Cyber Incident Victim: RIA Novosti
Date:
Feb 2022
Location:
Russia
Summary
A pro-Kremlin state media outlet was targeted by cyberattacks claimed by the hacker group Anonymous, resulting in website disruptions and defacement with messages urging Russians to oppose the invasion of Ukraine. The incidents included denial-of-service attacks and unauthorized content placement on multiple Russian media platforms, alongside broader disruptions affecting government websites and telecommunications operators. The group's actions aimed to protest military aggression and encourage dissent, with defaced messages purportedly from concerned journalists expressing resistance to censorship and the conflict.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 28, 2022, the hacker collective Anonymous claimed responsibility for disrupting the operations of multiple Russian state-affiliated media websites in response to Russia’s invasion of Ukraine. The group targeted state news agencies RIA Novosti and TASS, alongside newspapers Kommersant and Izvestiya and Forbes Russia magazine. Anonymous defaced these platforms with messages urging Russian citizens to oppose the war and reject participation as combatants. A statement on Forbes Russia’s website, attributed to "concerned journalists of Russia," criticized the conflict’s impact on living standards and declared, "It isn’t our war, let’s end it!" The message anticipated retaliation against dissenting journalists, including dismissals and arrests. This incident followed Anonymous’s February 24 cyberattack on RT, a state-funded television channel, and preceded disruptions to Russian government websites over the subsequent weekend.
The attacks expanded to include denial-of-service (DDOS) campaigns against the Kremlin, the Russian Ministry of Defence, and the Duma’s websites, as publicly claimed by Anonymous via Twitter. NetBlocks reported access delays affecting major Russian telecommunications providers—Rostelecom, MTS, Beeline, and Megafon—on February 26, though no group claimed responsibility for these disruptions. Concurrently, Ukraine’s Minister of Digital Transformation, Mykhailo Fedorov, announced the formation of an "IT army" on February 26 to recruit cybersecurity personnel for operational tasks. The cumulative disruptions highlighted coordinated efforts to impair Russian state media and critical infrastructure, while Ukraine sought to bolster its cyber defense and offensive capabilities amid the invasion.