Most Cyber activity points to a pro-Russian Cyber group named Cyber-Berkut, which CLAIMS to be a Ukrainian based group fighting neo-fascism, the EU and the U.S. They conduct mainly DDoS (Distributed Denial of Service), E-mail hacks, and information dumps. The group also carries the most common pro-Russian themes and does not deviate from them as is often the case with true, non-centrally controlled, grassroots, hacktivist groups.;xNLx;The term Berkut means golden eagle and is a reference to the recently dissolved Ukrainian secret police.;xNLx;Anonymous Ukraine is another group involved. Most activities have been pro-Russian, but Russian interests have been attacked, as well. This may indicate a rift among members as to which side of the conflict they belong.;xNLx;Please note that Google Translate was used extensively to translate the Russian text, thus the English may be slightly off. Efforts were made to correct egregious errors.;xNLx;The Timeline begins with former President Viktor Yanukovych abandoning the EU agreement on the 21st of November 2013. Other such non cyber-related events are included for context.;xNLx;
"Ukrainian President Viktor Yanukovych's government announces it is abandoning an agreement that would strengthen ties with the European Union. It seeks closer cooperation with Moscow. Protesters take to the streets."
"A protest attracts about 300,000 people at Kiev's Independence Square. Activists seize Kiev City Hall."
"Russian President Vladimir Putin announces Moscow will buy $15 billion worth of Ukrainian government bonds and all for a cut in the price Ukrainians pay for Russian natural gas."
January see an uptick in Root Kit popularly known as “Snake” infections within Ukrainian, including government and telecommunication networks. This software, which is capable of taking control of any infected computer as well as stealing data and recording network data traffic, believed to have been present in networks as early as 2011. Although researchers are unable to definitively tie this Advanced Persistent Threat (APT) to the Russian government, its sophistication strongly indicates a state actors and artifacts point to a Russian origin.
"The first protest deaths. Two die after being hit with live ammunition and the third after a fall during a confrontation between police and demonstrators manning barricades."
First known posting to YouTube of Ukrainian based US State Department official Victoria Nuland. This recording, in which Nuland is heard stating "Fuck the EU". This audio would appear to have been intercepted and then leaked for the purpose of dividing US and EU response to the growing Ukrainian crisis.
According to an unnamed diplomat, a link to the Victoria Nuland audio clip was first posted on Twitter by Dmitry Loskutov, an aide to Russian Deputy Prime Minister Dmitry Rogozin.
In the name of OpIndependence, Anonymous Ukraine hack Vitali Klitchko's UDAR party and releases confidential emails.
"Street clashes erupt, leaving at least 26 dead and hundreds injured."
"More than 50 people were shot dead in an around Maidan Square."
"Yanukovych flees the country after a political coup. Opposition leader Yulia Tymoshenko is released from prison."
"Pro-Russian protesters take a stand in Crimea. Yanukovych's former chief of staff is wounded by gunfire and hospitalized."
"Amid clashing protesters in Crimea, Putin orders military exercises in western Russia. Secretary of State John Kerry vows $1 billion in loan aid to Ukraine."
"Armed men in Russian military uniforms take control of key airports in Crimea. Russian marines surround a Ukraine coast guard base in Sevastopol. Obama warns "there will be costs" for Russian military intervention in Ukraine."
On March 1, 2014 Right Sector's page on Russian online social networking service VKontakte showed an entry with Dmytro Yarosh's alleged appeal to Doku Umarov, a Chechen militant guerrilla leader associated with Al-Qaeda, for support of Ukraine.
"Armed men in trucks and armored vehicles surround a Ukrainian military base in Crimea. Putin tells President Obama that use of force on Russia's part would be a response to provocations from Ukraine."
Cyber-Berkut claims to have hacked multiple Ukrainian websites to "plug the flow of lies."
Russia Today reports: "The snipers who shot at protesters and police in Kiev were allegedly hired by Maidan leaders, according to a leaked phone conversation between the EU foreign affairs chief Catherine Ashton and Estonian foreign affairs minister, which has emerged online."
Cyber-Berkut claims to have "blocked" phones of "junta members" and "neo-fascists." They further state:
Group wants e-mails and phone numbers of "criminals", states the following:
Cyber-Berkut claims: From 16.00 today we have launched DDoS attacks on the media sector to sell the rights: http://expres.ua http://sfera-tv.com.ua http://strelaua.com At the same time we blocked up to 800 phones belonging to participants of the neo-nationalist movement in Ukraine.
Cyber-Berkut claims to have hacked various e-mail accounts
The website Voice of Russia claims:
Cyber-Berkut claims to have hacked the following media sites: http://litsa.com.ua http://viche.lutsk.ua
Cyber-Berkut claims Tallinn kibertsentra NATO (NATO Cooperative Cyber Defence Centre of Excellence) was trying to attack them. They claim to have launched a successful DDoS attack against the following NATO sites: http://ccdcoe.org http://nato.int http://nato-pa.int The group also suggests NATO leader Arthur Suzikov change his computer password,
Cyber-Berkut launches DDoS attack against the following sites for "spreading fascist nationalism:" http://unian.net/ http://ukrinform.ua/ http://vlasti.net/ http://ord-02.com/ http://galnet.org/
Cyber-berkut launches DDoS attacks for three consecutive days against the following websites: http://rivne.fm/ http://uju.rv.ua/ http://zik.com.ua/ http://www.parubiy.org/ http://silaslova.zp.ua/
Cyber-Berkut claims to have hacked the e-mail account of "Edward Egorova - chairman of the NGO "Educational Center of Human Rights", which took an active part in the events of recent months in Ukraine. " Group claims that the NGO is receiving money for the U.S. Congress.
