Ukrainian military internet provider hit by major cyberattack

Ukrainian military internet provider hit by major cyberattack

A Ukrainian internet service provider used by the country’s military suffered a massive cyberattack on Monday, Ukrainian officials said, stoking fears that Russia plans to use more dangerous digital weapons as the war drags into its second month.

The attack on Ukrtelecom PJSC has been described by some experts as one of the most damaging cyber attacks since the Russian invasion of Ukraine on February 24. Around 3:30 p.m. ET on Monday, Ukrainian officials said they had repelled the attack and that the company could restore services, according to a statement from Ukraine’s State Service for Special Communications and Information Protection, which is in charge of cybersecurity in the country.

The statement by the Ukrainian cyber agency did not say who was responsible for the cyber attack. Security experts said that Russia-linked hackers have launched a variety of cyberattacks against financial services companies, internet service providers and government agencies since this February, leading up to and after the February 24 invasion.

Russia has denied involvement in cyber attacks.

According to its own information, Ukrtelecom is the largest provider of landline telephone services in Ukraine. It’s the seventh-biggest ISP in the country, said Doug Madory, director of internet analytics at network monitoring firm Kentik Inc.

Ukrainian residents survey the aftermath as Russian missiles continue to hit Kyiv, Kharkiv and other cities across the country. Another round of ceasefire talks is scheduled to begin in Turkey on Tuesday. Photo: Anastasia Vlasova/Getty Images

Ukrtelecom’s ability to connect to the Internet to provide services to customers began declining around 5 a.m. ET and gradually fell throughout Monday, according to data from the Georgia Institute of Technology’s Internet Outage Detection and Analysis Project , which monitors Internet failures. Within five hours, the company was almost completely offline, Mr. Madory said.

After the attack began, the company began reducing service to the majority of its business and consumer customers to preserve capacity for its military customers, SSSCIP said.

As of 4:30 p.m. ET, about 8% of the Ukrtelecom networks measured by the Georgia Tech Internet Outage Project were online.

Ukrtelecom did not respond with a request for comment, but the company confirmed service outages in a post Monday on its Facebook page and said it was working to restore stable service as soon as possible.

The disruption was confirmed by several groups monitoring internet traffic. Netblocks, an internet observatory that has tracked previous outages in Ukraine, said on twitter This network data showed “an ongoing and increasing disruption in service at a national level, which is the most severe since the Russian invasion.”

WSJ Pro Cyber ​​Security

Cybersecurity news, analysis and insights from the WSJ’s global team of reporters and editors.

Cybersecurity experts and US officials were surprised that no major disruptive or destructive cyberattacks took place during the Ukraine conflict as Russia is widely regarded as one of the most capable state-sponsored hacking groups in the world and Moscow has previously been blamed for launching cyberattacks, disrupting the Ukrainian government, electricity grid and financial services.

Malicious cyber activities are largely limited to website service disruptions and limited use of so-called wiper malware, which can destroy computer files. Nonetheless, US officials are increasingly concerned that Moscow could lash out either in Ukraine or against the West in response to its fighting on the battlefield and punishment of sanctions imposed by the US and Europe.

Last week, President Biden said there was new evidence suggesting Russia was exploring options to attack the US with cyberattacks.

write to Robert McMillan at [email protected] and Dustin Volz at [email protected]

Copyright ©2022 Dow Jones & Company, Inc. All rights reserved. 87990cbe856818d5eddac44c7b1cdeb8

Appeared in the print edition of March 29, 2022 as “Ukrainian military internet providers attacked”.