US critical infrastructure firms should reinforce their defenses and increase their vigilance following data-destroying cyberattacks in Ukraine prior to Russia’s attack on Ukraine, the FBI and US Cybersecurity and Infrastructure Security Agency said Saturday.
“Destructive malware can present a direct threat to an organization’s daily operations, impacting the availability of critical assets and data,” the US agencies said in a public advisory. “Further disruptive cyberattacks against organizations in Ukraine are likely to occur and may unintentionally spill over to organizations in other countries.”
The advisory includes several technical recommendations for organizations to keep malicious software from spreading on their systems.
US officials continue to say there are “no specific, credible” threats to the US homeland tied the conflict between Russia and Ukraine, but Saturday’s advisory is the latest warning from officials that what happens in cyberspace in Ukraine may not stay there.
Just hours before Russian forces began to attack Ukraine early Thursday, cybersecurity researchers said they had found a data-wiping hacking tool on hundreds of computers at Ukrainian government and financial organizations. The malicious code is designed to delete data from computers and render them inoperable — which has the potential to hobble organizations trying to stay online during a war.
Jean-Ian Boutin, head of threat research at anti-virus firm ESET, which responded to some of the destructive hacks, told CNN that he assumed that the malware was successfully deployed and the “affected machines were wiped.”
Two Ukrainian government contractors — one with a presence in Latvia and another with a presence in Lithuania, both NATO members — were hit with the malware, according to Broadcom’s cybersecurity unit Symantec. While the hack was targeted at Ukrainian assets, the potential for collateral damage in cyberspace during the war in Ukraine has been high on Western officials’ minds.
It’s unclear who was responsible for deploying the destructive malware. It was the second such destructive hack in as many months. A similar piece of malicious code appeared on the systems of some Ukrainian government agencies and nonprofit and technology organizations in January.
The White House has blamed Russia’s GRU military intelligence agency for a separate cyberattack on Ukrainian government websites on Feb. 15 that temporarily knocked the websites offline. Russia has denied the allegation.
In a statement Saturday, CISA Director Jen Easterly said her agency has been working “with our partners to identify and rapidly share information about malware that could threaten the operations of critical infrastructure here in the U.S.”
Three NATO members have announced they would send reinforcements to assist Ukraine in its battle against Russia.
The Czech Republic committed on Saturday to send a “shipment of weapons to Ukraine” worth over $8.5 million to a “place of Ukrainians choice.”
“The government has approved a shipment of weapons to Ukraine. We are sending machine guns, submachine guns, sniper rifles and pistols and their corresponding ammunition valued at CZK 188 million,” Czech Prime Minister Petr Fiala tweeted.
“We are doing everything we can to help Ukraine,” Fiala added.
The Netherlands on Saturday also said it would be providing Ukraine with more firepower.
“The Netherlands will supply Ukraine 200 anti-aircraft Stinger missiles. Other defence material already on its way,” the prime minister’s foreign affairs and defense adviser, Geoffrey van Leeuwen, tweeted.
Portuguese Prime Minister Antonio Costa said Friday that the country would be sending reinforcements to join Ukrainian soldiers on the ground to help secure their borders as this “is a war against the freedom of self-determination of a democratic country and therefore it is also a war against the freedom of self-determination and against democracy.”
Speaking at a televised news conference, the Portuguese prime minister went on to say, “there was an unanimity of all states, in view of the need to strengthen the NATO presence on the borders of Ukraine and in all the alliance countries that are close to the Ukraine region.”
“Portugal, in this sense, in addition to the forces that this year has assigned to the European command of NATO, decided to anticipate, from the second half to the first half, the mobilization and commitment of an infantry company that will act in Romania and that will be projected in the coming weeks,” Costa said.
“Several other countries at the moment are either anticipating or reinforcing or deciding to reinforce their participation with these countries [bordering Ukraine] in order to have a clear manifestation of unity and deterrence regarding Russia’s actions,” Costa added.
When asked for a specific number of that would be sent to support Ukraine, Costa said the infantry company would include 175 troopers.
Germany will deliver weapons to Ukraine in a major policy shift after resisting Kyiv’s previous calls for defensive weaponry.
In its coalition agreement, the German government had agreed on a restrictive arms export policy that does not allow any weapons deliveries to crisis regions. The delivery of such weapons also has historical connotations post-World War II.
“The Russian attack marks a change in times. It is our duty to support Ukraine as much as we can defending themselves against Putin’s invasion army. Therefore we will deliver 1,000 antitank weapons and 500 stinger missiles to our friends in Ukraine,” German Chancellor Olaf Scholz tweeted Saturday after a meeting with Polish Prime Minister Mateusz Morawiecki and Lithuania’s President Gitanas Nauseda.
Ukraine’s President Volodymyr Zelensky has hinted that there is consensus on SWIFT restrictions for Russia.
In a statement on Saturday evening, the Ukrainian leader said “we feel Ukraine has got the support of the whole civilized world. The practical result? SWIFT.”
He hailed this as an “important victory” and “means billions and billions of losses for Russia. It is a price for a sneaky invasion into our country.”
Earlier on Saturday, the Ukraine’s Foreign Minister Dmytro Kuleba said the “technical preparations” for Russia’s ban from the SWIFT system have begun.
