Belarus activist hackers help Ukraine, disrupt Russian trains carrying soldiers to war front

Activist hackers in Belarus have allegedly breached computers that control that country’s trains and brought some to a halt, part of what they say is an effort to disrupt Russian soldiers moving into Ukraine. The Cyber Partisans, as the activist hackers call themselves, said on Sunday that some trains had stopped in the cities of Minsk and Orsha, as well as in the town of Osipovichi, after its hackers compromised the railway system’s routing and switching devices and rendered them inoperable by encrypting data stored on them.

Several websites connected to Belarus’s rail network returned error messages on Sunday. However, Bloomberg News couldn’t independently verify the hacking group’s claims.

A former Belarus railway worker, who runs a Telegram channel popular with railway workers in the country, reported that train systems in Minsk and Orsha had been “paralyzed.” In addition, on Belarusian internet forums, some people described disruption to trains in Minsk.

Government representatives in Belarus didn’t respond to requests for comment. A representative for the Russian Embassy in Washington didn’t respond to a message seeking comment.

The Cyber Partisans said the purpose of the attack was to “slow down the transfer” of Russian troops who are traveling from bases in Belarus into northern Ukraine and to buy more time for Ukrainians to repel Russia’s attacks on the country. The hackers said they had put the train system into a “manual control” mode that would “significantly slow down the movement of trains, but will not create emergency situations.”

Sergei Voitehowich, a former employee of Belarus’s state-owned Belarus Railway company who helps operate an online forum for Belarusian railway workers, said that the hackers had damaged a train traffic control system. That had caused disruption to train movements, especially at a junction between Minsk and Orsha, he said.

Voitehowich added that the traffic control system had been restored following the breach but other systems weren’t operating and external train network websites were down. “It is impossible to buy tickets,” he said. “Train movement is very difficult.”

In late January, the Cyber Partisans said they had targeted state-owned Belarusian Railway and encrypted the majority of the company’s servers, databases and workstations. 

The Cyber Partisans have targeted Belarusian government and police agencies with cyberattacks. Last year, they released a data trove that included secret police archives, lists of alleged police informants, personal information about top government officials and spies, video footage gathered from police drones and detention centers and secret recordings of phone calls from a government wiretapping system.

Russia’s invasion of Ukraine has prompted to group to focus on disrupting Russian military movements. Russia has used Belarus as a staging point to enter northern parts of Ukraine. 

The Ukrainian government has actively sought the assistance of volunteer hackers amid the conflict. Groups of technology professionals and others with computing expertise have joined together on social media channels to identify Russian websites and officials to target with cyberattacks.