• According to Russian media, an official announcement about the closure of the Xbox office is expected soon. It is assumed that Microsoft may announce it on June 30, 2022.
• According to media, future Microsoft games for Xbox Series X|S and PC, which were announced for release in Russian, will be localized. However, it is unknown what will happen to future projects because the company has announced its withdrawal from the Russian market.
• In March 2022, Microsoft suspended all new sales of Xbox Series X|S and new accessories to retailers in Russia. At the same time, the generation of new Xbox Live Gold and Xbox Game Pass cards and codes for the Russian region was stopped.
• Russian media suggest that warranty service for previously sold consoles will also be canceled, or users will be asked to send products to service centers in other countries.

“When it comes to Russia, we, like everyone else, are basically seeing our business narrow and narrow and narrow and narrow until, eventually, there’s barely or there may be nothing there. We do want to take care of the people who work for our company, and we’re trying to be mindful of how to provide them with the kind of support I think they need and deserve because they’re not the ones who started this war. But, at the same time, there’s a clear path forward,” Brad Smith, president and vice chair of Microsoft, commented in the interview for The Washington Post.

Brief overview

• The Russian invasion relies in part on a cyber strategy that includes at least three distinct and sometimes coordinated efforts—destructive cyberattacks within Ukraine, network penetration and espionage outside Ukraine, and cyber influence operations targeting people around the world.
• On several occasions the Russian military has coupled its cyberattacks with conventional weapons aimed at the same targets in Ukraine.
• Microsoft detected Russian network intrusion efforts on 128 organizations in 42 countries outside Ukraine. The most efforts of Russian cyber troops were concentrated on the strongest allies of Ukraine: the United States, Poland, Baltic countries, Scandinavia, and Turkey.
• Since the start of the war, the Russian targeting has been successful 29 percent of the time.
• The report also unveils detail about sophisticated and widespread Russian foreign influence operations being used among other things, to undermine Western unity and bolster their war efforts.
• Many current Russian cyber influence operations currently go for months without proper detection, analysis, or public reporting.

Cyber War in Ukraine

While most reports state that the war in Ukraine started on February 24 of this year, in fact the first cyberattacks were fired the day before. The first weapon to be fired was the wiper software that we call “Foxblade.” Microsoft’s Threat Intelligence Center (MSTIC) has detected its launch against 19 government and critical infrastructure entities across Ukraine. It was developed and launched by the same group associated with Russian military intelligence that developed and launched the NotPetya attack against Ukraine in 2017.

Since the war began, MSTIC has detected multiple attempts to use eight distinct malware programs—some wipers and some other forms of destructive malware—against 48 different Ukrainian agencies and enterprises.

On several occasions the Russian military has coupled its cyberattacks with conventional weapons aimed at the same targets. Like the combination of naval and ground forces long used in an amphibious invasion, the war in Ukraine has witnessed Russian use of cyberattacks to disable computer networks at a target before seeking to overrun it with ground troops or aerial or missile attacks.

Russia attacks the whole World

As a coalition of countries has come together to defend Ukraine, Russian intelligence agencies have stepped up their network penetration and espionage activities targeting governments outside Ukraine. Not surprisingly, this increase appears to be most focused on obtaining information from inside the governments that are playing critical roles in the West’s response to the war.

Since the war began, MSTIC has detected Russian network intrusion efforts on 128 targets in 42 countries outside Ukraine.

While these targets are spread around the globe, 63 percent of this observed activity has involved NATO members.

• Russian cyber espionage efforts have focused on targets in the United States more than any other country, with American targets representing 12 percent of the global total outside Ukraine.
• At the top of this list is Poland, with 8 percent of intrusions, where the delivery of a majority of military and humanitarian aid is coordinated.
• The Baltic countries of Latvia and Lithuania represent a combined 14 percent of total intrusions outside Ukraine. (In contrast, in Estonia, the third Baltic border country, where the country has adopted cloud services, we’ve detected no Russian cyber intrusions since the onset of the Ukraine war.)
• Russian cyber activities have also actively targeted Denmark, Norway, Finland, and Sweden. These collectively represent nearly 16 percent of all the observed Russian attacks globally.

Since the start of the war in Ukraine, MSTIC’s detections have found that Russian actors have been successful 29 percent of the time. In a quarter of these successful intrusions, MSTIC identified incidents that led to the successful exfiltration of an organization’s data.

Russian Cyber Influence Operations

Russian agencies are deploying cyber influence operations that are designed to support its war aims. These involve sophisticated and coordinated efforts to use digital technologies and the internet to create and spread false narratives to advance multiple goals. 

