How Ukraine 'Neutralized' A Russian Cyberattack on Its Mobile and Internet Service

After weeks of comments about the absence of Russian cyberattacks on Ukraine - as well as on the resilience of  networks hit by missiles and artillery - a 'nation-scale' cyberattack was launched against one of Ukraine's more vulnerable systems which largely serves rural customers. 

Both the company running the service and the Ukrainian government responded to the attack and were able to begin restoring service within a day. Which is pretty impressive for a country under relentless military assault. JL 

Kyle Alspach reports in Venture Beat:

The the cyberattack was a “nation-scale disruption to service, which is the most severe registered since the invasion by Russia.” Ukrtelecom is the seventh-largest internet service provider in Ukraine, based on volume of traffic. “They are likely the only provider available in rural parts of the country.” “Specialists from SSSCIP Ukraine promptly reacted to the situation, due to which the attack was repelled. And now Ukrtelecom internet connectivity is being restored."

A “massive” cyberattack today against Ukrtelecom, a major mobile service and internet provider in Ukraine, has now been “neutralized,” a Ukrainian government agency said.

“Today, the enemy launched a powerful cyberattack against Ukrtelecom’s IT-infrastructure,” the State Service of Special Communication and Information Protection (SSSCIP) of Ukraine said in a statement provided by email.

At 5:38 p.m. in Ukraine, Eastern European Standard Time, on Monday, internet service tracker NetBlocks had tweeted that “major internet disruption has been registered across Ukraine on national provider Ukrtelecom.” The attack left network data connectivity “collapsing to 13% of pre-war levels,” NetBlocks said.

Less than an hour later, NetBlocks tweeted that Ukrtelecom had “confirmed a cyberattack on its core infrastructure” in a message posted to Facebook.

NetBlocks called the cyberattack a “nation-scale disruption to service, which is the most severe registered since the invasion by Russia.”

In the statement provided by email at 10:33 p.m., Eastern European Standard Time, SSSCIP chairman Yurii Shchyhol said that the “massive cyberattack against Ukrtelecom is neutralized. Resuming services is under way.”

However, “in order to preserve its network infrastructure and to continue providing services to Ukraine’s Armed Forces and other military formations as well as to the customers, Ukrtelecom has temporarily limited providing its services to the majority of private users and business-clients,” the SSSCIP statement said.

“The specialists from the SSSCIP Ukraine promptly reacted to the situation, due to which the attack was repelled. And now Ukrtelecom has an ability to begin restoring its services to the clients,” the statement said.

Ukrtelecom is the seventh-largest internet service provider in Ukraine, based on volume of traffic, according to Doug Madory, director of internet analysis at Kentik. “They are likely the only provider available in rural parts of the country,” Madory said in a tweet.

Update: NetBlocks reported that “Internet connectivity is being restored on Ukraine’s national provider Ukrtelecom some 15 hours after users started falling offline amid a cyberattack.”

“The company’s engineers say they have successfully mitigated the attack,” NetBlocks said on Twitter.

Since Russia’s invasion of Ukraine on February 24, cyberattacks against communications infrastructure in Ukraine have been less common than many had previously expected.

However, there is an indication that some details have been kept under wraps: Last week, for instance, The Washington Post reported that U.S. intelligence has attributed a late February cyberattack against European satellite internet services to Russia. The attack is believed to have had an impact in the war, as it caused a disruption to communications for the Ukrainian military starting February 24, the day of Russia’s invasion, the Post reported.