On April 27, Microsoft published a 21-page special report,
An overview of Russia’s cyberattack activity in Ukraine. According to the report, it was prepared by Microsoft’s Digital Security Unit, leveraging the intelligence and findings of the Microsoft Threat Intelligence Center (MSTIC) and data analysis of Microsoft’s AI for Good Research Lab,
the team I joined last November. I am glad the lab could contribute.
Tom Burt summarized the report the same day on Microsoft On the Issues in
The hybrid war in Ukraine. On April 28, Der Spiegel covered it under the headline
“Microsoft zählt bisher 237 Hackerangriffe auf die Ukraine” (Microsoft counts 237 hacker attacks on Ukraine so far), noting that hardly anyone has as deep an insight into Ukraine’s IT landscape as Microsoft.
The same day, I shared the Spiegel article
on X, together with the underlying report:
In this post I stay with what these public sources say, and add what stood out to me as someone who works with data.
What the report found
According to Microsoft, at least six Russia-aligned nation-state actors launched more than 237 operations against Ukraine, starting just before the invasion. Between February 23 and April 8, nearly 40 destructive attacks permanently destroyed files on hundreds of systems across dozens of organizations. 32% of these destructive incidents hit Ukrainian government organizations at the national, regional, and city level, and more than 40% targeted organizations in critical infrastructure sectors.
The report traces preparations back to as early as March 2021. Tom Burt’s summary also states plainly that the attacks Microsoft observed are likely only a fraction of the activity targeting Ukraine.
Two kinds of data on one timeline
The part I keep thinking about is methodological. The report compares Microsoft’s security signals with open-source data on kinetic attacks and finds that high concentrations of malicious network activity frequently overlapped with high-intensity fighting during the first six-plus weeks of the invasion. Its timeline shows several cases where computer network operations and military operations seemed to work in tandem against the same targets.
The report is careful about what this means. It notes that it is unclear whether there was coordination, central tasking, or merely a shared understanding of priorities, and that cyberattacks immediately preceding a military attack have been rare from Microsoft’s perspective. Der Spiegel picked up exactly this point: the report does not list attacks that were not already publicly known, but it shows whether and how often the hacks line up with attacks on the battlefield.
For me, this is a good example of what careful data analysis can and cannot say. Two very different sources, security telemetry and public records of military events, placed on the same map and timeline, reveal a pattern that neither shows alone. Whether that pattern means coordination is a separate question, and the report keeps the two apart.
Citing public Russian Defense Ministry documents, the report quotes the Russian military’s definition of information warfare as “confrontation in the information space with the goal of causing damage to critical information systems, undermining political, economic, and social systems, psychologically manipulating the public to destabilize the state and coerce the state to make decisions to benefit the adversary party”.
Two examples in the report show what that looks like. On March 1, suspected Russian actors attacked a major broadcasting company, on the same day the Russian military announced its intention to destroy Ukrainian “disinformation” targets and directed a missile strike against a TV tower in Kyiv. In another case, an actor Microsoft tracks as DEV-0586 sent emails posing as a resident of besieged Mariupol, blaming the Ukrainian government for abandoning its citizens. The emails carried no malicious links or attachments, which suggests their purpose was influence, and Microsoft writes that it was the first time it had observed such intense anti-government messaging in email.
The network itself is part of this. On Sunday, NetBlocks reported that connectivity on Skynet, a local internet provider in Russian-occupied Kherson, had been rerouted via Russia’s Rostelecom instead of Ukrainian infrastructure. On Tuesday, I traced the route myself from Frankfurt to Skynet, and
the visual traceroute showed the detour via Russia. I wrote up
how to run such a trace.
Cyberattacks go after systems, and disinformation goes after what people believe. In these examples, both aim at the same thing: people’s access to reliable information and their trust in it. I want to understand that overlap better.
Read the sources
