Ukrainian intelligence operatives conducted a major cyberattack against Russian authorities in occupied Crimea, downloading 100 terabytes of classified data before destroying the original files, according to RBK-Ukraine citing sources in Ukrainian intelligence.
The multi-day operation targeted electronic document management systems used by Russian-controlled government institutions across the peninsula, according to the report. Cyber specialists from Ukraine’s Main Intelligence Directorate (GUR) penetrated digital cabinets of Crimean Russian leadership and gained access to several key systems.
“Dialog” and “Delo” electronic document management systems were compromised, along with accounting systems “1C:Document Flow,” Directum, and “ATLAS,” the report said. The systems handle legally significant electronic document flow for government agencies, budget institutions, state committees, and municipal bodies including the apparatus of the Russian Council of Ministers of Crimea.
The downloaded data included documents marked “secret” containing information about Russian military facilities and logistical supply routes for Russian forces on the peninsula, RBK-Ukraine reported. After copying the information, GUR cyber specialists destroyed all data stored on servers of regional and district government institutions, ministries, and departments of Russian authorities in Crimea.
A DDoS attack reportedly paralyzed information systems and network infrastructure in Crimea during the operation. Russian media made only brief mention of the cyberattack, with the press service of the Russia-controlled Ministry of Information reporting “a massive DDoS attack on major fixed-line communication operators.”
“Some services may be periodically unavailable to subscribers,” the ministry said, without specifying the scale of the problem or the number of affected operators.
Russian State Duma officials expressed concern but provided no details about compromised information.
Ukrainian intelligence sources indicated the obtained data contains significant intelligence value.
“So much data was downloaded there that we will soon learn many sensations about the activities and crimes of Russian occupiers in Ukrainian Crimea,” a Ukrainian intelligence officer told RBK-Ukraine.
The breach also provided access to officials responsible for “patriotic education” and organizing exhibitions and street actions aimed at discrediting Ukraine, according to Armed Forces of Ukraine officer and political scientist Andriy Tkachuk writing for Ukrinform.
“Evidence was obtained of coordination between local administrations and the ‘representation of the Russian Foreign Ministry in Simferopol,’” Tkachuk wrote. “The Russian Foreign Ministry distributes narratives, ‘republican ministries’ transmit them to districts, and schools and universities become retransmitters of Kremlin lies.”
A military expert from Crimea, a former Ukrainian officer and reserve lieutenant colonel of the Armed Forces of Ukraine, told Krym.Realii on condition of anonymi that “Russian authorities in Crimea during the war closely interact with Russian military forces. This means that GUR will have a set of correspondence from which many interesting intelligence data can be ‘extracted,’.”
“All civilian administrations of Crimean districts and cities, as well as ministries and departments, issue secret orders and other documents related to territorial defense and more. This is not just important information, but the most important, like the mentioned logistical supply routes for troops,” he added.