2022 cyberattacks on Romania

From HandWiki
Short description: Series of cyberattacks on Romanian government and websites

Beginning 29 April 2022, at 04:05 EEST, until 1 May, a series of multiple DDoS attacks were launched against several Romanian government, military, bank and mass media websites. Behind the attacks was the pro-Kremlin hacking group Killnet, who resorted to this in response to a declaration made by Florin Cîțu, the then-President of the Senate of Romania, that Romania would provide Ukraine with military aid. The Russia , who invaded the latter, publicly spoke against Western military support for Ukraine, stating that it would result in "lightning-fast retaliatory strikes".

Background

On 26 April 2022, the President of the Chamber of Deputies of Romania Marcel Ciolacu, Prime Minister Nicolae Ciucă and Minister of Foreign Affairs Bogdan Aurescu visited Kyiv, Ukraine , to meet with Ukrainian President Volodymyr Zelenskyy, Ukrainian Prime Minister Denys Shmyhal, and with the president of the Verkhovna Rada, Ruslan Stefanchuk. In the meeting, Romania reiterated its support for Ukraine and its European integration aspirations, as well as committing to active involvement in the reconstruction of the country.[1]

The meeting was planned since as early as 13 April, with the Romanian delegation initially consisting of the President of the Senate Florin Cîțu and the President of the Chamber of Deputies Marcel Ciolacu, both visiting Kyiv on 27 April at the invitation of Stefanchuk.[2] Prime Minister Ciucă justified the absence of Cîțu around the fact that there were two state visits separately planned, under condition by the safety measures imposed in Kyiv due to the 2022 Russian invasion of Ukraine.[3] Nevertheless, Florin Cîțu visited Kyiv by himself on 27 April 2022,[4] after which he stated that Romania should do more for Ukraine, supporting them with military equipment.[5]

Russia claimed that Western military support for Ukraine are "posing a threat to European security". Russian President Vladimir Putin stated that "if someone intends to intervene in the ongoing events [Russian invasion of Ukraine] from the outside, and create strategic threats for Russia that are unacceptable to us, they should know that our retaliatory strikes will be lightning-fast".[6]

Cyberattack

On 29 April 2022, at 04:05 EEST, the websites of the Ministry of National Defence (MApN), the Romanian Border Police, the Government of Romania, and of CFR Călători were taken down by a DDoS attack. According to the MApN, the cyberattack did not compromise the functioning of its website, but rather prevented user access to it. The government stated that IT specialists at the structures at governmental level are collaborating with experts from specialized institutions to restore access and identify the causes. In the meantime, CFR Călători issued alternative means of purchasing train tickets digitally.[7]

The Romanian Intelligence Service (SRI) stated that the hackers behind the cyberattack used network equipment from outside Romania.[8] The pro-Kremlin hacking group Killnet claimed the attacks through Telegram, stating that "the president of the Romanian Senate, Marcel Ciolacu issued a statement promising the Ukrainian authorities "maximum assistance" in supplying lethal weapons to Kyiv". Furthermore, they revealed a list of websites that it took down through the DDoS attack, where the website of OTP Bank (the Romanian division) was also listed.[9] The Directorate for Investigating Organized Crime and Terrorism (DIICOT) was notified in the case, and access to the websites was restored.[7][10]

At 19:30 EEST, another DDoS attack was launched, this time on the website of the Ciolacu-led Social Democratic Party (PSD), taking it down in a similar manner. In response, the party's IT department quickly took action and restored access to the website within 15 minutes.[10]

In retaliation, Romania's National Cybersecurity Directorate (DNSC) published a list of 266 IP addresses involved in the 29 April DDoS attacks to its official website. On 30 April, at approximatively 2:30 EEST, this website had also been taken down through a further DDoS attack by the pro-Kremlin hacking group, with user access restored by 8:30 EEST.[11] Later the same day, a further DDoS attack took down the website of the Romanian Police.[12]

The pro-Kremlin hacking group threatened to take down another 300 Romanian websites in a similar manner, including websites of stores, military, government, mass-media, banks, hospitals, educational institutions, political parties, etc. Some websites using Moldovan (.md) domains were also included in the list.[13]

On 1 May 2022, Killnet took down the websites of seven Romanian airports (including those located in Bucharest, Cluj-Napoca, etc.), as well as of the TAROM airline and several news media websites, including Digi24, among others.[14]

It has been suspected that a Romanian resident in the United Kingdom helped Killnet take down Romanian websites, translating content in Romanian language to Russian language. They were put in custody.[15] In retaliation, Killnet threatened to "destroy Romania, the United Kingdom and Moldova" if they are not released in 48 hours.[16]

