Ukraine's Great Cyber Heist

""Cyberspace espionage is nothing new," JP Castellanos, Director of Threat Intelligence at Binary Defense and a former cyber operator at U.S. Central Command, tells The Cipher Brief. "However, this is the first time it has been publicly reported that a country such as Ukraine is taking the offensive. These recent operations yielded troves of classified information, from submarine schematics and crew rosters to aircraft design documents and staff records, suggesting that Kyiv is expanding the war into cyberspace to erode Moscow's military advantage.""

"The most consequential public instance of this trend came in early August, when Ukraine's military intelligence agency (HUR) published documents it says were extracted from Russian naval systems tied to the newly commissioned Project 955A submarine Knyaz Pozharsky. According to reporting based on HUR's release, the cache included technical diagrams, crew manifests, and operational procedures - material that, if authentic, could diminish the survivability and operational security of a platform that sits at the apex of Moscow's sea-based nuclear deterrent."

"But Emily Otto, an Alperovitch Fellow at the Johns Hopkins School of Advanced International Studies, warns that some of the press coverage of what HUR was able to directly access, may be exaggerated. "It's highly unlikely the Ukrainians reached directly into a submarine's network," she said. "Far more plausible is that the data originated from external systems, such as contractors, shipbuilders, or onshore networks tied to deployments and crew management. To penetrate hardened systems, hackers often pivot through softer targets in the supply chain or"

Ukraine's cyber operations reportedly extracted classified Russian military documents, including submarine schematics, crew manifests, aircraft design files, and staff records. The leak related to Project 955A submarine Knyaz Pozharsky and included technical diagrams, crew manifests, and operational procedures that could reduce survivability and operational security of a sea-based nuclear platform. The disclosures signal intent to target both symbolic and substantive elements of Russia's nuclear posture. Analysts caution that claims of direct intrusion into hardened submarine networks are unlikely. More plausible origins include contractors, shipbuilders, or onshore systems, with attackers pivoting through supply-chain or peripheral targets.

Read at The Cipher Brief