Positive Technologies senior analyst Darya Lavrova has warned businesses to prepare for losing control of their digital channels after cyberattacks hit two Russian government agencies in early November.
Speaking to the Russian business publication Inc., Lavrova, a senior analyst in the international analytics group at Positive Technologies, said companies must plan ahead for more than data leaks. A cyberattack can bring down a website, halt sales or turn a familiar mobile app into a source of fake news.
When a website fails to open and an application sends messages in an organisation's name, customers do not know what to believe. Lavrova noted that the fallout for a business can be far worse than a few hours offline because sales, client relationships and reputation are all put at risk.
Lavrova said that companies' growing reliance on digital services expands the attack surface of their infrastructure. According to the analyst, attackers' goals can range from causing financial damage to carrying out mass disinformation campaigns.
November cyberattacks on Russian state agencies
Two Russian state organisations faced those scenarios in early November. On the night of November 2, Russia's Ministry of Emergency Situations, known as EMERCOM, reported a cyberattack on its mobile application after false notifications were sent to users claiming nuclear warheads had been launched at Russian territory. The ministry confirmed the hack and began work to restore the app.
EMERCOM, the federal agency responsible for civil defence and emergency warning systems in Russia, assured the public that its main alert network continued to operate normally. Officials said the app is only a supplementary channel, and sirens, loudspeakers, SMS alerts, television and radio broadcasts were unaffected. Residents were advised to verify alerts through other official sources.
In a separate case focusing on infrastructure availability, Russia's Federal State Statistics Service, known as Rosstat, reported targeted cyberattacks on its information resources from October 29 to November 1. Rosstat, which collects and publishes official economic and population statistics in Russia, said its monitoring systems detected suspicious activity and responded in time.
The agency stated that no database compromise or leak of legally protected information had been found, though Rosstat's website remained offline. There is no public confirmation of any link between the attacks, which show how digital infrastructure can be targeted in different ways.
Cyber threats facing online business infrastructure
Positive Technologies, a Moscow-based cybersecurity company that specialises in threat intelligence and incident response, tracks how hackers target corporate networks. According to Lavrova, businesses that rely on online infrastructure face three main types of cyber threats.
The first is taking web resources offline using distributed denial-of-service, or DDoS, attacks and website defacement. A DDoS attack floods a server with traffic to knock it offline, while defacement alters a site's pages. For companies whose website is their main sales or service channel, this brings direct financial losses and reputational damage.
The second threat is unauthorised access to infrastructure through contractors such as IT integrators, online service developers and web hosting providers. Compromising a third-party vendor can give attackers access to the resources of several clients at once, creating risks of confidential data leaks and interference in business processes.
The third threat is the compromise of mass notification channels. Attackers use a trusted service, such as an official app or mailing list, to spread false information. Lavrova said this scenario is dangerous because of its scale and because users may treat the message as official.
How businesses can prepare for cyberattacks
Lavrova recommended that companies go beyond protecting their primary website or application and build an action plan in advance in case their digital channels are compromised.
First, businesses must designate a trusted source of information, meaning a secure official resource where customers can find verified messages. Companies should also set up backup communication channels on separate infrastructure, such as a website on a different domain or a telephone hotline, so they can inform customers even if the main service is unavailable or in doubt.
To detect a breach in time, Lavrova advised using behavioural monitoring and anomaly detection mechanisms alongside two-factor authentication, which requires two forms of identity verification at login. Alerts on suspicious activity should help staff spot a compromise quickly and suspend a service if necessary.
Businesses should also prepare an incident response plan that covers shutting down the compromised resource, informing users through backup channels and issuing clear instructions. Lavrova specifically noted that companies need to stay in contact with key clients during the first hour after detecting an incident.
Finally, companies should hold regular cyber drills to practise handling a service hack, the spread of false messages and decision-making in a crisis. Lavrova said businesses must work not only to restore their infrastructure, but also to rebuild user trust in official communication channels.
