Russian Hackers Hid Within Ukrainian Telecom’s Networks for Months, Then Plunged Country in Chaos

Russian government hackers lurked inside the computers of Kyivstar, Ukraine’s largest wireless provider, for at least seven months before crippling its network, a top Ukrainian official told Reuters.

“They were in the system at least since May 2023," said Illia Vitiuk, the head of the cybersecurity team at the Security Service of Ukraine.

When the hackers finally struck in mid-December, they plunged Ukraine into chaos, disrupting a network that supplied wireless service to roughly 24 million people and broadband internet to roughly 1 million people. At least one local government’s emergency alert system went offline, heightening fears about renewed Russian missile strikes in a region that has suffered heavy bombardment during the war between Russia and Ukraine.

Shortly after the attack, the Russian hacker gang Solntsepek took credit for the outages. Security experts have linked the group to Russia’s military intelligence agency, the GRU. Ukrainian officials also believe the GRU was responsible for the attack, according to Vitiuk.

It remains unclear how the hackers gained access to Kyivstar’s systems. Vitiuk said his agency was investigating multiple possibilities, including malware, an operation to trick an employee into handing over their password, or a plot aided by an accomplice inside Kyivstar.

During the attack, Vitiuk told Reuters, the hackers wiped almost all of Kyivstar’s vital systems, including thousands of computers and servers. All told, it might be the first example of a digital strike that “completely destroyed the core of a telecoms operator,” Vitiuk said.

The hackers likely gained “full access” to Kyivstar’s infrastructure in November, he said. If that timeline is correct, it suggests that the intruders either patiently waited for the right moment to launch their attack — or needed time to study Kyivstar’s systems and plan their sabotage.

In addition to severing communications throughout Ukraine, the hackers were likely able to track customers’ phones, intercept text messages and steal sensitive information from their accounts.

Kyivstar spokesperson Iryna Lelichenko declined to comment on whether the hackers could have surveilled customers, but she said the company’s investigation had so far found “no facts of leakage of personal data.”

Kyivstar has improved its cyber defenses since the attack, she said, including through tightened access to sensitive systems.