for major providers Rostelecom, MTS, Beeline, and Megafon by February 26. Ukraine’s government responded by mobilizing cyber capabilities, with Digital Transformation Minister Mykhailo Fedorov announcing the creation of an "IT army" on February 26 to recruit technical personnel for coordinated operations. Anonymous publicly claimed the media and government website takedowns via Twitter, framing them as protests against the invasion. The defacement of Forbes Russia highlighted internal dissent, with the posted message emphasizing journalists’ defiance despite anticipated repercussions. No technical remediation efforts by affected Russian organizations were detailed in available reports.