Cyberattack disables many Georgian websites

Yesterday, on October 28, 2019, the media reported about massive attacks on the Georgian segment of the Internet. The cyberattack disabled many Georgian sites: for example, unknown attackers defaced Georgian president website, governmental resources and interfered in the work of local media.

Imedi spokesman Irakli Chikhladze told Facebook that due to the attack, the channel’s internal network had not worked for about 20 minutes, and television broadcasts were interrupted.

“Today’s cyber-attack caused quite a panic in the small Caucasian country, although the attack wasn’t particularly sophisticated. In cyber-security terms, this is a classic “website defacement,” a type of hack where attackers replace the website’s original content with their own content, usually for a particular cause”, — write ZDNet journalists.

Many sites, including governmental resources, were compromised: attackers posted a picture of former Georgian President Mikheil Saakashvili on them with the caption “I’ll be back”.

Irina Shengelia, Media Advisor of the President of Georgia, Salome Zurabishvili, said that an investigation has already been launched, and the Georgian Ministry of Internal Affairs has opened a criminal case under Articles 284 (unauthorized entry into a computer system) and 286 (encroachment on computer data or (and) computer system) of the Georgian Criminal Code .

Read also: Fraudsters blackmail companies with DDoS attacks and impersonate Fancy Bear

ZDNet notes that the massive attacks seem to have been related to the compromise of the local hosting provider PRO-Service, whose services are used by government agencies, the private sector and media organizations.

A statement has indeed appeared on the company’s official website. Representatives of PRO-Service write that the incident affected approximately 15,000 customers, but as of 20:00 October 28, more than 50% of the pages hosted on the company’s servers were restored. It is expected that the final restoration of the functionality of sites will end in the evening, October 29, 2019.

It is still unknown who exactly was behind this mass attack, and what goals the attackers pursued.

“This attack is not unique. During the five-day Russo-Georgian War of 2008, Georgia saw a series of similar attacks. For example, Russian hackers used BGP hijacking to reroute Georgian internet traffic through servers in Russia, defaced government websites, and hacked TV and radio stations”, — writes ZDNet.