Mari-Liis Rüütsalu, CEO of Ekspress Grupp, whose sites were impacted by the attacks, said that malicious hackers had been more active in recent weeks than previously was the case, though the phenomenon itself was not out-of-the-ordinary.

Rüütsalu told ERR's radio news that:  "Estonian media houses coming under cyber-attack has been a common occurrence in recent years."

The incidents: "Generate a lot of requests on our servers, from foreign countries, causing loads to rise dramatically, so that those readers who want to visit news sites in the normal way are unable to."

"We have been able to repel most of these attacks, but in recent weeks they have become highly intensive. There are more of them, and they bring a greater burden," she continued.

"While with each attack, we become smarter on how to block them, the hackers are always one step ahead of us," Rüütsalu went on.

Rüütsalu said it was not clear whether Friday morning's attack was a Distributed Denial of Service (DdoS) attack such as that experienced, and successfully headed off, last Wednesday evening, or another strategy.

The attacks not only put Ekspress Grupp titles offline for a time, but also those of rival publishers the Postimees Grupp and Õhtuleht, she added.

As to dealing with cyber-attacks, Rüütsalu said: "The first thing tech support at a media house tries to do is understand the attacks' countries of origin, in order to exclude that area from external network traffic." 

Perhaps unsurprisingly, "Attacks from Russia have prevailed in recent weeks," Rüütsalu continued.

Once an attacker is isolated, those countries will be restored to network traffic one-by-one, she noted. "Our priority is to bring access for the Nordic countries and the Baltic countries, because many Estonians live there."

As to to the future, Ekspress Grupp has no plans to permanently remove Russia from the coverage area at present. 

"When cyber-attacks happen, Russia will be the first region to be shut down. We have not done this permanently, however. In fact, Russia itself has restricted the access of its own citizens to [Ekspress Group-operated portal] Delfi," Rüütsalu went on.

"Lithuania has been under the highest volume attacks since February 24, Latvia has, measure-for-measure, been under fewer attacks, while now the attacks on Estonia have intensified and become smarter."

Rüütsalu said that Ekspress Grupp's tech staff constantly communicate with the State Information System Agency (RIA), loosely analogue to the the U.S. authority the NSA, or the U.K.'s GCHQ, on the topic of cyber attacks. 

"Since February 24, we have been in an active discussion with the state regarding the media. It is true that private media is not a nationally critical service [as things stand]. I would like to be able to open that debate with the state," Rüütsalu went on, reiterating that so far as she is aware, cyber-attacks on all Estonian media houses have intensified in recent weeks.

Last week's attack followed the removal and relocation of a Soviet-era war memorial, a T-34-type tank, which is now housed in the national war museum but had for over half-a-century been on public display on a roadside plinth, between Narva and Narva-Jõesuu.

Ekspress Grupp publishes two weeklies, Eesti Ekspress and Maaleht, daily Eesti Päevaleht, all of which have websites as well as print versions, along with portal Delfi and several other publications.

--

Follow ERR News on Facebook and Twitter and never miss an update!