Moscow-Linked Hacker Gang Takes Credit for Cyberattack That Crippled Ukraine’s Communications

Hackers connected to the Russian government claimed credit on Wednesday for a devastating cyberattack on Kyivstar, Ukraine’s largest mobile network operator.

“We destroyed 10 thousand computers, more than 4 thousand servers, all cloud storage and backup systems,” the hacker group, Solntsepek, said on its Telegram channel, sharing screenshots purportedly of Kyivstar’s computer networks.

Tuesday’s Kyvistar attack crippled communications across Ukraine, in some cases disrupting vital services such as air-raid warning systems. By the evening, Kyivstar had partially restored its broadband internet service, but its 24 million wireless subscribers were still offline, with restoration work expected to begin on Wednesday.

“Our IT infrastructure was significantly damaged,” company president Oleksandr Komarov told local media, adding that systems vital to restoring service had been “completely destroyed.”

“This is the largest hacker attack on the telecom infrastructure in the world,” Komarov said in an interview with Forbes Ukraine.

Solntsepek said it attacked Kyivstar because the company supports Ukrainian government and military communications. On the group’s Telegram channel, the criminals hinted that they would carry out further attacks on other companies vital to the war effort.

Cybersecurity experts believe Solntsepek is a front for Russia’s military intelligence agency, the GRU, which uses it to promote its cyber operations — and sometimes exaggerate its success.

Tuesday marked a resurgence of cyber conflict in the war between Russia and Ukraine. On the same day that Moscow’s hackers scored a major victory with the assault on Kyivstar, the Ukrainian government took the rare step of publicly announcing a cyberattack on the Russian government, claiming that its operatives had “managed to break into one of the well-protected key central servers” of Russia’s tax agency and one of the agency’s IT vendors.

Key Russian tax files “were completely eliminated,” possibly impeding the agency’s ability to collect much-needed national revenue, Ukraine’s defense ministry said. “The entire database and its backup copies were destroyed.”