As the Russian tanks were rolling into Ukraine, hacktivist groups were declaring cyber-war on Russia. 

The hacktivist collective “Anonymous” made an announcement on its Twitter account.  The message read: “The Anonymous collective is officially in cyber-war against the Russian government. #Anonymous #Ukraine.” 

The cyber-war is “on”. 

 And Anonymous is taking credit for disabling the Russian government, news, and corporate websites. As well as, for leaking data from entities such as Roskomnadzor, the censor bureau of Russian media.

The group’s Twitter now has 7.9 million followers. And half a million of them signed on since the cyber-war was declared.

Another hacktivist group the Cyber Partisans hacked a Belarusian railway system to disrupt troop and weapon buildup during the early stages of the invasion.

Mykhailo Fedorov, Ukraine’s vice prime minister and Minister of Digital Transformation, gathered a cyber army on Twitter. They count some 310,000 digital volunteers who signed up for the "IT Army of Ukraine."   

Hacktivist groups attack verified 

It is believed that many of these hacks are the work of Anonymous. And Anonymous' claims coincide with the timeline of breaches and broadcast disruptions.

Anonymous is an international cyber hacker gang known for its high-profile online attacks. They attack entities they disagree with. They hit governments, including the US, Israel, and Uganda. And have also hacked PayPal, Sony, Mastercard, the Church of Scientology, and Westboro Baptist Church.

Their declaration of cyberwar with Russia was the first step in a 24/7 assault on the Kremlin.

According to Jeremiah Fowler, co-founder of the cybersecurity company Security Discovery, Anonymous is delivering what they promised. Fowler leads a group of researchers at the web company Website Planet who verify the group's claims.

"Anonymous has proven to be a very capable group that has penetrated some high value targets, records and databases in the Russian Federation," Fowler claimed in a report summarizing the findings.  

Hacked databases, websites and TV broadcasts

The verification report is subtitled, “Researchers See Russian Databases Targeted with Files Erased and Folders Renamed with Pro Ukrainian Messages.”

The researchers analyzed 100 Russian databases. And found, 92 had been compromised.

The websites belonged to retailers, Russian internet carriers, and intergovernmental agencies. This includes “Green Dot” (Зелёная точка) that which provides internet and digital TV services to 18 Russian cities. And contains 2.2 million records. 

Also impacted was the Commonwealth of Independent States (CIS). The CIS center coordinates information. And regulatory practices on trade, finance, lawmaking, and security between Russian affiliated CIS Member States.

Fowler noted that ciscenter.org had been hacked.

“Many CIS files were erased, hundreds of folders were renamed to "putin_stop_this_war" and email addresses and administrative credentials were exposed,” said Fowler. He claimed the attack looked like 2020's malicious "MeowBot" attacks. They "had no purpose except for a malicious script that wiped out data and renamed all the files."

The report describes a widespread disruption of Russian online data. Another hacked database contained more than 270,000 names and email addresses.

“Among the sampling of cloud storage databases, we discovered a very large number of secret keys and referenced mail.ru, one of the biggest email providers in Russia as the host server.” 

Other databases contained security information, internal passwords and a "very large number" of secret keys, which unlocked encrypted data.

"My partner at Security Discovery, Bob Diachenko, actually captured a state news live feed from a website and filmed the screen, so we were able to validate that they had hacked at least one live feed [with] a pro-Ukrainian message in Russian." Fowler added.

Denial of Service (DoS) attacks aim to disable websites by flooding them with traffic. These are an easy effective way to shut down a site. And many Russian sites are experiencing constant DoS hack attacks. Many Russian affiliated websites have been knocked offline at various points since the Russian invasion of Ukraine.

A new kind of war

Marianne Bailey, a cybersecurity partner at the consulting firm Guidehouse and former cybersecurity executive with the U.S. National Security Agency. Cyber activism is a low-cost way for them to influence governmental and corporate actions, she said.

"It is protesting in the 21st century," said Bailey.  

This is a new kind of war. First the hacktivist groups declared cyber-war. Then Ukraine directly enlisted an international cyber army to aid the embattled country. And all indications are that the hackers are attacking Russia on all fronts.