The Soviet Union long invested in and even excelled in sowing doubt, chaos, or confusion in other countries. One of numerous examples involved work in the early 1980s to blame the United States for the spread of AIDS. For example, in July of 1983, an anonymous letter appeared in The Patriot, an obscure Indian newspaper. The letter stated that the United States was moving its lab operations to Pakistan, thus putting the Indian people at greater risk.

To support the war in Ukraine, the Russian government is deploying a new generation of technology and tactics to support cyber influence operations. And, unfortunately, especially when pursued with patience and persistence, these cyber influence operations are almost perfectly positioned to take advantage of the longstanding openness of democratic societies and the public polarization that is characteristic of current times.

The Russian government currently is deploying an expanding cyber influence operation to support its war efforts in Ukraine. These appear to be focused on four distinct audiences.

• They target the domestic Russian population with the goal of sustaining support for the war by portraying Ukraine’s military as responsible for the conflict.
• They target the Ukrainian population with the goal of undermining confidence in the country’s willingness and ability to withstand Russian attacks.
• They target American and European audiences to diminish Western unity and deflect criticism of Russian military war crimes.
• And they target nonaligned countries to support Russian efforts at the United Nations and in other venues, combining longstanding narratives demonizing democracy and Western intentions and with emerging efforts to blame the west for potential food shortages.

Agencies across the Russian government are targeting each audience in textbook fashion through cyber influence operations. 

The tactics developed by the KGB over several decades are nowadays combined with new digital technologies and the internet to give foreign influence operations a broader geographic reach, higher volume, more precise targeting, and greater speed and agility. 

For instance, this approach was applied beginning in late 2021 to support the Russian false narrative around purported bioweapons and biolabs in Ukraine. This narrative was first uploaded on to YouTube on November 29, 2021, as part of a regular English-language show by a Moscow-based American expatriate who claimed that US-funded biolabs in Ukraine were connected to bioweapons. The story went largely unnoticed for months.

On February 24, 2022, just as Russian tanks crossed the border, this narrative was sent into battle. A data analytics team at Microsoft has identified 10 Russian- controlled or influenced news sites that simultaneously published reports on February 24 pointing back to “last year’s report” and seeking to give it credence. Russian- sponsored teams then worked to amplify the narrative on social media and internet sites more broadly.

The two graphs below show that consumption of narratives from Russian-controlled and -sponsored sites across the internet rose sharply in both Ukraine and the United States in the initial weeks after the war began. The surge in Ukraine represents an increase of 216 percent, while the spread of Russian propaganda in the United States increased by 82 percent.

Using internet data and these techniques, it’s also possible to identify the social media, search, and other sites that are being used to encourage and channel traffic to these stories. And it’s possible to identify, as shown below, the specific reports and narratives that attain the highest consumption levels in specific geographies and time periods.

Conclusions

The lessons from Ukraine call for a coordinated and comprehensive strategy to strengthen defenses against the full range of cyber destructive, espionage, and influence operations. As the war in Ukraine illustrates, while there are differences among these threats, the Russian government does not pursue them as separate efforts and we should not put them in separate analytical silos. In addition, defensive strategies must consider the coordination of these cyber operations with kinetic military operations, as witnessed in Ukraine.

• The first defensive tenet should recognize that Russian cyber threats are being advanced by a common set of actors inside and outside the Russian government and rely on similar digital tactics. As a result, advances in digital technology, AI, and data will be needed to counter them.
• Reflecting this, a second tenet should recognize that unlike the traditional threats of the past, cyber responses must rely on greater public and private collaboration.
• A third tenet should embrace the need for close and common multilateral collaboration among governments to protect open and democratic societies.
• And a fourth and final defensive tenet should uphold free expression and avoid censorship in democratic societies, even as new steps are needed to address the full range of cyber threats that include cyber influence operations.

The war in Ukraine provides not only lessons but a call to action for effective measures that will be vital to the protection of democracy’s future.

Check out the full version of the report, Defending Ukraine: Early Lessons from the Cyber War.

What is PUA?

Potentially unwanted applications are not malicious like viruses but can cause your device to run slowly, display unexpected ads, or install other software. PUAs include torrent clients, mining programs, marketing software that monitors user activity and transfers this data to third parties, so-called bundles — programs that offer to install other unrelated applications, and others.

The option to block such applications was added to the OS back in May 2020. However, from August 2021, such apps will be blocked by default by Windows 10 security systems.

How to enable them

There are two options: deactivate PUA blocking or add the necessary programs to the exclusions in Windows 10 Defender.

How to turn off the PUA blocking:

• Go to Windows Security and then to App & browser control.
• After that, find the section Reputation-based protection and select Reputation-based protection settings.
• Then find there the Block potentially unwanted application option and set its settings as you need:

How to add the desired programs in Windows Defender exclusions:

• Go to Windows Security and then to Virus & threat protection.
• Under Virus & threat protection, select Manage settings.
• Under Exclusions, select Add or remove exclusions.

