Industry
Government and public sector
State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
Read more
Significant cyber incident
Kyivstar outage and cyber attack, December 2023
On 12 December 2023 a cyber attack hit Kyivstar, Ukraine's largest mobile operator, with about 24 million mobile subscribers.
In short
On 12 December 2023 a cyber attack hit Kyivstar, Ukraine's largest mobile operator, with about 24 million mobile subscribers. Calls, mobile internet and SMS went down for days. The SBU, Ukraine's security service, said the intruders had been inside since at least May 2023 and that the group Sandworm, linked to Russian military intelligence, was behind it. Kyivstar restored all service categories by 19 December.
What happened
On the morning of 12 December 2023, Kyivstar customers across Ukraine lost phone and internet service. Reuters reported that the operator has 24.3 million mobile subscribers and more than 1.1 million home internet subscribers. Shops could not take card payments, and air raid alert systems in more than 75 settlements in the Kyiv region were affected. About 1 p.m. Kyivstar said on X that it was the target of a powerful hacker attack.
CEO Oleksandr Komarov said the attack could not be countered virtually, so Kyivstar was physically shut down to limit the attackers’ access. He said personal data of users was not compromised. The SBU opened criminal proceedings and said Russian special services might be behind it. A group called Solntsepyok claimed it on Telegram. Killnet had also claimed it on Telegram, without evidence, according to Reuters.
Services came back in stages. Voice returned on 13 and 14 December, mobile internet on 15 December, and on 19 December Kyivstar said all service categories were restored, with 99% of base stations working. In January 2024 the SBU cyber chief said the intruders had been in the network since at least May 2023.
Timeline
-
At least May 2023
According to the SBU cyber chief, the attackers are already inside Kyivstar's systems.
-
Probably by November 2023
The SBU cyber chief says the attackers probably had full access by at least this month.
-
12 December 2023, morning
Mobile and internet services go down across Ukraine. The SBU opens criminal proceedings.
-
12 December 2023, about 1 p.m.
Kyivstar says on X that a powerful hacker attack caused the failure.
-
12 December 2023
Komarov says Kyivstar was shut down physically to limit the attackers' access and that personal data was not compromised.
-
13 December 2023
Solntsepyok claims the attack on Telegram. The SSSCIP says a group tied to the GRU General Staff took responsibility. VEON says voice restoration began at 18.00 Kyiv time.
-
14 December 2023
More than 90% of mobile base stations are working and voice is on across the country.
-
15 December 2023
Mobile internet is restored across the country, including 4G. More than 95% of base stations are active.
-
19 December 2023
Kyivstar says services in all categories are restored and 99% of base stations work.
-
4 January 2024
In a Reuters interview, SBU cyber chief Illia Vitiuk gives details on the months of access and the wiping of servers.
-
18 January 2024
VEON estimates the 2024 revenue impact of customer compensation at about 3.6 billion UAH (about 95 million USD).
-
4 April 2024
Vitiuk says the SBU will pass evidence on the hackers to the International Criminal Court.
How the attack worked
What is known about the way in
Sources do not say how the attackers first got in. As of January 2024 the SBU had not established it. Vitiuk said it could have been phishing, someone helping on the inside, or something else. He said that if an insider helped, the person was low in the company, because the attackers used malware that steals password hashes. Samples were recovered and were being analyzed. Komarov told Forbes Ukraine, as quoted by Reuters, that it was not the first attempt on the perimeter of the operator, but this one succeeded.
Months of quiet access
Vitiuk said the attackers were in the system at least since May 2023, and probably had full access at least since November. The SBU assessed that this access could have allowed theft of personal data, tracking of phone locations and SMS interception. Reports so far found no leak of personal or subscriber data.
Destruction
On 12 December the attackers wiped systems. Vitiuk said the attack wiped almost everything, including thousands of virtual servers and PCs. Komarov later said hundreds of servers were destroyed and thousands of computers wiped, which made it hard to trace how the attackers moved. Solntsepyok claimed over 10,000 computers and 4,000 servers; Kyivstar called those claims fake. A source close to Ukraine’s cyber defense agency told Reuters there was no ransom and it was a state actor.
