The suspect, who has not been identified by the SBU, was accused of making “thousands” of phone calls to Russian officials, including high-ranking military officials, and sending text messages to Ukrainian officials asking them to surrender. According to Viktor Zhora, a senior cybersecurity official in the Ukrainian government, the seized equipment was used to route Ukrainian mobile phone traffic to Russian networks.
This is the latest development in the ongoing battle over communications networks in Ukraine as the Russian military continues to shell the capital Kyiv. From Moscow to the front lines of the war in Ukraine, the ability to communicate with both troops and citizens has been challenged by suspected Russian and pro-Ukrainian hackers.
Last week, hackers caused disruptions to the Ukrainian ISP Triolan, which has customers in major cities. Triolan blamed the “enemy”, referring to Russia, but provided no evidence to support this claim.
Carmine Cicalese, former chief of cyberspace and information operations at US Army Headquarters, said that functioning mobile networks are of particular importance to non-military personnel in Ukraine who are up in arms against Russia and do not have access to tactical communications.
More broadly, in war, the ability to connect with friends and family is “vital to keeping morale up,” Cicalese, who is currently president of cybersecurity firm Cyber Cic, LLC, told CNN.
In another incident, satellite modems that provide Internet access to tens of thousands of customers in Europe, including in Ukraine, were disabled in a February 24 cyberattack, around the same time that Russian forces launched an offensive into Ukraine, a U.S. official said. Telecommunications provider Viasat, which owns the affected network, told CNN.
Zhora, a Ukrainian official who works for the State Service for Special Communications and Information Protection, told reporters on Tuesday that the satellite hack “was a really huge loss to communications at the very beginning of the war.”
Viasat’s satellite network hack was a “deliberate, isolated and external cyber event” that is being investigated by a third-party cybersecurity firm and “government partners,” Viasat said in a statement.
Chris Phillips, a spokesman for Viasat, told CNN in an email that KA-SAT, Viasat’s satellite network that was the target of the hack, has been “stabilized.” Phillips declined to state how many customers were affected by the incident, calling it a “partial outage.”
Reuters reported for the first time the extent of the Viasat hack and investigation in the United States.
The US government is investigating the Viasat hack as a potential cyber attack sponsored by the Russian state, a US official familiar with the matter told CNN.
The US National Security Agency is “aware of reports of a potential cyberattack that has disabled thousands of very small aperture terminals that receive data to and from the satellite network,” an NSA spokesman told CNN. “We continue to work with inter-agency partners and allies to assess the scope and severity of the incident and provide any relevant experience we have.”