Ukrainian telecom, government blame cyberattack for most severe disruption since Russian invasion

The disruption targeted a large service provider in what might be the latest in a string of ongoing intentional internet disruptions.

One of Ukraine’s key internet service providers suffered a significant outage Monday, with both the Ukrainian government and the company blaming a cyberattack.

“Today, the enemy launched a powerful cyberattack against Ukrtelecom’s IT-infrastructure,” Yurii Shchyhol, the Chairman of the State Service of Special Communication and Information Protection of Ukraine said in a statement to reporters Monday.

When asked if “enemy” referred to Russia, he declined to comment.

Shchyhol said the attack had been repelled thanks to the work of specialists from the SSSCIP Ukraine.

Urktelecom’s CEO Yuriy Kurmaz confirmed in a LinkedIn message that the company is in the process of restoring service to all users. The company temporarily shut down service or private users and business customers in order to stop disruption to service for military forces and critical infrastructure, he said.

NetBlocks, a London-based internet accessibility advocacy group that monitors access around the world, tweeted Monday morning U.S. time that connectivity for Ukrtelecom dropped to 13% of pre-war levels as part of an “ongoing and intensifying nation-scale disruption to service, which is the most severe since the invasion by Russia.”

Isik Mater, the director of research at NetBlocks, told CyberScoop that the disruption is the most severe attack on the company — not all of Ukraine’s internet access — since the start of the invasion.

“But going by the public response it is also potentially the most impactful incident more generally,” she said, noting that the Ukrtelecom Facebook page was inundated with more than 1,000 complaints about connectivity.

The main website for the company remained inaccessible as of 2:50 p.m. ET U.S. time.

Connectivity for Ukrtelecom customers declined over a five-hour period beginning at about 11 a.m. local time in Ukraine, according to Doug Madory, the director of internet analysis at Kentik.

Ukrtelecom is seventh among Ukrainian telecom providers in terms of their volume of traffic, Madory added in a subsequent tweet. But also one of the key providers in rural parts of the country.

Ukrainian networks have been targeted by Russian government hackers for years. The activity intensified ahead of the Feb. 24 Russian military attack, including wiper malware designed to destory data, website defacements, DDoS attacks and an attack on modems provided by U.S. company Viasat targeting Ukrainian communication networks that’s spilled into other countries. As part of regular briefings with international reporters, Zhora has described ongoing hacker efforts to target Ukrainian logistics and humanitarian efforts amid ongoing DDoS disruptions.

Updated 3/28/22: with additional information from Ukrtelecom and SSSCIP Ukraine.

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

Over a dozen law enforcement agencies took action earlier this week, resulting in multiple arrests.

Russian military intelligence may have deployed wiper against multiple Ukrainian ISPs

Russian hacking operations target Ukrainian law enforcement

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure