The institutions of Kosovo faced a cyberattack following the announcement by government officials that military support would be offered to Ukraine, which has been at war with Russia since February 2022. According to government officials, the hybrid attack was carried out by Russia on May 7.
As a result of the Russian hacker attack, the official websites of the Presidency and the Prime Minister's Office were temporarily out of service. Referring to a statement by the Minister of Defense, Ejup Maqedonci, the Russian hackers posted a message stating that Kosovo should carefully consider whether it is ready to support Ukraine.
"Kosovo is ready to join collective efforts to support Ukraine's defense. They should think more about this...", read the message in Russian, which was removed after some time when the official websites were restored.
The message from Russian hackers
Minister Maqedonci stated that the attack occurred following statements he made at a conference in Poland, "Defense 24", where he spoke about the assistance that could be offered to Ukraine in facing Russian aggression.
"This group of Russian hackers has launched a cyberattack against Kosovo, as retaliation for my statement in support of Ukraine," Maqedonci said.
Although she did not offer many details about the attack, Kosovo's Foreign Minister, Donika Gërvalla, wrote on Platform "X" that the Russian state caused the hybrid attack.
“Russia is attacking Kosovo in a hybrid attack today, following our announcement of support in military equipment for Ukraine in its justified defense against Russian genocidal aggression. We know from Serbia's genocide against Kosovo that only military means do halt genocide," Gërvalla wrote.
Even though it does not recognize its statehood, Kosovo showed solidarity with Ukraine by aligning itself with Western countries in imposing sanctions on Russia. As part of this support, Kosovo also provided shelter to several journalists from Ukraine.
During the past two years, Kosovo has been a target of cyber attacks and bomb threats aimed at destabilizing the country and creating panic among the population.
According to Sbunker's research, the majority of the attacks occurred during the spring of 2022, targeting some of the most frequented public places such as public schools, the University of Prishtina, and Prishtina International Airport. These threats occurred at a difficult time for the country, when tensions in the north were high.
Government systems faced Distributed Denial of Service (DdoS) cyberattacks, causing temporary disruptions in internet service within institutions and a lack of access to some government services. The website of the Prime Minister's Office, several ministries, the Kosovo Police, the e-Kosovo Platform, and several media outlets were targeted in cyberattacks.
In addition to cyberattacks, Russian officials have mentioned Kosovo in a negative context in some cases, claiming that Albanian mercenaries are fighting alongside Ukrainians. Furthermore, in an attempt to justify the annexation of regions in Eastern Ukraine, Russians have referenced the case of Kosovo, accusing NATO of forcibly detaching Kosovo from Serbia.
Russia's efforts to spread conflict in the Western Balkans region have been denounced in several instances. Last year, Prime Minister Albin Kurti accused "Russia's allies" of influencing the normalization process between Kosovo and Serbia through disinformation and other malicious behavior in the cyber domain.
"During this sensitive time, when our state is committed to the mediation process facilitated by the European Union and the United States to normalize relations with our northern neighbor, Serbia, as well as to the full inclusion of minorities in the democratic processes of the state, without external influence, these cyber threats, as well as disinformation, cyberbullying, and other forms, are particularly defining," Kurti had declared.
*This article is published as part of the Western Balkans Regional Initiative against disinformation. “Western Balkans Anti-Disinformation Hub: exposing malign influences through watchdog journalism.”