Public reactions

Romania's Minister of Defence, Vasile Dîncu described the cyberattacks as "symbolic attacks".[17] The President of the Chamber of Deputies of Romania Marcel Ciolacu called his nominalization as "Senate president" by Killnet a mistake (as the presidency of the Senate was held by Florin Cîțu),[18] and stated that "if needed, Romania is ready both legally and morally to take this step [to supply Ukraine with military equipment]. At this moment [at the time of the first attacks], there is no decision".[19] In the meantime, the Romanian hacking group "Anonymous Romania" stated that it launched a counterattack against a Russian governmental website.[20]

Florin Cîțu, the president of the Senate, reacted as well: "First of all, I do not know what kind of hackers are those who do not know who the president of the Senate or the president of the Chamber of Deputies is [...]. Secondly, if we look at that [Killnet's] statement it is bizarre to have the picture of the President of the Chamber of Deputies, to have the correct name, but to mistake his position [...]. A simple search on Wikipedia and you would have found out who the president of the Senate is".[21]

See also

References

  1. ↑ "Imagini cu Marcel Ciolacu și Nicolae Ciucă la Kiev, cu Volodimir Zelenski. Vizita ar fi trebuit să aibă loc mâine, împreună cu Florin Cîțu" (in Romanian). https://www.antena3.ro/politica/imagini-marcel-ciolacu-nicolae-ciuca-kiev-637504.html. 
  2. ↑ "Marcel Ciolacu și Florin Cîțu merg la Kiev pe 27 aprilie" (in ro). https://www.digi24.ro/stiri/actualitate/politica/florin-citu-a-fost-invitat-sa-mearga-la-kiev-1904633. 
  3. ↑ "De ce nu a fost Florin Cîțu în Ucraina alături de Ciucă și Ciolacu. Explicația premierului" (in Romanian). https://www.antena3.ro/politica/nicolae-ciuca-florin-citu-lipsa-delegatie-ucraina-637562.html. 
  4. ↑ "Primele imagini cu Florin Cîțu în Ucraina: "Ceea ce am văzut deschide ochii lumii asupra acțiunilor Rusiei"" (in Romanian). https://www.antena3.ro/politica/florin-citu-ucraina-vizita-zelenski-637616.html. 
  5. ↑ "Marcel Ciolacu, despre trimiterea de arme în Ucraina: "Dacă este nevoie, România este pregătită să facă acest pas"" (in Romanian). https://www.antena3.ro/politica/marcel-ciolacu-trimitere-arme-ucraina-637828.html. 
  6. ↑ Reuters (2022-04-28). "Russia says pumping Ukraine with weapons is threat to European security" (in en). https://www.reuters.com/world/europe/russia-says-pumping-ukraine-with-weapons-is-threat-european-security-2022-04-28/. 
  7. ↑ 7.0 7.1 "Val de atacuri cibernetice în România. Vizate mai multe instituții, între care Guvernul și Ministerul Apărării / Atacurile, revendicate de hackerii pro-ruși de la Killnet" (in ro). https://economie.hotnews.ro/stiri-telecom-25525145-val-atacuri-cibernetice-romania-site-urile-guvernului-politiei-frontiera-cfr-calatori-ale-unei-banci-fost-afectate.htm. 
  8. ↑ "Atacurile cibernetice care au vizat Guvernul și MApN. SRI: Hackerii au folosit echipamente de rețea din afara României, profitând de vulnerabilități ale site-urilor" (in ro). https://www.hotnews.ro/stiri-esential-25525815-atacurile-cibernetice-care-vizat-guvernul-mapn-sri-hackerii-folosit-echipamente-retea-din-afara-romaniei-profitand-vulnerabilitati-ale-site-urilor.htm. 
  9. ↑ "Cine este gruparea de hackeri Killnet care a atacat site-urile Guvernului și Armatei României" (in ro). https://economie.hotnews.ro/stiri-telecom-25525633-cine-este-gruparea-hackeri-killnet-care-atacat-site-urile-guvernului-armatei-romaniei.htm. 
  10. ↑ 10.0 10.1 "Site-ul PSD inactiv după ce a fost atacat de hakerii ruși de la Killnet" (in Romanian). https://www.antena3.ro/politica/siteul-psd-inactiv-dupa-ce-a-fost-atacat-de-hakeri-637898.html. 
