Pro-Russia hackers targeted Kosovo’s government websites

Pro-Russia hackers targeted government websites in Kosovo in retaliation for the government’s support to Ukraine with military equipment.

Pro-Russia hackers targeted Kosovo government websites, including the websites of the president and prime minister, with DDoS attacks. The attacks are a retaliation for Kosovo’s support of Ukraine with military equipment. Defense Minister Ejup Maqedonci claimed that Russian hackers launched a cyberattack against Kosovo in retaliation for his statement supporting Ukraine at the Defence 24 conference in Poland.

The attacks caused temporary disruption, however, the government’s Information Society Agency restored the websites. The attack is part of a hybrid war aimed at destabilizing Kosovo’s security, stability, and welfare institutions, Prime Minister Albin Kurti told local media.

“We were informed by the relevant institutions that some government websites have been the target of DDoS attacks. For a short time the websites were not functioning,” a Government spokesperson told Balkan Insight.

“The attack was carried out by Russian hackers in retaliation for our support of Ukraine with military equipment,”

Foreign Minister Donika Gervalla-Schwarz announced on Tuesday that Kosovo was under a hybrid attack from Russia, following Kosovo’s announcement of support for Ukraine’s defense against Russian aggression.

Russia and Pro-Russia groups have targeted in the past multiple European governments that expressed their support to Ukraine.

NATO and the European Union early this month condemned cyber espionage operations carried out by the Russia-linked threat actor APT28 (aka “Forest Blizzard”, “Fancybear” or “Strontium”) against European countries.

The German Federal Government condemned in the strongest possible terms the long-term espionage campaign conducted by the group APT28 that targeted the Executive Committee of the Social Democratic Party of Germany.

In March 2024, the Moldovan national intelligence agency warned of hybrid attacks from Russia ahead of the upcoming elections.

Since the beginning of the Russian invasion of Ukraine, pro-Russia threat actors hit Moldava due to its support to Kiev.

The Pro-Russia group Killnet group launched multiple DDoS attacks against governments that expressed support for Ukraine, including Moldova, Italy, Romania, the Czech Republic, Lithuania, Norway, and Latvia.

In October 2022, another wave of attacks targeted tens of Moldovan institutions with distributed denial-of-service (DDoS) attacks.

In October 2023, the French National Agency for the Security of Information Systems ANSSI (Agence Nationale de la sécurité des systèmes d’information) warned that the Russia-linked APT28 group has been targeting multiple French organizations, including government entities, businesses, universities, and research institutes and think tanks.

The French agency noticed that the threat actors used different techniques to avoid detection, including the compromise of low-risk equipment monitored and located at the edge of the target networks. The Government experts pointed out that in some cases the group did not deploy any backdoor in the compromised systems.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Kosovo)