According to a report from Microsoft, Russia is preparing for another cyber war against Ukraine

According to a Microsoft research report, Russian hackers appear to be preparing a new wave of cyber attacks on Ukraine.

On Wednesday, the tech giant’s cybersecurity research and analysis team outlined a series of discoveries about how Russian hackers operated during the conflict in Ukraine and what might come next.

“Since January 2023, Microsoft has determined that Russian cyber threat activity has adapted to increase destructive and intelligence capabilities on the civilian and military assets of Ukraine and its partners,” the report said.

One group “appears to be preparing for yet another destructive campaign”.

Microsoft noted that a sophisticated Russian hacking team called Sandworm was “testing additional ransomware-style capabilities that could be used in destructive attacks against non-Ukrainian organizations that perform key functions in Ukraine’s supply chains.”

In a ransomware attack, hackers usually break into an organization, encrypt the data, and extort a fee to regain access.

Historically, ransomware has also been used as a cover for more malicious cyber activities, including so-called wipers that simply destroy data.

As of January 2022, Microsoft said it had discovered at least nine different wipers and two types of ransomware variants deployed against more than 100 Ukrainian organizations.

In 2023, Russia has stepped up its espionage attacks, targeting organizations in at least 17 European countries, mostly government agencies. Wiper attacks continue in Ukraine,” said Clint Watts, general manager of Microsoft’s Digital Threat Analysis Center.

These developments are accompanied by an increase in covert Russian cyber operations aimed at directly endangering organizations in countries associated with Ukraine, the report said.

In late November 2022, Microsoft and other security companies identified a new form of ransomware called “Sullivan” being used against Ukrainian targets, alongside the “Prestige” ransomware that Russia deployed in Ukraine and Poland in October 2022.

“Our analysis suggests that Russia will continue to carry out espionage attacks against Ukraine and Ukraine’s partners, as well as destructive attacks inside and possibly outside Ukraine, as was the case with Prestige,” Watts said.

Moscow has also begun spreading propaganda against Ukrainian refugees across Europe, trying to convince them that they could be deported and conscripted into the Ukrainian army.

Russian media promoted protests, backed by a pro-Russian political party, encouraging citizens to demand that the government pay their energy bills in winter.

Another campaign organized by Russia called “Moldova Leaks” published alleged leaks by Moldovan politicians, just one of many hack-and-leak operations designed to sow distrust between European citizens and their governments.

The results come as Russia has sent fresh troops to the battlefield in eastern Ukraine, according to Western security officials.

Ukraine’s Defense Minister Oleksiy Reznikov warned last month that Russia could speed up military activity around the Feb. 24 anniversary of its invasion.

The Russian embassy in Washington did not immediately respond to a Reuters request for comment.