According According to Bloomberg, these gift codes were often sold on reseller markets at a lower price. This reselling phenomenon can be traced to Volodymyr Kvashuk, a Ukrainian who lived in the US and, being a Microsoft employee, had unlimited access to the generation of such codes.

Testing of the payment system did find glitches

Volodymyr Kvashuk moved to the United States and got a job at Microsoft in 2017. Among his job duties was to test the payments system in the company’s stores. He “bought” a Dell laptop on the website, paid for it with a faux credit card, and documented errors. The system made the purchase and sent notifications, but the money was not debited, and the order was not shipped. After all, all these actions were only necessary to test the system.

In the winter of 2017, Kvashuk found that unlike buying physical products, every time he checked gift card purchases, the Microsoft Store sent real gift codes. The money was still not deducted, and the tester could generate an almost unlimited number of cards.

He realized that his team’s experimental accounts were programmed only to prevent them from sending fake purchases of physical goods such as PCs, tablets, keyboards, etc. Microsoft simply didn’t plan for its digital retail testers to order Xbox gift cards on the job. Kvashuk could have reported the vulnerability to his management, but instead, he started reselling them.

Underground business affecting global prices for the gift cards

Kvashuk started small, generating Xbox cards in increments from $10 to $100. But by the time federal agents arrested him almost two years later, he had stolen more than 152,000 Xbox gift cards, worth $10.1 million, and was living off the proceeds in a lakefront home with plans to buy a ski chalet, yacht, and seaplane.

In January 2018, Kvashuk built a computer program, PurchaseFlow.CS, to sell a really large number of gift cards. With a few clicks in the app, he could select a gift card denomination (30, 75, 100), the currency output (USD, EUR, GBP), and the desired number of purchases. Prosecutors later said the program was “created for one purpose, and one purpose only: to automate embezzlement and allow fraud and theft on a massive scale.”

At one point, Kvashuk reached such volumes that prosecutors said it began to influence global price fluctuations for Xbox gift cards on reseller markets. When prices dropped too low because of an oversupply of codes on the market, he would stop in the hope the lack of product would push the market upward.

Kvashuk bought a red Tesla Model S for $162,899 and then a modern house for $1.675 million. He explained his expenses are disproportionate to the income he earned by investing in cryptocurrencies.

Microsoft knew about the scam but couldn’t figure out the scammer

Kvashuk was very careful. Usually, he and his colleagues switched between a couple of fake profiles that they registered in the Microsoft store. To conceal his identity, Kvashuk figured out his colleagues’ passwords and used their test logins. Also, he masked his Internet traffic by routing it through servers in Japan and Russia.

But in February 2018, Microsoft’s Fraud Investigation Strike Team noticed an unexplained spike in online purchases using gift card codes that was about double normal redemption levels. Investigators assumed that the hack came from an “external bad actor” but soon realized that it was an inside job.

In March, corporate investigators traced the irregular activity to two internal test accounts assigned to Microsoft sales employees. The accounts, they learned, had already gobbled up almost $8 million in codes that were selling on the reseller markets.

Investigators questioned the employees behind those test accounts, who seemed like stunned victims, not perps. Microsoft determined that a testing program called Fiddler, which employees used to file bug reports, contained data divulging tester logins. Anyone with Fiddler access could have hacked the accounts.

The company soon discovered that one of Kvashuk’s accounts had bought three Nvidia graphics cards that had been shipped to a non-existent address. When asked whether he used the test accounts to generate codes, Kvashuk admitted to redeeming about 600 of them, but only for buying movies from the Microsoft store. Four weeks later, Microsoft fired Kvashuk.

FBI, searches, and jail

For a seemingly sophisticated engineer, Kvashuk had made many mistakes. Although he cloaked his address through international servers, he used the same Linux-based computer with the same outdated version of the Firefox browser to commit the theft. In addition, the Microsoft Office license he bought at the start of his scam was registered to an administrative account for SearchDom, his startup. This circumstantial evidence allowed Microsoft to link him to the crime.

Soon, federal agents, who had conducted their own investigation into Kvashuk after Microsoft referred the case to them, searched his home and found a lot of incriminating evidence, such as crypto wallet keys, notebooks with bank account information, USB drives stuffed with stolen codes, and lots of cash.

The agents also found a list of Kvashuk’s future investments. The list was written in Ukrainian and was titled: “How I will manage my next 10 million.”

In February 2020, federal prosecutors from the Western District of Washington brought Kvashuk to trial for money laundering, identity theft, mail fraud, and filing false tax returns.

Kvashuk’s attorneys argued that their client did not intend to defraud anyone. He generated the gift card codes to help the company because the more free gifts Xbox gave away, the more popular the platform would be, which would increase overall costs.

