Federal State Statistics Service

Summary

Attackers compromised a visitor‑tracking widget used by several Russian government agencies, allowing them to replace content and block access to the affected sites. The Federal State Statistics Service was among the organizations whose websites displayed incorrect material and became temporarily unavailable before the breach was contained and the sites restored within a short period.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On Tuesday evening, unknown attackers compromised a statistics widget used by multiple Russian federal agencies to track visitor numbers, gaining the ability to alter content on the associated websites. The breach was discovered after the attackers posted their own material and blocked access to the sites, affecting the Federal State Statistics Service along with several other federal agencies. The intrusion manifested as incorrect information being displayed on the compromised pages while legitimate access was prevented.

Officials said the incident was promptly localized, and the Russian Digital Development Ministry reported that the affected websites were restored to normal operation within an hour of the breach. The press service of the Russian Ministry of Economic Development explained that direct compromise of the sites is difficult, prompting attackers to exploit external services such as the widget to demonstrate false content. In response, the Federal Security Service's National Coordination Center for Computer Incidents issued warnings to Russian organizations, urging them to adopt protective measures and sharing guidance to defend against similar supply‑chain threats. The ministry also noted that the response was coordinated across the impacted agencies to minimize disruption.

The episode occurred amid heightened cyber tensions, as the Russian government had previously published a list of more than 17,000 IP addresses allegedly involved in DDoS attacks against its networks, and noted ongoing reciprocal targeting between Ukrainian and Russian actors. Ukrainian Vice Prime Minister Mykhailo Fedorov had announced the formation of an 'IT army' to support Kyiv's cyber front, a move described as stemming from a massive wave of hybrid warfare and linked to recruitment efforts by Ukraine's Defense Ministry. Earlier on Monday, the Russian Digital Development Ministry denied reports that Russia planned to disconnect from the global internet, emphasizing preparations for various scenarios to maintain accessibility of Russian online resources amid continual foreign cyberattacks. These statements underscored the broader context in which the supply‑chain compromise of the statistics widget took place.

Sources

Sources available to members: 1 source.