Kyivstar Cyberattack Knocks Out Ukraine's Largest Mobile Operator
On 12 December 2023 a destructive cyberattack disabled mobile and home-internet service for roughly 24 million Kyivstar subscribers for days; Ukraine's SBU attributed it to Russian military intelligence's Sandworm group.
02Deep-Dive Technical Analysis
According to SBU cyber chief Illia Vitiuk, attackers were present in Kyivstar's network from at least May 2023, likely with full access by November, before a destructive phase that "completely destroyed the core," wiping thousands of virtual servers and PCs. Kyivstar's CEO said the attackers used malware its protections did not detect. Voice, SMS and data failed nationwide, and some air-raid alert systems relying on the network were affected; service was fully restored by 20 December. A Sandworm-linked persona, Solntsepek, claimed responsibility with larger, unverified damage figures.
03Vulnerability & Exploit Flow
Long-term covert access to operator IT and core management followed by destruction of virtualized infrastructure.
04Recommended Defense & Mitigation Protocol
Segmented, immutable offline backups of core configurations, privileged-access hardening and rapid rebuild playbooks for core network functions.
05Security Impact & Geopolitical Consequence
Regarded as one of the most destructive cyberattacks on a telecom operator, showing that wiper attacks can disable national mobile service in wartime.
06Authoritative Standards & External References
07Related Topic Cluster Records
Master 5G Core, SS7 Defense & Subsea Cable Auditing
Ready to turn your historical knowledge into certified hands-on expertise? Register free on TelcoSec Academy to access interactive lab challenges, or consult our enterprise team for carrier-grade signaling assessments and portable BTS hardware.