Microsoft: Russia invasion of Ukraine ‘unlawful, unjustified’

Windows giant says it detected 'destructive cyberattacks', DDoS malware aimed at now occupied nation

Microsoft is decrying what it calls the "tragic, unlawful and unjustified invasion of Ukraine" by Russia, and vowed to continue protecting the country from cyberattacks and state-sponsored disinformation campaigns.

The software giant added it will support humanitarian efforts as Ukrainians try to fend off an invading Russian army and as hundreds of thousands flee Ukraine into such neighbors as Poland, Romania, and Moldova. The Windows titan will work to protect its own employees in Ukraine, Russia, and Eastern Europe and those elsewhere who are of Ukrainian or Russian origin, we're told.

It also is working with a broad array of government and international entities, including the Ukrainian and US governments, the European Union and its member governments, and NATO and the United Nations.

"One of our principal and global responsibilities as a company is to help defend governments and countries from cyberattacks," Brad Smith, Microsoft's president and vice chair, wrote in Monday blog post, outlining the company's efforts. "Seldom has this role been more important than during the past week in Ukraine, where the Ukrainian government and many other organizations and individuals are our customers."

This comes as organizations take steps to make it politically difficult for Moscow to continue its occupation of its much smaller neighbor, and for Russian citizens to go about their normal lives, in hope that such actions will put pressure on President Vladimir Putin and his regime to end the unprovoked war.

Among the companies that have taken action are Google, its YouTube business, Facebook, and Twitter, which are blocking Russian state media from running ads on their sites, stopping all advertising in Russia and Ukraine or kicking off channels run by Russian state media. In addition, Google temporarily disabled locator tools on Google Maps that delivered live information that could be used to track military units and civilians in Ukraine, which could help Russian military officers in directing their units.

Facebook parent company Meta plans to limit the access for RT and Sputnik, Russia-controlled state media outlets, throughout the European Union. Netflix said it won't add Russian TV channels to its service in the nation, defying a regulation that requires it to carry the outlets, which again includes state-controlled media.

SpaceX CEO Elon Musk directed his biz to use its Starlink satellite broadband service and appliances to aid the communications of Ukraine's military and citizens in the event that Russian troops interrupt internet service.

More recently, Intel and AMD are suspending processor sales to Russia, while TSMC and GlobalFoundries are also supporting sanctions against the country. These moves come after the Biden Administration restricted semiconductor sales and other kinds of technology to Russia. Similarly, HP Inc has suspended shipments of equipment to Russia.

In addition, cybersecurity vendor Bitdefender is working with Romania's National Cyber Security Directorate to deliver cybersecurity expertise, technology such as antivirus products, technical consulting and threat intelligence to any company, government or private citizen in Ukraine and one year of free cybersecurity technology to any NATO or EU company or public agency looking to strengthen their security posture.

"We are deeply saddened by the unprovoked brutal act of war against the free people of Ukraine and are committed to doing what we can to support them and our NATO allies," Florin Talpes, co-founder and CEO of Bitdefender, said in a canned statement. "As proud Romanians and a company of global citizens, we stand with our northern neighbors who bravely fight for their future."

Redmond's not holding back

For its part, Microsoft's Smith said that hours before Russia launched any missiles or moved tanks on February 24, the corporation's Threat Intelligence Center detected "offensive and destructive cyberattacks" against Ukraine's technology infrastructure, at least some of which involved a Windows malware package that Microsoft's researchers dubbed FoxBlade. Microsoft alerted the Ukraine government and offered technical advice on how to prevent the malware from knocking out systems.

Microsoft Defender was updated to intercept FoxBlade, which is described as being able to use an infected "PC for distributed denial-of-service (DDoS) attacks without your knowledge."

More recently, the company has provided threat intelligence and suggested to Ukrainian officials ways to defend the country against attacks on military institutions, government agencies and manufacturers in the country. This work is continuing.

Microsoft is also sharing information with NATO and US officials, part of a larger effort to push back against escalating cyberattacks against Ukrainian targets that included new forms of malware that were previously disclosed. The Windows giant will continue to update its services – including anti-malware Defender service – to protects against such malware.

Recent campaigns against Ukraine also have included attempts to steal data, such as health, insurance and transportation-related personally identifiable information (PII) and government data sets.

"These recent and ongoing cyberattacks have been precisely targeted, and we have not seen the use of the indiscriminate malware technology that spread across Ukraine's economy and beyond its borders in the 2017 NotPetya attack," Smith said. "But we remain especially concerned about recent cyberattacks on Ukrainian civilian digital targets, including the financial sector, agriculture sector, emergency response services, humanitarian aid efforts, and energy sector organizations and enterprises."

He suggested the attacks on civilian targets may violate the Geneva Convention and is sharing what it can on that topic with Ukrainian officials.

There also has push-back against disinformation aimed at sowing discord by reducing the exposure of Russian propaganda and making sure Microsoft's own platforms aren't used by the Russian operations.

Smith wrote that its Start platform, which includes MSN.com, won't display content from RT and Sputnik, the company is removing RT news app from its Windows app store and re-ranking the sites' search results on Bing. Microsoft also is banning ads from RT and Sputnik across its ad network. ®