Russian Hackers Hijack Ukrainian TV to Broadcast Victory Day Parade

On May 9th, 2024, a significant cyber attack by Russia-aligned hackers disrupted Ukrainian television broadcasts, underscoring the intensifying information warfare between Russia and Ukraine. The hackers commandeered several Ukrainian television channels to air a Victory Day parade from Moscow, commemorating the Soviet Union's triumph over Nazi Germany in World War II. This brazen act of cyber aggression highlights the evolving nature of cyber conflict between the two nations.

The Attack

The Ukrainian agency responsible for television and radio broadcasting, Nacrada, reported that hackers infiltrated the broadcasts of at least 15 TV channels owned by Starlight Media. This attack involved interference with Astra communication satellites operated by the Luxembourg-based company SES. Nacrada noted that such satellite signal disruptions are frequent and typically originate from Russia.

Broader Implications and Responses

The cyber attack extended beyond Ukraine, affecting the Latvian television network Balticom, which also broadcast the Moscow parade. Latvia’s National Electronic Media Council (NEPLP) confirmed that while Balticom’s infrastructure remained uncompromised, the attack targeted their interactive TV server based in Bulgaria. Latvia’s computer emergency response team, CERT.lv, described the incident as part of Russia’s ongoing hybrid warfare strategy, predicting future provocations of a similar nature.

In retaliation, suspected Ukrainian hackers targeted Russian TV channels in Crimea, broadcasting anti-Russian messages. Russian media reported similar hacks in several Russian regions, including Bashkiria and the cities of Orenburg, Omsk, and Irkutsk. These hacks are symptomatic of the broader cyber conflict that sees both nations targeting each other’s media outlets, especially during significant political events like the May 9 parade.

Message of Dissent During Victory Day

As Russian state TV broadcasted the Victory Day military parade, some viewers were greeted with a message starkly opposing Putin's propaganda:

"On your hands is the blood of thousands of Ukrainians and their hundreds of murdered children. TV and the authorities are lying. No to war."

Programme guides shown online and on smart TVs were compromised by unknown parties, likely hacking under the banner of Anonymous, to display this repeated message. This disruption was not just a nuisance for viewers trying to follow their favourite shows but a significant blow to the Kremlin's attempt to control information about its invasion of Ukraine.

Additionally, the names of Russia's three biggest TV channels—Rossiya-1, Channel One, and NTV-Plus—were altered in the programme guide to reflect anti-war slogans. Even children’s channels were impacted, as one parent in the Siberian city of Tyumen reported:

"The [TV] provider ‘delighted’ my child with such a message on children’s channels, and then it turned out that the same thing happened on the other channels. The message appears in the description of any programme."

TV Zvezda, the channel run by Russia's defense ministry, was also affected for those watching via Yandex. One viewer described how the hack lasted for hours:

"The same s*** is happening there on every channel. It is not on all MTS channels but on many for several hours. I switched on the TV at 7am, it was already like that, and stopped only at 11."

Provider MTS acknowledged the attack, stating:

"A cyberattack was carried out on Russian TV broadcasting channels, because of which subscribers could have extremist inscriptions in the broadcast grid. Now our IT specialists are promptly eliminating the consequences of the hack so that subscribers can receive services and watch TV programs and movies as quickly as possible."

This incident raises questions about who will face repercussions. It's likely not the hackers but those responsible for securing the TV listings infrastructure.

Historical Context of Media Hacks

Media hacks have become a common tactic in the cyberwar between Ukraine and Russia. In April 2024, pro-Russian hackers took over Starlight Media to air Russian advertisements and a fragment of the Swan Lake ballet, historically associated with political unrest in Russia. In 2023, hackers replaced broadcasts of Vladimir Putin’s Victory Day parade with anti-war messages, directly challenging the Russian narrative.

Ongoing Cyber Conflict

The ongoing cyber warfare between Ukraine and Russia has seen numerous attacks on digital media platforms. In February, Russian hackers breached several popular Ukrainian news outlets, posting fake news about the destruction of Ukrainian special forces in Avdiivka. These persistent attacks aim to spread misinformation and propaganda, further complicating the already tense geopolitical situation.

Nacrada has emphasized that these cyber-attacks pose significant threats to Ukraine’s national security by spreading enemy propaganda and destabilizing information integrity. The Ukrainian government continues to bolster its cyber defenses and remains vigilant against such incursions.

Conclusion

The hijacking of Ukrainian TV channels to broadcast Russia’s Victory Day parade is a stark reminder of the high-stakes information warfare being waged in cyberspace. As the conflict between Russia and Ukraine persists, the frequency and sophistication of cyber-attacks are likely to increase. This incident underscores the urgent need for robust cybersecurity measures and international cooperation to mitigate the risks associated with cyber warfare and protect the integrity of national information infrastructures.