Cyber Incident Victim: Ministry of Energy of Ukraine
Date:
Apr 2018
Location:
Ukraine
Summary
A ransomware attack compromised Ukraine's energy ministry's website, rendering it offline and encrypting files while displaying a ransom demand for 0.1 bitcoin. Ukrainian cyber-police confirmed the incident was isolated, with no broader government impact, and noted the ministry's email systems remained operational. Security researchers identified two distinct attackers: an initial hacktivist defacing the site under the alias 'X-zakaria,' followed by a separate actor exploiting the breach to deploy ransomware for financial gain. Analysis suggested both were likely amateur hackers rather than state-sponsored actors, contrasting with previous destructive attacks masquerading as ransomware targeting Ukrainian energy infrastructure. The attackers' historical earnings from similar compromises were minimal, and officials worked to restore services without disclosing resolution timelines.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On April 24, 2018, ransomware compromised the website of Ukraine’s Energy Ministry, rendering it inaccessible and encrypting its files. The attackers replaced the site with an English-language message demanding a payment of 0.1 bitcoin, equivalent to approximately $928 at the time. Ukrainian cyber-police spokeswoman Yulia Kvitko confirmed the incident as isolated, clarifying that no other government websites were impacted and that the ministry’s email systems remained operational. The cyber-police initiated a response, with specialists working to resolve the issue, though no estimated restoration timeline was provided. Security firm AlienVault analyzed the attack, identifying two distinct threat actors: the first, using the alias ‘X-zakaria,’ defaced the website but did not deploy ransomware. A second attacker subsequently exploited a backdoor left by the initial intrusion to encrypt files and implement the ransom screen.
AlienVault researcher Chris Doman characterized both hackers as likely amateurs rather than nation-state actors, citing their limited financial gains from prior attacks—approximately £100 total. The firm noted that while Ukrainian energy entities had historically faced disruptive attacks disguised as ransomware, this incident lacked hallmarks of sophisticated operations. The ransomware’s payment mechanism and the attackers’ operational patterns suggested a financially motivated criminal effort rather than a strategic cyber campaign. The Energy Ministry’s website remained offline during the response, with no public reports of data destruction or secondary impacts beyond the encryption. Ukrainian authorities maintained public assurances of their capacity to manage the incident, emphasizing its containment to a single government domain.