Ukraine’s largest mobile network operator hit by massive cyberattack amid ongoing conflict with Russia

12/15/2023 / By Laura Harris

Kyivstar, the largest mobile network operator in Ukraine, has just been hit by the biggest cyberattack to affect the network since the beginning of Russia’s special military operation in the country in late February 2022.

The attack, which happened on Dec. 12, disrupted services, damaged information technology infrastructure and threatened the safety of the 24.8 million subscribers who rely on the network for alerts, particularly regarding potential Russian air assaults. The disruption affected air raid alert systems in over 75 settlements surrounding Kyiv and throughout northern Ukraine, particularly in the Sumy region to the northeast, where air raid services experienced outages.

“Due to a malfunction of the Kyivstar operator, the air alert system will temporarily be out of service in the territory of the Sumy city territorial community,” the local administration for Sumy said in a statement.

Sumy officials assured residents that alternative notification measures would be put in place when air raid alerts needed to be broadcast. Mobile network-based notification systems are crucial for Ukrainians, providing them with early warning for possible Russian air assaults.

According to Oleksandr Komarov, the CEO of Kyivstar, the cyberattack inflicted damage on the IT structure of the company, compelling them to shut down network connections to contain the incident. (Related: Cybersecurity official warns: Americans must prepare for CYBERATTACKS from Chinese hackers.)

“War is also happening in cyberspace. Unfortunately, we have been hit as a result of this war. [The attack] significantly damaged [our] infrastructure, limited access, we could not counter it at the virtual level, so we shut down Kyivstar physically to limit the enemy’s access,” he told the national television.

The Security Service of Ukraine swiftly launched a criminal probe into the incident and explored the possibility of Russian special services being behind the hacker attack.

Ukraine accused Russia of hacking essential infrastructures in the country

An anonymous source close to the cyber defense agency of Ukraine claimed that the attack bore the hallmarks of a state actor, with data cable interception revealing a significant volume of Russian-controlled traffic directed at Ukrainian networks.

The absence of a ransom demand further fueled suspicions that the cyberattack was politically motivated rather than financially driven.

John Jultquist, a chief analyst at the Google-owned cybersecurity firm Mandiant, claimed that Ukrainian telecom firms have been a target of Russian hacking groups for years, including a notorious group linked with Russia’s military intelligence agency.

This sector “is often targeted by cyber espionage actors seeking to quietly gather intelligence but attacks can have serious military consequences as well as psychological impacts on the populace,” Hultquist said.

Komarov speculated on potential motives behind the attack, including disrupting the visit of President Volodymyr Zelensky to the United States and impacting energy blackouts in Ukraine.

This cyberattack adds to a series of digital assaults on Ukrainian critical infrastructure since the full-scale invasion of Russia nearly two years ago. The impact of cyberattacks during times of conflict is challenging to assess accurately due to the fog of war.

This cyberattack follows a pattern of accusations against Russia for orchestrating similar attacks on Ukrainian entities throughout the conflict.

Victor Zhora, a former top Ukrainian cyber official, posted on X that the Kyivstar hacking “seems to be the most effective attack in Ukraine” since the invasion in 2022. Oleh Derevianko, co-founder of Ukrainian cybersecurity firm ISSP, supported the claims of Zhora. He said an attack of this magnitude requires extensive preparation and execution.

Learn more about cyber attacks and other cybercrime and hacking incidents at CyberWar.news.

Watch this video warning about how one sophisticated cyberattack could be enough to bring down Europe’s banking system.

This video is from the Alex Hammer channel on Brighteon.com.