Who says who was behind it
Who attributed it, and how firm it is
SSSCIP (Ukraine's special communications service), 13 December 2023, as reported by Reuters: responsibility was taken by one of the Russian groups associated with the GRU General Staff. The statement did not name the group. Reuters also reported that earlier in 2023 the SSSCIP had identified Solntsepyok as a front for Sandworm.
Illia Vitiuk, head of the SBU cybersecurity department, 4 April 2024 (reported by the Kyiv Independent and The Record): the SBU linked the attack to Sandworm, a GRU unit, and also linked Solntsepyok to Sandworm. He said Ukraine identified Sandworm by its behavior patterns, specially crafted software and the file download infrastructure.
Claims of responsibility: Solntsepyok (Telegram, 13 December) and Killnet (Telegram, 12 December, without evidence per Reuters). Russia has repeatedly denied being behind such attacks.
Impact
Customers: sources differ on the number. Reuters gives Kyivstar's base as 24.3 million mobile subscribers and more than 1.1 million home internet subscribers. VOA says about 24 million.
Services: voice, mobile and fixed internet, SMS and international roaming were down. Card payments in shops were disrupted, and air raid alert systems in more than 75 settlements in the Kyiv region were affected (Reuters). Street lights in Lviv had to be switched off by hand (Kyiv Post).
Data: Kyivstar and VEON said consumer data was not compromised. The SBU said the access could have allowed data theft, and reports found no leak so far.
Military: a source close to Kyivstar and Vitiuk said military communications and detection were not strongly affected.
Cost: sources differ. VEON estimated a 2024 revenue impact of about 3.6 billion UAH (about 95 million USD) from customer compensation and expected no material impact on 2023 results. The Record reported a figure of almost $100 million in January and about $24 million in a March company report. The Kyiv Independent reported VEON's damage figure as Hr 3.6 billion ($93 million). The sources opened do not explain the differences.
Scope of destruction: sources differ. Solntsepyok claimed over 10,000 computers and 4,000 servers and Kyivstar called that fake. Komarov said hundreds of servers were destroyed and thousands of computers wiped.
Government and regulator response
- 12 December 2023: Kyivstar shut down its network physically to limit access and said on X that it was under a powerful hacker attack. The SBU opened criminal proceedings and a treason case.
- 13 to 19 December 2023: Kyivstar restored services in stages. VEON thanked the SBU, law enforcement and government agencies for their help. On 19 December 99% of base stations were working.
- 13 December 2023: The SSSCIP said it was investigating with the SBU and that a group tied to the GRU General Staff took responsibility.
- December 2023 to January 2024: Kyivstar gave customers one month of free services on certain contracts. Vitiuk said the SBU helped Kyivstar restore systems within days and repel new attacks.
- 4 April 2024: The SBU said it was gathering evidence and would pass it to the International Criminal Court. Vitiuk said cyber attacks on civilian infrastructure fit the definition of war crimes.
- 4 April 2024: Vitiuk said the SBU is working on the whole chain of those involved and that, beyond the individual perpetrator, the head of the military unit and the leadership of the service should be held accountable. The SBU said it had also sent requests for more information to international partners.
Lessons
-
Core telecom systems are targets
Vitiuk called it probably the first destructive attack that destroyed the core of a telecoms operator and said the attack was a warning for the whole Western world.
-
Long dwell time before the damage
The SBU found access from at least May 2023 and probably full access from November. Quiet access can last months before the destructive step.
-
Password hashes are worth guarding
The attackers used malware that steals password hashes, and the SBU said an insider helping may have been low level. Low level accounts can lead to full access.
-
Plan for operating without your network
Kyivstar shut itself down to limit access, and recovery took a week. Prepare offline recovery steps and clean backups.
-
Outages reach other services
Card payments, street lights and air raid alerts were affected. Map which services depend on your network.
-
Work with the state early
Kyivstar and VEON credited the SBU and government agencies for their response, and the SBU said it helped repel follow-up attempts.
What to check in your own organization
-
Dwell time
Search for old, unexplained access to core systems. Review logs for accounts active for months without a clear owner.
-
Credential theft
Look for tools that dump password hashes on servers and admin workstations, and limit who can log in to core systems.
