Thomas Samson | AFP | Getty Images
Hordes of Ukrainian programmers divide their time between carrying out their daily work and fighting a cyber war with Russia.
Over 311,000 people have joined a group called the “IT Army of Ukraine” on the social media platform Telegram, where Russian targets are shared. Although not all of them are from Ukraine, a significant number of them, according to members of the group who spoke to CNBC.
Dave, a Ukrainian software engineer who preferred to withhold his last name because of the nature of his comments, told CNBC that the group has helped carry out several cyber attacks outside of their daily work since the war began. He said the targets had included Russian government websites, Russian banks and currency exchanges.
“I’m helping the IT Army run DDoS attacks,” he said. A distributed denial-of-service attack is a malicious attempt to disrupt the normal traffic of a website by flooding it with a stream of internet traffic.
“I have rented a few servers on GCP (Google Cloud Platform) and written a bot to myself that just accepts site links and targets attacks against them every time I insert them,” he explained. “I usually run attacks from 3-5 servers, and each server usually produces about 50,000 requests per second.”
When a list of targets is shared on the Telegram channel, Dave says he just inserts them into a bot that took about an hour to create.
Asked how successful it has been so far, he said it was hard to say as the attacks are being carried out by thousands of people simultaneously. “Combined actions are absolutely successful,” he said.
Dave is one of about 30 Ukrainians working externally for a US technology consulting firm. The company has made the work “fully optional” for its Ukrainian employees.
Oleksii, a quality assurance team leader for a software company in Zaporizhzhia, Ukraine, told CNBC that he and his colleagues are doing their best to keep working and keep the economy going. But it has not been easy.
“[During] the first days of the war the air raid sirens went on for 24 hours in a row and you can not think of work in these moments – you can only think of your family, children and how you can keep them safe and sheltered, “he said.
Since Russia launched its invasion of Ukraine on February 24, Oleksii said he has, on average, not spent more than two hours a day working. “In times like this, of course, it’s hard to prioritize professional work,” he said.
In addition to his normal job, Oleksii is also trying to help Ukraine win the cyber war. “As an IT employee, I hope I can serve my country on the digital front line, as this war is also taking place in the digital world,” he said. “On a daily basis, I help reach various European and American websites and ask them to stop trading with Russia, posting on social networks, etc.”
Gazprom and Sberbank targets
Another developer named Anton said he personally participated in a DDoS attack on Russian oil giant Gazprom, as well as others against Russian bank Sberbank and the government. Gazprom, Sberbank and the Russian government did not immediately respond to a CNBC request for comment.
“There are a lot of people involved in attacking, so it doesn’t take long to put a service down,” he told CNBC.
Meanwhile, Nikita, a CEO and co-founder of a cybersecurity company, told CNBC that he is also in the IT Army of Ukraine’s Telegram channel. His company works for clients all over the world, and its staff has continued to work throughout the Russian invasion. They do “penetration tests” and check IT systems for vulnerabilities.
Nikita told CNBC that via messaging services he has tried to tell Russian citizens what is really happening in Ukraine under strict media control from Moscow. He said he and his hacking team also publish Russian credit card information online. “I published about 110,000 credit cards in the Telegram channels,” he said, adding that he wants to inflict economic damage on Russia.
“We want them to go to the Stone Age, and we’re pretty good at this,” Nikita said, adding that they are now targeting Russian gas stations with a cyber attack. However, he stressed that he does not hate all Russians and he is grateful to the Russians who help Ukraine.
Ukraine’s digital minister Mykhailo Fedorov urged people to join the channel last month, saying Ukraine continues to fight on the cyber front.
Yehor, another technology expert working for an international cyber security firm far from Ukraine, is also juggling his normal role alongside the cyber war.
“My company is not trying to push us on any timelines,” he said, adding that some employees are still in Kiev or Kharkiv, where the fighting is more intense.
“I’m trying to get equal time for work and cyber attacks. Unfortunately, my family is not with me, so I have more free time than usual,” he added.
Cyber-savvy citizens
Ukraine is one of the largest software development centers in Eastern Europe, and its coders are world-renowned.
The cyber war is reportedly a two-way battle. In the first three days after the invasion, online attacks on Ukrainian military and government sectors increased by 196%, according to Check Point Research.
They also rose modestly against Russian (4%) and Ukrainian (0.2%) organizations, according to the data, while simultaneously declining in most other parts of the world.
Nearly four weeks later, Ukraine continues to maintain a barrage of online attacks, most of which target the country’s government and military, according to CPR data.
Moscow has consistently denied that it participates in cyber warfare or aids cyber attacks. February 19th It informs the Russian embassy in Washington on Twitter that it “has never performed and does not perform any ‘malicious’ operations in cyberspace.”
—Additional reporting by Monica Buchanan Pitrelli.