NSA cyber director: Espionage is now Russia’s focus for cyberattacks on Ukraine

After years of bombarding Ukrainian targets with wiper malware and other cyberattacks aimed at wreaking havoc, a top U.S. intelligence official said there are signs Russia is changing its tactics with a focus on cyberespionage.

Dave Luber, the National Security Agency's director of cybersecurity, said Wednesday at Recorded Future’s Predict conference in Washington, D.C., that the Kremlin has been focusing on gathering intelligence to help plan attacks on the ground. Earlier in the war, Russia’s cyber efforts were used to knock out satellite connectivity, communication systems and a variety of Ukrainian internet providers.

“What I think has changed is the Russians shifting back to more espionage,” said Luber, who took on his role at the NSA in April following the retirement of Rob Joyce. “How can I conduct espionage against Ukrainian systems so that I can have an advantage on the battlefield?”

His comments came shortly after two hackers with the Russian federal security service, or FSB, were sentenced in absentia to 15 years in prison in Ukraine for carrying out thousands of cyberattacks on critical infrastructure facilities and state institutions. The Russia-backed cyber-espionage group known as Gamaredon or Armageddon remains as active as ever, cybersecurity researchers say.

The goal of these attacks was “to gain access to electronic documents and servers with secret government data,” Ukraine’s security service, SBU, said. 

Luber, in conversation with Click Here podcast host and Recorded Future News Senior Correspondent Dina Temple-Raston, said one of the best ways to defend against Russian intrusions is to enhance information sharing with the Ukrainian government and other potential targets.

“I think the power of partnerships is one of the most important lessons when we think about supporting something like a Ukraine conflict … I would say there’s no one single entity that has the silver bullet,” Luber said. “But whether it’s partnerships with industry, government partners, or even select foreign partners, that’s where the real power of cybersecurity comes into play because that’s when you can start to scale the insights and scale the outcomes.”