The international hacker group Anonymous has bombarded Russia with cyberattacks ever since it declared “cyber war” on Russian President Vladimir Putin in retaliation for the invasion of Ukraine. Some individuals and groups operating under the umbrella of Anonymous talked to BBC cybersecurity reporter Joe Tidy about their goals, tactics and ways of working together.
Among the cyber attacks carried out by Anonymous since the beginning of the Ukraine war, a viral video directed to Russian television draws attention.
The short video features several channels on Russian cable TV interrupted by footage of the bombings in Ukraine, and Russian soldiers talking about the horrors of war.
The video went viral on February 26 and was shared by the largest anonymous social media accounts with millions of followers.
“Hacking collective #Anonymous hacked Russian broadcasting services Wink and Ivi (like Netflix) and live TV channels Russia 24, Channel One, Moscow 24 to broadcast war footage from Ukraine,” one post said.
The video was watched millions of times in a short time.
Anonymous claimed that there were several other cyberattacks, including the takedown of Russian websites and the theft of secret government data, but this TV attack was the most popular among pro-Ukrainian groups.
That’s why I was surprised to learn that the people behind the major Anonymous Twitter accounts did not know who carried out the hack, nor could they even confirm that it did.
They said that besides cyber warfare, information warfare is also being waged, which is why they published the video.
Later, I found a smaller group of hackers, Anonymous, who said they were doing this TV hack, and another group of hackers who said they were playing the Ukrainian national anthem on Russian channels.
One of the group said in broken English:
“Since we declared cyber ‘war’ on the Kremlin, there have been two cyberattacks on Kremlin propaganda channels that have interrupted the main broadcast. We have posted images and videos of the current situation in Ukraine.”
What is Anonymous?
- The cyber activist collective first appeared on the 4chan website in 2003.
- The group has no representative and no leadership, its motto is “We are the legion”
- Anyone can claim to be part of the group and hack for any reason they want, but they often target people they accuse of abusing power.
- Its symbols are the mask made famous in V for Vendetta, Alan Moore’s graphic novel about an anarchist revolutionary overthrowing a fascist government.
- The group spans multiple social media groups with 15.5 million followers on Twitter alone.
The hacker I spoke with described how their team used the “broadcast signal intrusion” technique to gain control of the channel transmit signal for about 12 minutes. He said that in the second attempt, they had Russian television channels play the Ukrainian national anthem.
The group also said that the original source of the first viral video was a young woman named Eliza, who lives in the US and has a Russian father:
“My dad was watching Russian TV on Apple TV and he saw the footage of the war in Ukraine on the air. He called me at the time of the incident and said, ‘Oh my God, they’re showing the truth!’ He said. So I asked him to record the broadcast, and I posted the video on the Internet.”
The Anonymous member I spoke to offered two more videos shot by the Russian public as proof that the hacking actually happened.
When I said it was a serious cybercrime, he agreed, but said he had good reason, saying “innocent Ukrainians are being murdered”.
“If nothing is done to restore peace in Ukraine, we will intensify attacks on the Kremlin,” Anonymous members said.
The Russian company Rostelecom, which manages the hacked services, did not respond to requests for comment.
Lisa Forte, partner at cybersecurity firm Red Goat, says most attacks against Russia are “pretty simple”.
“Hackers on both sides for and against Ukraine mostly use DDoS attacks where the server is suffocated with a series of requests directed towards a server. These are relatively simple attacks and take websites temporarily offline. But the TV hack is incredibly inventive and if Russian TV network security is in the UK If it’s like that, it’s pretty hard to achieve.”
Anonymous also carried out attacks that crashed websites. Lisa says this is one step away from a DDoS attack and involves taking control behind a website to change the content displayed.
“It all depends on the security of the website, but in the crudest form, hackers either steal the administrator’s username and password or try the obvious information and get into the website that way.”
Worries are rising
Cybersecurity experts have become increasingly concerned about the explosion of cyber activism since the Ukraine war.
“Despite the good intentions of those involved, these actions carry risks,” says Emily Taylor of the Cyber Policy Journal.
“Cyber activism is blurring the boundaries in an already intensely contentious and chaotic environment and can lead to escalation or someone can actually accidentally harm a critical aspect of civic life.”
Anyone can claim to be a part of Anonymous as there is no central leadership or membership.
A Ukrainian technology entrepreneur named Roman, who heads a hacker group called Stand for Ukraine, says he and his team briefly crashed the website of Russian state news agency Tass with an anti-Putin poster and added the group’s logo, even though he is not an Anonymous member.
From his sixth-floor apartment in central Kiev, Roman says he’s been trying to launch cyberattacks and create websites, Android apps and Telegram bots to aid his country’s war effort.
“I’m ready to be recruited for Ukraine, but right now I use my skills better on the computer. With two laptops at home, I coordinate this communications technology resistance. Sometimes I see rockets in the sky. It’s scary.”
When asked whether the group’s actions were moral, he says the war has changed moral boundaries:
“Until there is a threat to you or a relative, these things are illegal and wrong. It’s a method of survival.”
Another group joining forces with Anonymous is the UK-based Squad 303. It has set up a website designed to send truth-telling messages about the war to random phone numbers in Russia. They claim that more than 20 million SMS and WhatsApp messages have been sent so far.
Two Anonymous groups I spoke to said this was the most effective thing the collective has ever done in combat.
“Hacking is finding a way to get around an obstacle or creating a way to do something better. It’s not always about breaking systems,” says Anon2World.
Jan Zumbach claims his group is “non-violent” and its aim is to win the information war against Russia.
When asked how Squad 303’s illegal activity can be justified, Jan Zumbach replied that they did not steal or share any proprietary information and were simply trying to talk to the Russians.
It is not known how many hackers attacked on behalf of Anonymous, but the Ukrainian government says more than 400,000 volunteers have applied to work for what it calls the “Ukrainian IT Army”.
Hacker groups in Russia also carry out attacks on Ukraine, but they appear to be on a smaller scale.
The BBC recently interviewed a small group that hacks Ukrainian websites and steals data. A Telegram group believed to be coordinating attacks on Ukraine also has 30,000 members, mostly from Russia and Belarus.
On Wednesday, a manipulated video of President Zelensky was posted on the website of the Ukrainian 24 TV channel, following an obvious hack.
Since January, there have been three major waves of coordinated DDoS attacks against Ukraine affecting the online services of government and financial institutions.
On Tuesday, Ukraine’s Department of Cyber Defense also confirmed that it is assessing the impact of a “wipe” attack that wiped data from a small number of infected computer systems in the country, the third attack on the country in recent weeks.
These “wiping” attacks are the most sophisticated since the invasion, and many cyber experts say they go beyond the capabilities of civilian computer hackers.
But in the current environment, it’s hard to know exactly who is behind any cyberattack.
“The Achilles heel of Anonymous is that anyone can claim to be Anonymous, including state actors working against what we’re fighting for,” says Anon2World.
“With the current rise in popularity, it is almost certain that there will be obvious backlash from a government agency. When it comes to increasing chaos, we are used to chaos, especially online chaos.”