Russian Federation

Summary

The Russian Foreign Ministry experienced a severe cyber attack described as unprecedented in scale, targeting its official website and portal infrastructure with a large-scale distributed denial-of-service (DDoS) attack originating from abroad. The incident coincided with the BRICS summit hosted by Russia, an event aimed at bolstering Moscow's international standing amid Western sanctions, though the ministry noted it regularly faces similar disruptive attempts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 23, 2024, the Russian Foreign Ministry experienced a significant cyber attack targeting its digital infrastructure during the BRICS summit hosted in Kazan. Ministry spokeswoman Maria Zakharova publicly disclosed the incident, characterizing it as a large-scale distributed denial-of-service (DDoS) attack originating from abroad. The assault began in the morning and specifically targeted the ministry's official website and portal. Zakharova noted that while the Foreign Ministry regularly faces such attacks, this incident was distinguished by its unprecedented scale, though no specific metrics quantifying the attack volume were provided. The timing coincided with the high-profile BRICS summit (October 22-24), an event Russia aimed to leverage to demonstrate its geopolitical relevance amid Western sanctions. No immediate details were released regarding the duration of service disruptions, specific systems affected beyond the public-facing web assets, or technical methods used to execute the DDoS.

The incident occurred during a strategically sensitive period, as the BRICS gathering represented a major diplomatic effort by Russia to reinforce international alliances. Zakharova’s announcement framed the attack as externally sourced but did not attribute responsibility to any specific actor or nation. No information was disclosed regarding defensive measures taken by the ministry to mitigate the attack, nor were there statements about data compromise or secondary impacts on internal operations. The public disclosure emphasized the scale of the disruption but did not elaborate on operational consequences beyond the targeting of web infrastructure. The absence of reported collateral damage to summit-related activities or other government functions suggested primary impacts were confined to the Foreign Ministry’s public digital services during the attack window.

Sources

Sources available to members: 1 source.