Cyber Incident Victim: Kommersant
Date:
Feb 2022
Location:
Russia
Summary
A hacktivist group disrupted multiple Russian state media outlets, including Kommersant, through website takeovers and denial-of-service attacks. The attackers defaced sites with messages urging citizens to oppose the invasion of Ukraine, citing risks of isolation and claiming internal dissent among journalists. These actions followed prior cyber operations against state-funded broadcasters and coincided with broader disruptions targeting government websites and telecommunications providers. The incidents occurred amid public calls by Ukrainian officials to mobilize digital volunteers for cyber defense efforts against the ongoing conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 28, 2022, the hacker group Anonymous claimed responsibility for cyberattacks targeting several Russian state-affiliated media organizations, including the newspaper Kommersant. The attacks disrupted the targeted websites and involved defacement campaigns protesting Russia’s invasion of Ukraine. Anonymous simultaneously compromised the websites of state news agencies TASS and RIA Novosti, newspapers Izvestiya and Kommersant, and Forbes Russia magazine. The group replaced content on these platforms with messages urging Russian citizens to oppose the war and reject participation in military actions. A specific message posted on Forbes Russia’s site, attributed to “concerned journalists of Russia,” criticized the conflict’s impact on civil liberties and economic stability, warning of a future resembling North Korea under continued aggression. The message acknowledged anticipated retaliation against dissenting journalists, including dismissals and arrests.
The incident formed part of a broader wave of cyber operations against Russian entities between February 24 and 28, 2022. Anonymous had previously targeted RT, the state-funded television channel, on February 24 and subsequently claimed attacks over the weekend that disrupted access to the Kremlin, Russian Defense Ministry, and Duma websites through distributed denial-of-service (DDoS) attacks. NetBlocks reported collateral disruptions affecting major Russian telecommunications providers—Rostelecom, MTS, Beeline, and Megafon—with citizens experiencing delays accessing their services. While the article did not specify Kommersant’s technical response, the defaced messages indicated an expectation of rapid content removal and internal disciplinary measures against staff. Ukraine’s Digital Transformation Minister concurrently announced the formation of an “IT army” to recruit cybersecurity personnel, reflecting the incident’s alignment with escalating cyber hostilities accompanying the physical invasion.