Solntsepek has previously been used as a front for the hacker group Sandworm, the Moscow-based Unit 74455 of Russia’s GRU, says John Hultquist, the head of threat intelligence at Google-owned cybersecurity firm Mandiant and a longtime tracker of the group. He declined, however, to say which of Solntsepek’s network intrusions have been linked to Sandworm in the past, suggesting that some of those intrusions may not yet be public. “It’s a group that has claimed credit for incidents we know were carried out by Sandworm,” Hultquist says, adding that Solntsepek’s Telegram post bolsters his previous suspicions that Sandworm was responsible. “Given their consistent focus on this type of activity, it’s hard to be surprised that another major disruption is linked to them.”
If Solntsepek is a front for Sandworm, it would be far from the first. Over its years of targeting Ukrainian infrastructure, the GRU unit has used a wide variety of covers, hiding behind false flags such as independent hacktivist groups and cybercriminal ransomware gangs. It even attempted to frame North Korea for its attack on the 2018 Winter Olympics.
Today, Kyivstar countered some of Solntsepek’s claims in a post on X, writing that “we assure you that the rumors about the destruction of our ‘computers and servers’ are simply fake.” The company had also written on the platform that it hoped to restore its network’s operations by Wednesday, adding that it’s working with the Ukrainian government and law enforcement agencies to investigate the attack. Kyivstar’s parent company, Veon, headquartered in Amsterdam, didn’t respond to WIRED’s request for more information.
While the fog of war continues to obscure the exact scale of the Kyivstar incident, it already appears to be one of the most disruptive cyberattacks to have hit Ukraine since Russia’s full-scale invasion began in February 2022. In the year that followed, Russia launched more data-destroying wiper attacks on Ukrainian networks than have been seen anywhere else in the world in the history of computing, though most have had far smaller effects than the Kyivstar intrusion. Other major Russian cyberattacks to hit Ukraine over the past 20 months include a cyberattack that crippled thousands of Viasat satellite modems across the country and other parts of Europe, now believed to have been carried out by the GRU. Another incident of cybersabotage, which Mandiant attributes to Sandworm specifically, caused a blackout in a Ukrainian city just as it was being hit by missile strikes, potentially hampering defensive efforts.
It’s not yet clear if the Kyivstar attack—if it was indeed carried out by a Russian state-sponsored hacker group—was merely intended to sow chaos and confusion among the company’s customers, or if it had a more specific tactical intention, such as disguising intelligence-gathering within Kyivstar’s network, hampering Ukrainian military communications, or silencing its alerts to civilians about air raids.
“Telecoms offer intelligence opportunities, but they’re also very effective targets for disruption,” says Mandiant’s Hultquist. “You can cause significant disruption to people’s lives. And you can even have military impacts.”
