‘Most Severe’ Cyberattack Since Russian Invasion Crashes Ukraine Internet Provider

A “powerful” cyberattack has hit Ukraine’s biggest fixed line telecommunications company, Ukrtelecom. Described as the most severe cyberattack since the start of the Russian invasion in February, it has sent the company’s services across the country down.

Victor Zhora, deputy head of the State Service for Special Communications and Information Protection, confirmed to Forbes that the government was investigating the attack. He said it’s not yet known whether Ukrtelecom—a telephone, internet and mobile provider—has been hit by a distributed denial of service (DDoS) attack or a deeper, more sophisticated intrusion.

The attack has only been acknowledged by Ukrtelecom in responses to customer comments on Facebook. In one, it responded by saying that services were down as a result of a “powerful cyber attack of the enemy.” When Forbes messaged Ukrtelecom over Facebook, an automated response was provided, reading, “Currently, there are difficulties in using the internet service from Ukrtelecom. Our specialists are doing everything possible to resolve this issue as soon as possible.

“Due to the abnormal load and problems with internal systems, the operators of the contact center and Facebook cannot process customer requests.”

NetBlocks, which tracks internet downtimes across the world, found Ukrtelecom had been dealing with a disrupted service since this morning, “collapsing to 13% of pre-war levels.”

Alp Toker, director of NetBlocks, told Forbes that the “gradual loss of connectivity was a giveaway that it wasn’t a power or cable cut.” He’d tweeted that the attack was the most significant since Russia’s invasion.

“The new attack has cut deep into Ukraine’s connectivity at nation scale and with extended duration and impact,” he told Forbes. “Unlike the spate of cuts and outages in the most heated conflict zones, this one has struck the country’s national operator at its core, and they appear to be struggling to mitigate the incident.”

Ukrtelecom, which claims to be the “largest fixed-line operator in Ukraine,” hadn’t immediately responded to a request for comment at the time of publication. It was once the national provider, but later went private, with the internet market now competitive.

After publication, Zhora’s office said that the attack had been ‘‘neutralized’’ and Ukrtelecom could begin restoring services, adding on Twitter: ‘‘In order to preserve its network infrastructure and to continue providing services to Ukraine’s Armed Forces and other military formations as well as to the customers, Ukrtelecom has temporarily limited providing its services to the majority of private users and business-clients.’’

While the cyber war side of the Russian invasion of Ukraine has been more muted than most expected, it has been ongoing. Telecom companies have been subjected to heavy cyberattacks but have for the most part avoided any serious deleterious effects. As Forbes had previously reported, a smaller internet provider, Triolan, had suffered a breach that saw hackers reset some of its systems to factory settings, hinting at a deep breach of the network.

Last week, Ukraine’s Computer Emergency Response Team (CERT) revealed statistics showing the country had been subjected to 60 different cyberattacks. It said 11 had targeted government and local authorities, with 8 hitting military and law enforcement. Just 4 had hit telecoms and other tech companies. The majority of those cyberattacks focused on information gathering, though a series of “wiper” attacks aimed at destroying data on targeted computers have been launched across Ukrainian entities.

“Despite the growing number of attacks, most of them reach no success,” the CERT found. “Even those that are successful, almost have no impact on the work of the critical infrastructure.”

Ukraine’s telecom companies are also having to keep the internet up in the face of rocket strikes. As a Forbes story revealed, teams were going into bombarded cities, from Kharkiv to Okhtyrka, during the quieter hours to replace and fix equipment.

READ MORE: Ukraine’s Engineers Battle To Keep The Internet Running While Russian Bombs Fall Around Them