The same day as it appears on YouTube, Cyber-Berkut posts a link to the Shufrych and Tymoshenko conversation to their website.
Youtube video posted by Sergiy Vechirko. Post states: "Telephone conversation between the former Deputy Secretary of the National Security and Defense of Ukraine Shufrych and former Ukrainian Prime Minister Tymoshenko. March 18, 2014 at 23:17 Ukrainian time " Part of the conversation claims that Tymoshenko states they should fire nukes at Russians living in Ukraine.
Cyber-Berkut claims to have launched DDoS attack against the following websites: http://una-unso.in.ua/ http://cun.org.ua/
Cyber-Berkut claims the following: Having achieved power by neo-Nazis new government in order to obtain the status of legitimacy and approval from the U.S. and the EU on track to tyranny and lies. To hide and organized directly Parubiya Nalivaychenko provocation on Independence - murder commandos and their pravosekov same, they are using the media they control cynically blamed the fighters themselves as "Berkut". Puppeteers in the west worthy applauding his disciples. Do all other hands - it's the American way! This is an example of true democracy. On someone else's blood and grief of the people they do not care, most importantly make geopolitical success. They sent for this far away even the EU, and they swallowed the pill. A proteges West Ukraine all ready, the more shamelessly lie to the people through TV and print media. To prevent them from doing so, we have repeatedly blocked the work of anti-popular media, websites and other resources. Today "KiberBerkut" as promised earlier continues attack on TV channels making his fortune on the mountain of the Ukrainian people and oligarchs Kolomoyskogo Firtasha: www.1plus1.ua www.inter.ua
Cyber-Berkut claims to have launched a DDoS attack against the following websites: http://ukrpolitforum.com/ http://kharkovforum.ua/ http://tymoshenko.ua/
Cyber-Berkut claims to have launched a DDoS attack on the following websites: http://privatbank.lv/ - Latvian branch bank "Privatbank" Igor Kolomoisky http://comments.ua/ - news portal "Comments" Sergei Taruta
Cyber-Berkut claims to have launched a DDoS attack against the following websites: http://mvs.gov.ua/ http://gp.gov.ua/
Group claims to have Defaced the websites of Triple Canopy and Tidewater Global Services, and launched a DDoS against Greystone Limited and Academi.
The Ukrainian Government has arrested more than a dozen suspected Russian intelligence agents in recent weeks, many of whom were armed at the time of arrest. In the first week of April 2014, the Government of Ukraine had information that Russian GRU officers were providing individuals in Kharkiv and Donetsk with advice and instructions on conducting protests, capturing and holding government buildings, seizing weapons from the government buildings’ armories, and redeploying for other violent actions. On April 12, armed pro-Russian militants seized government buildings in a coordinated and professional operation conducted in six cities in eastern Ukraine.
Cyber-Berkut states their support for "Residents of Donetsk, Luhansk and Kharkiv regions" and claims to have launched a DDoS attack on the following websites: http://news.pn/ http://racurs.ua/ http://day.kiev.ua/ http://rnbo.gov.ua/
The group claims to have knocked out UA DNS servers the day prior. They further state they will continue to knock out domain zones in the country.
Cyber-Berkut states: "We Cyber-Berkut gained access to the correspondence of illegitimate Interior Minister Arsen Avakov and his former spokesman and business partner Dmitry Brook. In the correspondence it clearly indicates that the murder was planned Bellamy Bilogo Avakov, and as "retribution" for his death, the so-called government issues Yarosh Berkut fighters. Moreover, from the correspondence shows how cynical illegitimate power eliminates disagreeable journalists, for example Konstantin Dolgov, who was detained and taken to Kiev on April 19. These and other details of the "democratic" methods you will find the new rulers in correspondence Avakov Laid here."
Anonymous Ukraine states: We, Anonymous Ukraine, hacked correspondence of the famous oligarch, gangster and racketeer Igor Kolomoyskiy. In this correspondence he addresses in a familiar way to the prosecutor of Lviv and hints at a powerful plot of the security agencies and power structures...
Cyber-Berkut states:
Video from Дмитрий Сергеевич (Dimitri Sergyevich) uploaded. Video link was added to Cyber Berkut website two days later.
Video from FallenUSSoldiers appears on Youtube. Video is then linked to on Cyber Berkut website two days later.
The group asks for volunteers to join their army:
Cyber-Berkut thanks volunteers for downloading their software to conduct a DDoS Attack. They instruct them to launch the software May 14th at 10.00.
The group states: "We Cyber-Berkut, announcing that the world formed by KiberArmiyu entered already 4.5 thousand volunteers. Such an amount of honest and courageous people strengthens the confidence in the bright future of our country.
Cyber-Berkut states they continue to recruit for the Cyber Army to fight neo-Fascism
The group states: "We Cyber-Berkut, in protest against the legitimization of crimes Kiev junta completely destroyed the network and computing infrastructure of the Central Election Commission of Ukraine.
We'd love to hear from you. Please send questions or feedback to the below email addresses.
Before contacting us, you may wish to visit our FAQs page which has lots of useful info on Tiki-Toki.
We can be contacted by email at: hello@tiki-toki.com.
You can also follow us on twitter at twitter.com/tiki_toki.
If you are having any problems with Tiki-Toki, please contact us as at: help@tiki-toki.com
Close