1. Home
  2. Procedures
  3. Continuation of the Russo-Ukrainian War: Armed Aggression in the Donbas (2014–2015)
  4. Cyber Operations

Cyber Operations

in the campaign “Continuation of the Russo-Ukrainian War: Armed Aggression in the Donbas (2014–2015)”

The use of a hacker group linked to the security services to compromise Ukrainian artillerymen's software: "the filename 'Попр-Д30.apk' was linked to a legitimate application which was initially developed domestically within Ukraine by an officer of the 55th Artillery Brigade named Yaroslav Sherstuk," and "in-depth reverse engineering revealed the APK contained an Android variant of X-Agent" - an implant whose exclusive operator is FANCY BEAR[1]. The same toolkit was used in cyberattacks on the Ukrainian power grid in the winters of 2015 and 2016[2][3].

ID: C0101.T0136
Technique:  Cyber Operations
Campaign:  Continuation of the Russo-Ukrainian War: Armed Aggression in the Donbas (2014–2015)
Start: April 2014
End: February 2015
Contributors: decolonial.ist project

References

  1. Meyers A. Danger Close: Fancy Bear Tracking of Ukrainian Field Artillery Units. 2016. – CrowdStrike.
  2. MITRE ATT&CK®. 2015 Ukraine Electric Power Attack | MITRE ATT&CK®. 2023.
  1. MITRE ATT&CK®. 2016 Ukraine Electric Power Attack | MITRE ATT&CK®. 2023.