-
Insider and supplier access
Review which staff and contractors can reach core network and cloud systems, and remove access that is not needed.
-
Backups
Confirm backups and cloud storage are separate from the production network and cannot be wiped with the same account.
-
Shutdown and rebuild plan
Write down who can isolate the network, how services are restored in stages, and who tells customers.
-
Dependencies
List the services (payments, alerts, building controls) that stop when your network stops.
-
Contacts
Keep contact details for your national CERT and security service, and test them.
Where it happened
- Industry Telecommunications State-sponsored intrusions, subscriber data theft, SIM swapping and account takeover at telecom providers, and the rules that apply.
- Country Ukraine Ukraine is the country where Russian state cyber operations have been most destructive, from the 2015 power grid attack to wiper malware in 2022. Europe
Questions
When did the Kyivstar attack happen?
On 12 December 2023. Kyivstar said on X around 1 p.m. that it was under a powerful hacker attack.
How many customers were affected?
Sources differ. Reuters gives Kyivstar's base as 24.3 million mobile subscribers and more than 1.1 million home internet subscribers. VOA gives about 24 million users.
Who was behind it?
Ukrainian officials point to Sandworm, linked to the GRU. The SBU linked the attack to Sandworm (reported 4 April 2024). The SSSCIP said on 13 December 2023 that a group tied to the GRU General Staff took responsibility. Solntsepyok claimed it. Russia has repeatedly denied such attacks.
How long were the attackers inside?
The SBU cyber chief said at least since May 2023, with full access probably at least since November.
Was customer data stolen?
Kyivstar and VEON said consumer data was not compromised. The SBU said the access could have allowed data theft, and reports found no leak of personal or subscriber data so far.
How long did recovery take?
Voice returned on 13 and 14 December and mobile internet on 15 December. On 19 December Kyivstar said all service categories were restored.
Which governments have publicly linked the attack to Sandworm?
Ukraine's SBU did, on 4 April 2024. The UK government (Foreign Office, Home Office, Cabinet Office and NCSC) repeats in its profile of GRU cyber operations that the SBU named Unit 74455, which is Sandworm, for the Kyivstar operation.
Did the SBU say who should be held accountable?
Vitiuk said the SBU is working across the whole chain of those involved. He said not only the specific perpetrator but at least the head of the military unit and the leadership of the service that carried out the destructive activity must be held accountable.
Sources
- GRU hackers who attacked Kyivstar identified, case file to be sent to The Hague - Illia Vitiuk (4 April 2024, archived copy) Security Service of Ukraine (SSU/SBU)
- Profile: GRU cyber and hybrid threat operations UK Government (FCDO, Home Office, Cabinet Office, NCSC)
- Cyber Security Brief 24-01 - December 2023 (5 January 2024) CERT-EU
- Ukraine's top mobile operator hit by biggest cyberattack of war Reuters (via The Globe and Mail), 12 December 2023
- Hackers linked to Russian spy agency claim cyberattack on Ukrainian cell network Reuters (via The Globe and Mail), 13 December 2023
- Russian Hacking Group Claims Attack That Took Out Ukrainian Mobile Operator Voice of America, December 2023
- Russian hackers were in Kyivstar system for months, Reuters LB.ua (relaying Reuters), 4 January 2024
- Kyivstar Cyberattack: Ukraine's Largest Mobile Operator Knocked Out Kyiv Post, 12 December 2023
- Kyivstar starts restoring voice services on its network following widespread cyber-attack VEON, 13 December 2023
- Kyivstar restores voice services across Ukraine, starts the reactivation of mobile data services VEON, 14 December 2023
- Kyivstar restores mobile internet across Ukraine, reactivates international roaming VEON, 15 December 2023
- Kyivstar restores services in all categories, brings 99% of mobile network back on air VEON, 19 December 2023
- Kyivstar completes preliminary assessment of the financial impact of the cyberattack VEON (via TelecomTV), 18 January 2024
- SBU: Ukraine gathers evidence for ICC on Russian GRU hackers behind Kyivstar cyberattack Kyiv Independent, 4 April 2024
- Ukraine gathers evidence to prosecute hackers behind Kyivstar attack in Hague The Record, 4 April 2024
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.