Ukraine

This page covers cyber threats to Ukraine. It brings together Ukrainian laws on the Verkhovna Rada site, government advisories from other countries (CISA, the FBI, NSA, the UK NCSC), MITRE ATT&CK, the EU declaration of 10 May 2022, and Brandefense research. Ukraine has been the target of Russian state cyber operations for years, and several of the best known destructive attacks began there.

Threat groups that official sources link to Ukraine

Each group below has a profile in our threat group library. Attribution is stated as given by the named body.

Sandworm: MITRE ATT&CK says the US indicted six GRU Unit 74455 officers associated with Sandworm Team in October 2020 for a list of operations, including the 2015 and 2016 attacks on Ukrainian electrical companies and government organizations and the 2017 NotPetya attack. MITRE also links Sandworm to the AcidRain wiper used in the Viasat KA-SAT incident in 2022.

APT28: CISA advisory AA25-141A (May 2025) says the GRU unit 26165, commonly known as APT28 and Fancy Bear, expanded its targeting of logistics entities and technology companies involved in the delivery of aid to Ukraine. It also says these actors targeted internet-connected cameras at Ukrainian border crossings. MITRE ATT&CK says APT28 used the LAMEHUG malware against targets in Ukraine.

Gamaredon: MITRE ATT&CK describes Gamaredon Group as a suspected Russian espionage group that has targeted military, law enforcement, judiciary, non-profit and non-governmental organizations in Ukraine since at least 2013. It says the Ukrainian government attributed the group to Russia’s FSB Center 18 in November 2021.

Ember Bear: MITRE ATT&CK says Ember Bear has mainly focused on Ukrainian government and telecommunication entities and carried out the WhisperGate wiper attacks against Ukraine in early 2022. A joint advisory from CISA, the FBI and NSA (AA24-249A, 5 September 2024) says GRU Unit 29155 cyber actors began deploying WhisperGate against Ukrainian victim organizations as early as 13 January 2022.

Incidents on record

The incidents listed below are the major ones that governments and the press reported widely. Small incidents are not listed. Where sources differ, the incident page says so.

How attackers target Ukraine: Brandefense research

Our own research has covered Ukraine many times. In summary, as our posts report:

State-linked destruction and sabotage: The Sandworm (APT44) profile links the group to NotPetya in 2017 and attacks on Ukrainian power grids, and our Sandworm research summary says the group mainly targets Ukrainian organizations in energy, industrial control systems, SCADA, government and media. The Geopolitical Countdown post describes the Viasat KA-SAT attack of 24 February 2022, about an hour before the invasion. The HermeticWiper report says the wiper was used mainly against Ukraine, with some activity in Latvia and Lithuania. Our hybrid warfare analysis walks through the cyber war from the 2015 power grid outages to the wipers of 2022, and the FoxBlade post and the HermeticRansom post cover other malware used in the 2022 attacks.

Espionage: The Gamaredon profile says the group targets Ukraine and increasingly NATO members. The APT28 profile says its targets include NATO countries, Ukraine and the EU. The UAC-0102 profile and the UAC-0194 profile cover clusters tracked by CERT-UA that mainly target Ukrainian government bodies. The RomCom profile says the group targets Ukraine, NATO states and their partners. The Ghostwriter profile notes that CERT-UA describes the group as Belarus-aligned, and that attribution differs by source. The Winter Vivern profile lists UAC-0114 as the CERT-UA name for the group.

Supply chain: Our supply chain case study says a state-sponsored Russian group breached the update servers of the Ukrainian accounting software M.E.Doc and pushed out the NotPetya payload. The supply chain post makes the same point about NotPetya reaching global companies.

Critical infrastructure: The critical infrastructure post describes the 2015 Ukraine power grid hack as one of the first known cyberattacks to cause a large-scale power outage. The Moxa NPort post notes allegations that such devices were manipulated in the 2015 campaigns against Ukraine’s grid.

Ransomware and hacktivism: Our ransomware evolution post says the Conti group declared support for Russia in the war and was hit by internal conflict and a data leak. The ransomware groups post says Stormous emerged at the start of the tension between Russia and Ukraine. The Anonymous Sudan review mentions protest against Western support of Ukraine as a motive.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity. In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector, which matters for organizations in Ukraine and for those that work with Ukrainian partners. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The basic law is the Law on the Basic Principles of Cybersecurity of Ukraine, No 2163-VIII of 5 October 2017. It names the State Service of Special Communications and Information Protection, the National Police and the Security Service of Ukraine among the main bodies of the national cybersecurity system. It makes the National Bank responsible for setting cyber protection requirements for banks and other financial firms it supervises.

Ukraine also has a Law on Critical Infrastructure, No 1882-IX of 16 November 2021, which sets the legal and organizational basis of the national system for protecting critical infrastructure. The current Cybersecurity Strategy was approved by Presidential Decree No 447/2021 of 26 August 2021. It builds the national system on deterrence, cyber resilience and cooperation.

How incident response is organized

The 2017 law names CERT-UA as the national incident response team (national CSIRT), supported by the State Service of Special Communications and Information Protection. It makes the National Cybersecurity Coordination Center, a working body of the National Security and Defense Council, responsible for coordinating and controlling the security and defense bodies responsible for cybersecurity. The Security Service of Ukraine runs its own cybersecurity situation center and regional centers.

Personal data

Personal data protection is governed by the Law on Protection of Personal Data, No 2297-VI of 1 June 2010.

The official sources opened for this page do not give attack counts for Ukraine. Figures will come from Brandefense Atlas.