In the past few years, Ukraine has been subjected to a series of cyber- attacks increasing in scale and sophistication, becoming, in effect, a testing ground for cyber-warfare tools and tactics. Ukrainian infrastructure such as power stations and airports, banks, government organizations, and companies have all been targeted by a wide array of malware, social engineering techniques, and cybersecurity exploits. These attacks have been harbingers of tactics subsequently used against targets in other countries including the US.

Our team of researchers at Information Systems Security Partners have been directly involved in analyzing the breaches and the tools used to achieve them. We will present a view of these cyber activities from the trenches, describing attacks from the points of view of the targetedorganizations and individuals, the incident responders, and the analysts performing post-mortem analysis of the compromised systems and the captured malware.  We will describe how the attacks grew in complexity, and how the attackers developed a mature supply chain of diverse competences and capabilities.

Although we will discuss some important technical aspects of the attacks against banks and energy delivery systems, no special knowledge of cybersecurity is necessary.