Cyber Incident Victim: Russia-24
Date:
Sep 2022
Location:
Russia
Summary
Pro-Ukrainian hackers breached multiple Russian television channels, including Russia-24, to broadcast anti-war messages comparing Russia's invasion of Ukraine to terrorist attacks and displaying footage of assaults on Ukrainian cities alongside condemnations from Ukrainian and international leaders. The group "hdr0" claimed responsibility, stating the hack forced Russian viewers to confront the conflict's realities, though they did not disclose technical details or audience reach. This incident followed similar prior breaches where hackers replaced Victory Day parade coverage with anti-war statements and hijacked Crimean broadcasts to air Ukrainian presidential addresses asserting territorial claims. The attacks mirror tactics used by pro-Kremlin actors, who previously compromised Ukrainian media to spread false health claims about Ukraine's leader and replaced sports broadcasts with propaganda, reflecting an ongoing cycle of retaliatory cyber operations targeting broadcast platforms since the war began.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 11, 2022, pro-Ukrainian hacktivist group "hdr0" claimed responsibility for breaching multiple Russian state television channels, including Russia-24, Channel One Russia, and Russia-1. The attackers interrupted regular programming to broadcast anti-war content comparing Russia's invasion of Ukraine to the September 11 terrorist attacks in New York. The hacked transmission featured footage of Russian military strikes on Ukrainian cities alongside excerpts from Ukrainian President Volodymyr Zelensky and international leaders condemning Russia's actions. A superimposed message accused Moscow of being the "real owner" of terrorism, asserting that Russians were "finally seeing the truth." The group did not disclose their intrusion methods or the estimated viewership reach. This followed their previous operation in May 2022, when hackers replaced Vladimir Putin's Victory Day parade broadcast with an anti-war message referencing Ukrainian civilian casualties. The same group had targeted Crimean television infrastructure the prior week, airing a Zelensky address urging local populations to support potential Ukrainian military operations to reclaim the region. An August 2022 hack on Crimean television had similarly broadcasted Zelensky's speech declaring "Crimea is Ukrainian land."
Russian-aligned hackers conducted reciprocal attacks against Ukrainian media targets throughout 2022. In July, pro-Kremlin actors compromised two major Ukrainian radio stations to falsely announce Zelensky's hospitalization in critical condition. June saw hackers infiltrate Ukrainian streaming service Oll.tv, replacing a Ukraine-Wales football match with Russian propaganda content. Ukraine's national public broadcaster reported persistent distributed denial-of-service (DDoS) attacks since Russia's full-scale invasion began in February 2022, according to general producer Dmytro Khorkin. The television hacks formed part of an escalating pattern of cyber operations between both sides, with Russian channels previously compromised during the May Victory Day event and Ukrainian media facing repeated disruptions. Neither Russian authorities nor the affected broadcasters provided public statements regarding incident response or containment measures following the September 11 intrusion.