Major internet disruption hit Ukrtelecom, Ukraine’s national internet provider, following a cyber-attack on 28 March.
NetBlocks, a global internet monitoring organization, reported that at the time of the incident real-time network data showed connectivity collapsing to 13 percent of pre-war levels.
“Real-time network data show an ongoing and intensifying nation-scale disruption to service, which is the most severe registered since the invasion by Russia,” NetBlocks said in a Tweet. Some reported that this was the most severe cyber-attack since the Russian invasion of Ukraine began on 24 February.
The internet provider confirmed a cyber-attack against its core infrastructure. Ukrtelecom is the largest fixed-line operator in the country.
As the company responded to the attack it limited the provision of services to the majority of its private users and business clients in order to prioritize services to Ukraine’s Armed Forces and other military formations, according to the State Service of Special Communications and Information Protection of Ukraine (SSSCIP).
The incident was resolved with 15-hours of down-time and NetBlocks confirmed that connectivity had been restored on 29 March.
Targeting connectivity
It is known that targeting critical infrastructure and communications with cyber-attacks is part of Russia’s warfare playbook with cyber incidents against government organizations, for example, having begun in the build up to the 24 February.
Many of these attacks took and are taking the form of distributed denial-of-service (DDoS) attacks.
The SSSPIC has said that cyberwar is underway and that cyber offenders continue to attempt to cause harm to Ukraine’s information infrastructure as well as seeking to collect critical information.
NetBlocks has reported that, since the war began, communications providers including GigaTrans, Kyvstar and Triolan have all been affected by outages and disruptions.
In addition, commercial satellite operator Viasat experienced a partial outage of its KA-SAT network in Europe on 24 February as a result of a “multifaceted and deliberate cyber-attack.”
In a statement on 30 March, Viasat said that following the attack network stabilization and security mitigation actions began immediately. The network was largely stabilized within hours and service returned to normal within several days.
Viasat explained that the incident was a denial-of-service attack which made it difficult for many modems to remain online.
The investigation into the incident is still ongoing.