Russian hackers have been in the Kyivstar system since May 2023 – Kommersant

Head of the Cybersecurity Department of the Security Service of Ukraine Ilya Vityuk said Reutersthat Russian hackers have been in the system of the mobile operator Kyivstar since at least May 2023. In December, a powerful cyber attack was carried out on Kyivstar, as a result of which tens of millions of Ukrainians were unable to access mobile communications and the Internet.

“At this point we can say with confidence that they have been in the system since at least May 2023. I can’t say now since when they had… full access. Probably at least since November,” said Mr. Vityuk.

According to the head of the cybersecurity department, the hack caused catastrophic destruction and was aimed at inflicting a psychological blow and gathering intelligence information.

The intelligence officer noted that Russian hackers destroyed almost everything, including thousands of virtual servers and computers. According to him, the December attack on Kyivstar is probably the first example of a cyber attack that completely destroyed the core of a mobile operator.

Mr. Vityuk claims that hackers tried to get into the Kyivstar system back in March. He stated that in November they had access to personal information and the location of the operator’s users’ phones. Since November, hackers have been able to intercept SMS messages and possibly steal Telegram accounts, an SBU official said.

A representative of Kyivstar told the agency that no cases of leakage of personal data of clients have been identified. According to Mr. Vityuk, the SBU helped the operator restore systems and repel new cyber attacks within a few days. The head of the cybersecurity department emphasized that the cyber attack on Kyivstar did not have a big impact on the Ukrainian army because it uses different algorithms and protocols.

Mr Vityuk told Reuters he was almost certain that the Russian-linked hacker group Sandworm was behind the cyberattack. At the same time, representatives of the hacker group Solntsepek took responsibility for the attack.

Mr. Vityuk claims that a year ago Sandworm had already penetrated the system of a Ukrainian mobile operator – he refused to name the company – but the SBU managed to identify the hackers. Samples of the malware that was used to attack Kyivstar are currently being studied by the Ukrainian intelligence service.

On December 12, 2023, the largest failure in the information infrastructure of Ukraine since February 2022 occurred; mobile communications and the Internet were unavailable to tens of millions of Ukrainians. Ukrainian intelligence services accused Russia of carrying out a powerful cyber attack on Kyivstar. The problems affected the banking sector and a number of other critical industries. “Kyivstar” statedthat hackers broke into the security system through an employee account.

Details – in the material “Kommersant” “Ukraine did not get in touch”.

Erdni Kagaltynov