Russia's invasion of Ukraine may spur more cyberattacks in Canada, security experts warn

The Russian invasion of Ukraine isn't just on the ground — it's also online, and cybersecurity experts warn it could have an impact on Canadians.

A recent report from the Waterloo, Ont.-based online security firm eSentire found the Conti Ransomware Group has declared its support for Russia on the group's data leak website.

At first, the Conti Ransomware Group announced its "full support of [the] Russian government" on Feb. 25, a day after Russia invaded Ukraine.

Later that day, the group appeared to soften its message to say they "do not ally with any government and we condemn this ongoing war," but also said it would focus its efforts to retaliate against "the Western warmongers."

The group is known for using Cobalt Strike ransomware software to infiltrate computer networks of major corporations, including municipalities and health-care systems.

Seeing it align itself with Russia so openly is significant, said Keegan Keplinger, a Yukon-based threat intelligence research and reporting lead for eSentire.

Keplinger recently wrote a report on the Contri group and its use of Cobalt Strike, which is posted to the company's security advisories page.

"I have not seen that before," he said of Contri aligning with Russia, but it also doesn't surprise him. For example, he said, the group uses malware that comes out of Russia and looks for a Russian keyboard.

"If you have a Russian keyboard, the malware will stop and it won't infect you any further."

Keplinger expects the Russian government is aware of what the group is doing online.

"It's not like the Russian government's saying go and fight these people. But the Russian government is at least turning a blind eye."

On Feb. 24, Canada's Communications Security Establishment (CSE) warned power companies, banks and other major companies "to take immediate action and bolster their online cyber defences" the same day Russia invaded Ukraine.

"When we have a situation like we have now with Russia engaged in a conflict, we want to make sure that Canadian institutions have every mechanism possible to help defend themselves," Dan Rogers, associate chief at CSE, said at the time.

Even before the invasion, Matthew Schmidt, an associate professor and national security expert at the University of New Haven in Connecticut, warned people will see high-level cyberattacks "just short of war."