Financial institutions in Western countries may see retaliatory cyber attacks from Russian-based threat groups after Canada, the U.S. and U.K. announced sanctions against Russian banks following that country’s recognition of two breakaway regions of Ukraine.
The U.K. announcement was the first of what are expected to be many detailed responses today from the U.S., the European Union, and Canada to Russia’s recognition of the Donetsk and Luhansk regions as independent states and the sending of Russian troops into the regions in what it called a peacekeeping mission.
CNN reports that Prime Minister Boris Johnston told Parliament today the U.K. will sanction five Russian banks and three “very high net worth” individuals.
U.S. President Joe Biden this afternoon announced “full blocking sanctions” on two large Russian financial institutions, including a military bank. There are also sanctions on Russian government debt, preventing Moscow from raising funds from the West and it cannot trade in new debt on American or European markets. Sanctions will also be announced shortly against “Russia’s elites and their family members.”
An analyst from the Chicago Council on Global Affairs told CBC News the sanctions on the international movement of money of those persons, who are big supporters of Russian President Vladimir Putin, may hurt more than other sanctions.
That is just the first tranche of sanctions, Biden added, saying more will be added if the Russian army moves further into Ukraine.
Three hours later Prime Minister Justin Trudeau said Canada has also imposed sanctions on two Russian-state-backed banks, banned Canadians from business dealings with the Donetsk and Luhansk regions, and imposed sanctions on members of Russia’s parliament who voted to recognize the “so-called independent states.”
These are first round of actions, Trudeau added.
“The economic costs on Russia will be severe,” said deputy prime minister and Finance Minister Chrystia Freeland.
Germany said it has suspended approval of the NordStream 2 natural gas pipeline from Russia.
In an interview, Brian Hay, president of the Toronto-based Mackenzie Institute, said he expects Russia will launch cyberattacks against Canadian, American, and European financial institutions.
That’s because the U.S. and the European Union focused their initial response to Russia’s moves to financial targets.
“I suspect that the counter-actions of the Russians will also be financial,” Hay said. “I suspect they will attack financial markets in the United States, Europe, and Canada. They proved a number of years ago they could shut down the banking systems in Latvia and in Ukraine. That was the better part of a decade ago, and I’m sure they’ve been refining their skills to be able to do that more assertively [now] to North American and European institutions.”
Another possibility is that Russia will disrupt Western stock markets by short-selling stocks that they don’t own through third-party accounts. “There’s a lot they can do without firing a shot,” Hay said.
Earlier this month Hay, president of the Mackenzie Institute, predicted Russia would respond with cyber attacks on Western financial institutions if they sanctioned its banks. Russia would argue that sanctioning its financial system would justify a response, Hay said.
In January Canadian, American and U.K. intelligence agencies warned critical infrastructure providers — including financial institutions, utilities, communications and transportation companies — to be prepared for Russian state-sponsored cyber threats as a result of the crisis in Ukraine.
Biden signed an executive order on Monday that prohibits U.S. persons from new investments, trades and financing to, from, or in the so-called DNR and LNR regions of Ukraine.
Also on Monday Trudeau said in a tweet that “Canada strongly condemns Russia’s recognition of so-called ‘independent states’ in Ukraine. This is a blatant violation of Ukraine’s sovereignty and international law. Canada stands strong in its support for Ukraine – and we will impose economic sanctions for these actions.”
Global Affairs Minister Melanie Joly tweeted that Canada is preparing to impose economic sanctions for Monday’s action by Russia. These will be separate from sanctions that would be imposed by “any further military invasion of Ukraine by Russia.”
Canada has already imposed some sanctions on Russia stemming from its 2014 occupation of the Crimea region of Ukraine, a move this country has called an illegal annexation.
Russian state actors or Russian-sponsored proxies may retaliate in cyberspace against Canada for the economic sanctions announced yesterday, said Dave Masson, Canadian-based director of enterprise security at Darktrace. For Canadian forces deployed in Latvia, Russian cyber aggression will likely include social media disinformation and disruptive attacks on communications and military activity. We could also see full-blown ransomware and DDoS attacks like those used against Ukraine before, he added.
“Recent cyber-attacks on the Office of the Governor-General and Global Affairs Canada demonstrated that government institutions have targets on their backs. In the wake of current political tensions, attackers may launch social media disinformation campaigns to increase polarization and encourage further protests and disruption.”
Canada’s mainstream media should also be wary of disinformation and cyber-threats to sow discontent, disrupt regular coverage, and distract audiences, Masson said. Like political figures, journalists could find their work disrupted by destructive cyber-attacks like wipers disguised as ransomware. Given the recent threat bulletin from the Candian Centre for Cyber Security and the recent cyber-attack on Vodafone Portugal, we may also see attackers exploit zero-day vulnerabilities within the Canadian telecommunications network.
