Hacktivists Claim Ransomware Strike on Belarus Railway Intended to Disrupt Russian Forces

Viacorka, who has also worked with the Atlantic Council and is a media analyst for the US Agency for Global Media, told Gizmodo that he had learned about the cyberattack directly from “railroad workers.” Viacorka called the “scale” of the attack “huge,” and said that he expects there to be an “official statement” soon on the incident, as “some railroad services don’t work.”

While there doesn’t appear to be any official acknowledgment of the attack by the Belarusian government, a railway notification to travelers on Monday announced that certain “technical” difficulties were causing problems for electronic service delivery:

“For technical reasons, reference web-resources of the Belarusian Railways and services for issuing electronic travel documents are temporarily unavailable,” the railway announced. “To arrange travel and return electronic travel documents, please contact the ticket office.”

While this alone doesn’t confirm the hacktivists’ claims, it certainly sounds like one of the classic side-effects of a ransomware attack.

The ongoing standoff in Ukraine between Russian and pro-NATO forces has gotten to the point where, some say, political squabbles risk devolving into armed confrontation. The buildup of 100,000 Russian troops at Ukraine’s border has heightened tensions and led American officials to accuse Putin of wanting to invade the neighboring country.

More relevantly, multiple cyberattacks have targeted Ukraine over the past two weeks—a fact that has added to the growing conflict. This includes a Jan. 14 defacement attack on nearly 80 Ukrainian government websites, which was blamed on hackers connected to Belarusian intelligence. This makes the timing of the railway incident—a little over a week later—somewhat interesting.

On their Telegram page Monday, Cyber Partisans wrote that they had hacked the railway system to defy Belarusian President Lukashenko, who they dubbed a “terrorist”:

BelZhD at the command of the terrorist Lukashenko these days allows the occupying troops to enter our land. As part of the “Peklo” cyber campaign, we encrypted the bulk of the servers, databases and workstations of the BelZhD in order to slow down and disrupt the operation of the road. The backups have been destroyed.

The hackers claimed that “automation and security systems were deliberately NOT affected by a cyber attack in order to avoid emergency situations.”