We have seen Zarya discuss critical infrastructure hacks as well as confirm control over ICS. In their own words from November 2022:
https://zetter.substack.com/p/leaked-pentagon-document-claims-russian
This is not a shift in their actions as Radware states. This is only the awareness of their full capabilities
Russian hackers gained access to several factories, power plants and providers in Ukraine. They also penetrated the networks of critical infrastructure facilities and can affect their operation, but the main goal of such attacks is to gain a foothold in the enterprise information network in order to receive information for as long as possible, and not to disable the facility. Hesh, the founder of the Zarya hacker group, which is known primarily for hacking the SBU, told Gazeta.Ru about this. According to Hesh, Russian hackers do not seek to sow destruction and chaos. Read more about the real goals of hacker groups and defectors in an interview with Gazeta.Ru.
Who is Hash
- How can I contact you?
“I introduce myself as Hesh. For their just hashes.
How long have you been hacking?
- Approximately eight years. I started with the same thing that many of my colleagues did: I studied programming languages.
– I know that you used to participate in KillNet. Why did you leave this group?
- I decided to become an independent link in this war, to pursue my own policy and not depend on anyone.
offensive potential
- First of all, Zarya is known for hacking and a series of SBU data leaks . In the meantime, you must have had other attacks as well. Which ones do you consider the most outstanding?
– Hacking of the largest operator in Western Ukraine UARNet, which hosts mainly state institutions: institutes, chambers, councils, and so on. Joint hacking of the SBU with Beregini and XakNet, of course. Hacking the leading information-analytical and expert center of Ukraine in the field of external and internal markets for goods and services “Derzhzovnishhinform”.
- Has everything interesting from the documents of the SBU already been published, or are there still some trumps left?
“Of course there are, there are a lot of them. But if we haven’t written about it yet, it means that for various reasons we can’t do it yet. I can only say that we come across a lot of official documents about current employees of the SBU.
– What, besides reputational damage, do the victims of your attacks receive?
– The essence of our attacks is that we are aimed exclusively at state and strategic facilities. Accordingly, not only reputation “leaks” from the target, but also internal documents: their plans and projects, mail, correspondence, lists of employees.
As a result of our attacks, Ukraine has to revise its strategy, change plans, reassign people, and so on. The data that we have is enough to bankrupt half of the state institutions and force all the SBU to drastically change their place of deployment and employees.
- From hand to hand – no. Contrary to prejudices and stereotypes, we don’t go to the Kremlin with disks full of information. At least for the reason that above all we value our anonymity and security.
Everything that we consider necessary to publish, we post on our official Telegram channel, which, I think, is also subscribed to by representatives of law enforcement agencies .
– How would you rate the level of information security of Ukrainian organizations?
– Depending on the purpose, the level of security varies greatly. Of course, I would like to laugh at them and say that everything is very bad there, the employees are fools, and the systems are expired pirate slag that has not been updated since the Maidan. But this is not always the case. At the same time, I cannot overestimate their safety.
– Cybersecurity experts often say that a hacker attack on a factory or power plant can lead to a man-made disaster. How realistic is this from your point of view?
- Is quite real.
Just as we can drastically cut off the Internet from half of Kiev , so our friends may well de-energize almost all of Ukraine. This is a huge minus of the transition to the so-called smart control systems in industrial enterprises.
However, such an attack is a huge amount of work. It’s impossible to do this alone.
– Have you ever discussed attacks on industrial enterprises in Ukraine?
- Certainly. There were moments when we took control of the entire plant down to the management of the machines.
Did you turn them off?
- No.
The fact is that such [destructive] attacks have far-reaching consequences and a wide resonance. We prefer to act gently and harmlessly towards ordinary citizens. We are warriors, not terrorists.
- Do you think the conflict between Russia and Ukraine will ever reach the point of devastating cyber attacks on industrial enterprises?
From our side, of course not. Again, we are not terrorists. If the question is about seizing control, then yes. It’s already happening. True, no one, most likely, will turn off the same electricity.
How to say it…
Critical infrastructure attacks have two goals. The first is to have control. Not to necessarily turn off something, but just to have such an opportunity just in case. The second is to gain a foothold in the information network of the enterprise in order to receive information as long as possible.