“Official decision hasn’t been processed yet, but technical preparations for making and implementing that decision have begun,” Kuleba said in a statement posted on his official Facebook page.
Banning Russia from the SWIFT high-security network that connects thousands of financial institutions around the world would cut Russia’s banks off the global financial system. The move is considered the “nuclear option” of sanctions, because while it would be very damaging to the Russian economy, it would hurt other countries, too.
A number of European countries said on Friday and Saturday that they would support cutting Russia off from SWIFT. The UK, France, Italy, Hungary, Cyprus, Lithuania, Estonia, Latvia and Germany already indicated they would not block the sanction.
US President Joe Biden is seriously weighing whether to remove Russia from SWIFT, the high security network that connect thousands of financial institutions around the world, but has yet to make a final decision, multiple people familiar with his thinking say.
US President Joe Biden, in a taped interview that aired on Saturday, said one of his major strategic goals as Russia invades Ukraine is to keep NATO and the European Union united.
“My goal from the very beginning was to make sure that I kept all of NATO and the European Union on the same page. Because the one thing I think Putin thought he could do was split NATO, creating a great aperture for him to be able to walk through. And that hasn’t happened,” Biden told podcaster and commentator Brian Tyler Cohen.
Biden also predicted that Russia would pay a heavy price in both the long and short term for its invasion of Ukraine, adding that the conflict is bringing Europe and NATO closer together.
“He’s producing the exact opposite effect that he intended,” Biden said of Putin.
When asked about sanctions, Biden argued that he believes it’s one of the only ways to penalize Russia without risking war on a global scale.
“You have two options. Start a third world war, go to war with Russia, physically. Or two, make sure that a country that acts so contrary to international law pays a price for having done it,” Biden said.
He also pointed to the defense weaponry and economic assistance the US is providing Ukraine as the country continues to fend off the Russian advance.
Germany has said it will support restricting Russia from SWIFT after days of debate among European Union members as to whether to include the global interbank payment system in its next round of sanctions.
German Foreign Minister Annalena Baerbock and German Economics Minister Robert Habeck in a joint tweet on Saturday said they are “under high pressure to avoid collateral damage when decoupling (Russia) from SWIFT so it will hit the right people. What we need is a targeted and functional constraint of SWIFT.”
More background: US President Joe Biden is seriously weighing whether to publicly support expelling Russia from SWIFT, but has yet to make a final decision, according to multiple people familiar with his thinking say.
The decision to trigger the action has always been contingent on sign-off by the European Union, which has been split in a contentious debate for weeks over the action, ultimately choosing not to go forward this week.
Ukraine appealed for Russia to be removed from SWIFT after President Vladimir Putin ordered an invasion on Thursday. The call from Kyiv was backed by numerous countries, including Lithuania, Estonia, Latvia and the United Kingdom.
Hungary will not block sanctions against Russia, including on SWIFT, according to its foreign minister. Italy has also signaled that it would support taking measures to expel Russia from the SWIFT global payment system as part of further EU sanctions.
CNN’s Kaitlan Collins, Phil Mattingly, and Kevin Liptak contributed reporting to this post.
A Russian thermobaric multiple rockets launcher has been spotted by CNN team south of Belgorod, Russia, near the Ukrainian border early Saturday afternoon.
The TOS-1 or TOS-1A Multiple Rocket Launcher seen by CNN is capable of launching rockets with thermobaric warheads.
There is no evidence that thermobaric weapons have been used in the conflict in Ukraine.
These types of weapons do not use conventional ammunition. Instead, they are filled with high-temperature, high-pressure explosive. They are sometimes called “vacuum bombs” because they suck in the oxygen from the surrounding air to generate a powerful explosion and a large pressure wave that can have enormous destructive effects.
Thermobaric weapons have been used in Chechnya, with horrifying consequences, according to Human Rights Watch. Their use has been condemned by number of non-governmental organizations.
Dramatic video out of Bakhmach, Ukraine, shows Ukrainians citizens standing in front of Russian tanks, attempting to stop them from moving forward.
In the video, tanks can be seen driving on roads in Bakhmach, which is just over 110 miles northeast of the Ukrainian capital of Kyiv.
CNN has confirmed the authenticity and location of the video.
“They are throwing their bicycles underneath the Russian tanks,” a voice on the video says.
Then a man steps in front of one and jumps on top. The tank continues to roll forward until the man jumps off, puts his hands on the tank and tries to hold it back. The tank stops suddenly, and the man moves in front, kneeling in front to obstruct its path.
The tank stops for just a moment longer as bystanders appear to pull the man to the side.
“People are begging the tanks to stop,” the voice on the video says.
It starts to move again, but is again confronted by another Ukrainian standing in front of it.
“They are just throwing themselves under the wheels,” the voice on the video says, as other bystanders are seen gesturing and yelling toward the tanks.
The legs of the individual that stood in front of the tank are seen airborne in the video; they appeared to have jumped on the tank again.
Before the video cuts off, the tank spits out a black cloud of exhaust and continues moving forward.
Twitter said Saturday it is being restricted inside Russia and is working to address the issue.
“We’re aware that Twitter is being restricted for some people in Russia and are working to keep our service safe and accessible,” the company said on its support account.
Twitter did not immediately comment on whether it is in touch with the Russian government about this problem or whether any action would be taken by Russia.