Boryspil airport in Ukraine's capital Kyiv was the target of a hacker attack officials claim originated in Russia. Image from Wikimedia Commons.
Officials in Ukraine are set to reconsider the state's cyber security and defense systems, including those at airports and railway stations, after a recent malware attack on Kiev's main airport Boryspil that targeted its air traffic control system. The Ukrainian defense ministry believes the attack was launched from a server within Russia.
Malware akin to that which was used to attack Ukrainian power companies in December 2015 was detected last week on a computer in the IT network of Boryspil airport, a key transport hub connecting Ukraine to the rest of the world.
Irina Kustovska, a spokeswoman for Ukraine's infrastructure ministry, which oversees airports, railways, and other transport networks, said the ministry intends to initiate a review of anti-virus databases at Boryspil airport and in other companies it is responsible for.
At a press briefing on January 16, Ministry of Defense spokesman Andriy Lysenko announced [1] that state cybersecurity experts discovered an airport workstation infected with the BlackEnergy malware, linked to other recent cyber attacks on Ukraine. Experts isolated the infected computer from the airport's IT network.
“The control center of the server, where the attacks originate, is in Russia,” Lysenko told [2] Reuters news agency, adding that the malware in Boryspil's system had been detected early on and that no damage had been done. At this stage, Ukrainian authorities have made no mention of the Russian government in their statements on the matter.
Ukraine's state security service has previously blamed Russia for the blackout in Ukraine's western Ivano-Frankivsk region on December 23 that affected about 80,000 citizens. At the time, a local power company, Prycarpattyaoblenergo, reported that part of its service area, including the regional capital Ivano-Frankivsk, was left without power [3] for over six hours due to “interference” in its industrial control systems. The cybersecurity research team iSIGHT Partners linked the attack to the Russian hacker collective known as the Sandworm Team based on their analysis of the BlackEnergy software, reportedly used in the attack.
On January 18, Ukraine's state Computer Emergency Response Team (CERT-UA) issued a warning [4] about the threat of more attacks connected to BlackEnergy, calling on system administrators to keep an eye out for suspicious indicators in log-files and Internet traffic.