Microsoft says cyberattacks using new malware hit Ukraine hours before Russia's invasion began; the company added new signatures to Defender within three hours
- Brad Smith, Microsoft's president, wrote in a blog post on Monday about the company's efforts to keep Ukraine informed of cyberattacks.
Later coverage broadened the arc from an initial Ukrainian campaign to Russian cyberactivity across 42 countries, making the speed of vendor detection and signature delivery consequential beyond the first targets.
First-order effects
Microsoft made new malware detections available through Defender within three hours, giving Defender-protected Ukrainian organizations an immediate mechanism to identify the newly observed activity.
Microsoft's security team became an active source of incident intelligence for Ukraine while Russia-linked activity was targeting Ukrainian systems.
Second-order effects
The early Defender response gives Microsoft a concrete role in Ukraine's defensive stack, raising the value of rapid telemetry sharing and detection engineering for affected customers.
As the campaign expanded, organizations outside Ukraine faced a stronger incentive to treat Ukraine-focused threat reporting as relevant to their own defenses, consistent with the later cross-border targeting reported by Microsoft.
Third-order effects
The episode points to major security vendors functioning as cross-border cyber-defense infrastructure during conflict: their endpoint reach and update cadence can shape how quickly newly deployed malware is countered.
If state-linked campaigns continue to spread beyond an initial theater, the boundary between a national security incident and enterprise security operations will increasingly be set by vendors' global telemetry and distribution networks.
The trend: Cyber conflict is making endpoint-security providers operational participants in collective defense, with rapid detection updates extending protection from a frontline target set to global customers.
The tragic, unlawful, and unjustified invasion of Ukraine includes cyberattacks and internet-based disinformation campaigns. We're working to protect computer networks and provide humanitarian assistance to Ukraine, our customers, and employees. https://blogs.microsoft.com/ ...
When “wiper” malware appeared to target Ukraine a few hours before Russia's invasion, Microsoft stepped in, throwing itself into the middle of a war. https://www.nytimes.com/...
Microsoft says hackers deployed a new piece of malware in Ukraine “several hours before the launch of missiles or movement of tanks” on Feb. 24. It's also seen attempts to steal health info, transportation-related PII, and other government data. https://blogs.microsoft.com/ ... h…
Just before Russia's invasion, Microsoft threat analysts near Seattle saw warnings of a powerful new malware targeting Ukraine. Microsoft was able to notify Ukrainian officials and update systems to block the malware as the ground war was beginning. https://www.nytimes.com/...
Microsoft says Russia's cyberattacks on civilian infrastructure “ raise serious concerns under the Geneva Convention, and we have shared information with the Ukrainian government about each of them.” https://blogs.microsoft.com/ ... https://twitter.com/...
Microsoft: “In accordance with the EU's recent decision, the Microsoft Start platform will not display any state-sponsored RT and Sputnik content. We are removing RT news apps from our Windows App Store” https://blogs.microsoft.com/ ...
Microsoft's president says cyberattacks on Ukraine's civilian digital infrastructure “raise serious concerns under the Geneva Convention,” which considers it a war crime to intentionally direct attacks against civilian populations or civilian objects. https://www.axios.com/...
“Many people are quite surprised that there isn't significant integration of cyberattacks into the overall campaign that Russia is undertaking in Ukraine,” said @ShaneHuntley the director of @Google's TAG. “This is mostly business as normal as to the levels of Russian targeting.”…
Microsoft says its “initial and immediate focus has been on support for humanitarian organizations such as the ICRC...” This will become even more important in the coming days and weeks. https://blogs.microsoft.com/ ...
As a Ukrainian descendant, I'm happy to see how my employer is supporting Ukraine. Digital technology and the war in Ukraine https://blogs.microsoft.com/ ...
Microsoft outlines what it's seeing in Ukraine and how it's responding, with a focus on malware it's identified and steps it's taking to limit the reach of Russian state media outlets. https://blogs.microsoft.com/ ...
Microsoft says it's complying with an EU directive and will remove the RT news app from its Windows store, de-rank Sputnik and RT in Bing results, and remove RT and Sputnik content from MSN and Microsoft Start https://t.co/Q6epVSHzG5 https://t.co/p3L41lTXUw