  11. ↑ "Continuă seria de atacuri de tip DDoS asupra site-urilor românești" (in Romanian). https://www.antena3.ro/actualitate/atacuri-ddos-site-romanesti-637930.html. 
  12. ↑ "UPDATE Site-ul Poliției Române a fost atacat cibernetic ”într-un mod similar ca celelalte instituții” (surse)/ Problema a fost remediată în aproximativ o oră de la anunțul Poliției/ Hackerii pro-ruși Killnet au amenințat că vor ataca peste 300 de entități din România" (in ro-RO). 2022-04-30. https://www.g4media.ro/update-site-ul-politiei-romane-a-fost-atacat-cibernetic-intr-un-mod-similar-ca-celelalte-institutii-surse-problema-a-fost-remediata-in-aproximativ-o-ora-de-la-anuntul-politiei-ha.html. 
  13. ↑ "Gruparea Killnet amenință că va ataca cibernetic alte aproape 300 de site-uri din România" (in ro). https://economie.hotnews.ro/stiri-telecom-25527684-gruparea-killnet-ameninta-ataca-cibernetic-alte-aproape-300-site-uri-din-romania.htm. 
  14. ↑ "Site-urile marilor aeroporturi din România nu funcționează. Hackerii ruși de la Killnet revendică atacul" (in ro). https://www.digi24.ro/stiri/economie/transporturi/site-urile-marilor-aeroporturi-din-romania-nu-functioneaza-hackerii-rusi-de-la-killnet-revendica-atacul-1924549. 
  15. ↑ "BREAKING Un român din Marea Britanie, suspectat că a ajutat gruparea de hackeri ruși Killnet pentru a ataca site-uri din România. Bode: „Cetăţeanul este în custodia autorităţilor şi este audiat”" (in ro-RO). 2022-05-03. https://www.g4media.ro/breaking-un-roman-din-marea-britanie-suspectat-ca-a-ajutat-gruparea-de-hackeri-rusi-killnet-pentru-a-ataca-site-uri-din-romania-bode-cetateanul-este-in-custodia-autoritatilor-si-este-audia.html. 
  16. ↑ "Killnet confirmă sprijinul românului Ioan Feher și amenință că va ”distruge România, Marea Britanie și Moldova” dacă nu va fi eliberat: ”Dacă susține Rusia, nu înseamnă că e un criminal”/ Este vizat Ministerul Sănătății" (in ro-RO). 2022-05-03. https://www.g4media.ro/killnet-confirma-sprijinul-romanului-ioan-feher-si-ameninta-ca-va-distruge-romania-marea-britanie-si-moldova-daca-nu-va-fi-eliberat-daca-sustine-rusia-nu-inseamna-ca-e-un.html. 
  17. ↑ "Reacția lui Vasile Dîncu după ce grupul pro-rus Killnet a atacat cibernetic România: „Este un atac simbolic”" (in ro). https://stirileprotv.ro/stiri/actualitate/reactia-lui-vasile-dincu-dupa-ce-grupul-pro-rus-killnet-a-atacat-cibernetic-romania-zeste-un-atac-simbolic.html. 
  18. ↑ "Ciolacu spune că hackerii ruși l-au confundat cu Cîțu: E o greșeală acolo, sunt și eu" (in ro). https://www.digi24.ro/stiri/actualitate/politica/ciolacu-spune-ca-hackerii-rusi-l-au-confundat-cu-citu-e-o-greseala-acolo-sunt-si-eu-1922315. 
  19. ↑ "Ce spune Marcel Ciolacu, președintele Camerei Deputaților, despre motivele invocate de hackerii Killnet: E o greșeală acolo" (in ro). https://www.zf.ro/zf-24/ce-spune-marcel-ciolacu-presedintele-camerei-deputatilor-despre-20782673. 
  20. ↑ "Grupul de hackeri Anonymous România susține că a atacat un site guvernamental din Rusia ca răspuns la acțiunile grupării ruse Killnet" (in ro-RO). 2022-04-29. https://www.g4media.ro/grupul-de-hackeri-anonymous-romania-sustine-ca-a-atacat-un-site-guvernamental-din-rusia-ca-raspuns-la-actiunile-gruparii-ruse-killnet.html. 
  21. ↑ "Cîțu, deranjat că a fost confundat cu Ciolacu: Ce hackeri sunt ăia care nu știu cine e șeful Senatului? Dădeai search pe Wikipedia" (in ro). https://www.digi24.ro/stiri/actualitate/politica/citu-deranjat-ca-a-fost-confundat-cu-ciolacu-ce-hackeri-sunt-aia-care-nu-stiu-cine-e-seful-senatului-dadeai-search-pe-wikipedia-1924847. 




Retrieved from "https://handwiki.org/wiki/index.php?title=2022_cyberattacks_on_Romania&oldid=2635303"