Cyber Incident Victim: TASS
Date:
Feb 2022
Location:
Russia
Summary
A hacker group disrupted multiple Russian state media websites, including TASS, through cyberattacks involving denial-of-service incidents and unauthorized defacement. The attackers posted anti-war messages urging Russians to oppose the ongoing conflict, with compromised platforms displaying appeals to reject participation in military actions and warnings of societal consequences. These incidents followed prior disruptions targeting government and telecommunications infrastructure, causing access delays for critical services. The collective actions were framed as protests against the invasion of Ukraine, aligning with broader digital activism efforts during the conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 28, 2022, the hacker collective Anonymous claimed responsibility for disrupting multiple Russian state media websites in response to Russia’s invasion of Ukraine. The group targeted the websites of state news agencies TASS and RIA Novosti, along with newspapers Kommersant and Izvestiya and Forbes Russia magazine. Anonymous defaced these platforms with messages urging Russian citizens to oppose the war and reject participation as combatants. One message on Forbes Russia’s site, written in Russian, warned of a future resembling North Korea under continued conflict and declared, “It isn’t our war, let’s end it!” The message attributed itself to “concerned journalists of Russia,” acknowledging the risk of censorship, job loss, or imprisonment for dissent. These cyberattacks primarily involved distributed denial-of-service (DDoS) campaigns, overwhelming the sites to disrupt access.
The incident followed a pattern of escalating cyber operations against Russian entities. Days earlier, Anonymous had hacked the state-funded RT television channel on February 24 and claimed responsibility for weekend DDoS attacks that temporarily disabled websites of the Kremlin, the Russian Defense Ministry, and the Duma (Russia’s lower parliament). Concurrently, NetBlocks reported widespread access issues affecting major Russian telecommunications providers—Rostelecom, MTS, Beeline, and Megafon—though it did not explicitly link these disruptions to Anonymous. Meanwhile, Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov, publicly called for an “IT army” of volunteers to bolster cyber defenses and offensive operations against Russian targets, reflecting the broader cyber conflict emerging alongside conventional warfare. The defacement messages emphasized internal dissent among Russian media professionals while highlighting the immediate operational impact on state-aligned news dissemination.