The judge and jury found his defense ridiculous and declared him guilty on all counts. He’s likely to be deported back to Ukraine after serving time in prison until March 2027 and will have to pay back $8.3 million.

As ITC.UA reports, these are real shares, just like those listed on foreign exchanges. So you can invest in them and receive dividends.

In total, stocks of 14 foreign issuers are available on PFTS

The cost of shares of these six companies that became available on the PFTS Stock Exchange is:

• Microsoft Corporation (MSFT) — ₴7,581
• Advanced Micro Devices Inc (AMD) — ₴2,324
• Visa Inc. (V) — ₴6,532
• Tesla Inc (TSLA) — ₴21,763
• Netflix Inc (NFLX) — ₴15,974
• Facebook Inc (FB) — ₴8,938

In addition to these companies, shares of eight other foreign issuers are also available on the PFTS Stock Exchange:

• Apple (AAPL)
• Biz Finance (201003920)
• Blackrock Fund Advisers (TLT)
• Equity Residential (EQR)
• Ferrexpro (FXPO, a Ukrainian company but traded on the London Stock Exchange)
• MHP (MHPC, a Ukrainian company but listed on the London Stock Exchange)
• State Street Global Advisors Trust Company (SPY)
• US Department of the Treasury (US9128283)

According to the law, in order to buy securities on the stock exchange, you need to contact an intermediary – an investment company or a broker.

There are the following ones:

• shares of Tesla, Inc. (ISIN code – US88160R1014)
• shares of Facebook Inc. (ISIN code – US30303M1027)
• shares of Netflix Inc. (ISIN code – US64110L1061)
• shares of Microsoft Corporation (ISIN code – US5949181045)
• shares of Advanced Micro Devices, Inc. (ISIN code – US5949181045)
• shares of Advanced Micro Devices, Inc
• shares of Visa, Inc. (ISIN code – US92826C8394)

The corresponding decisions were published on the website of the Commission on December 8.

To recap, in 2017, new rules of the NBU came into force, according to which Ukrainian citizens can officially invest up to $50,000 per year abroad from their Ukrainian bank account. Since then, under these rules, Ukrainians have already bought shares in Facebook.

• Now players from Ukraine can buy a console, but can’t register an account in their region, and choose other countries for this purpose.
• But the official launch of Xbox services will allow them to choose Ukraine as their region of residence, pay for games in the national currency, and get the Ukrainian interface.

“There are preliminary agreements on the launch of Xbox, but it is too early to speak of the terms. We hope to be able to launch it by the end of this year,” Oleksandr Bornyakov, the Deputy Minister of Digital Transformation of Ukraine, explains to AIN.UA.

Representatives of the company and the Ministry of Digital Transformation announced the news at a briefing on October 2.

Deal details

According to AIN.UA data, among other things, this investment will go toward the construction of two data centers of the company in Ukraine. If data are stored inside the country, Ukrainian government agencies will be able to use the cloud services of the company (this requires the adoption of a cloud technology law).

The deal also includes discounts or special conditions for using Microsoft Azure, Office 365, and other cloud services for the Ukrainian government agencies and organizations, educational projects, etc.

According to Mykhailo Fedorov, the Head of the Ministry, the government is considering transferring Diia 2.0 services to Microsoft clouds.

Similar projects abroad

It should be noted that this is not the first such project of the company. In May 2020, Microsoft announced a $1 billion investment in the creation of a new data center and implementation of cloud services for enterprises and government agencies in Poland.

The company also signed a cooperation agreement with Chmura Krajowa (CK), a Poland-based cloud services provider. As part of this project, Polish enterprises will undergo digital transformation in the field of cloud solutions and will train about 150,000 employees and students.

Also, in June 2020, Pawel Borys, the president of the Polish Development Fund, co-founder of Chmura Krajowa ​(CK), announced about $3 billion of investments from Google and Microsoft to Poland over the next few years.

Jan Peter de Jong has arrived in Ukraine and commenced the duties on February 5.  Previously, from the 1st of December, the duties of the CEO of Microsoft Ukraine were performed by Heorhii Randelov, the top manager of the company in the region of Central and Eastern Europe.

Jan Peter de Jong has already indicated that he is the CEO of Microsoft Ukraine on his LinkedIn profile.  According to the data from the account, he previously worked at IBM and was the director of sales of  IT services, as well as the director of development of the company in the region of Central and Eastern-Europe.

UPD: Microsoft representatives confirmed to AIN.UA the information about the appointment of Jan Peter de Jong. The company noted that the manager will be responsible for “strategic growth, transformation of the Ukrainian customers and partners, as well as for the focus on the digitization of the country “. “I am fascinated with the fact that I will lead the Microsoft office in Ukraine. This is an important and growing region in Central and Eastern Europe, ” commented Jan Peter de Jong.