Ukrainian intelligence cyberattack cripples telecom networks in Russian-occupied territories

The attack, described by Russian providers as the most powerful DDoS attack, disrupted both subscriber and operator networks and took at least 16 hours to partially restore communications. However, a significant number of subscribers were left without communication for more than two days.

Restoring connections proved difficult because "subscribers, fearing traditional Russian scams, refused to provide operators with their current contact information, and 20% of subscribers refused to upgrade network equipment that could protect them from further attacks in the future," the source said.

Operators had to hire additional technical specialists to handle the influx of customer complaints.

Telecom operator Miranda Media was one of the hardest hit, with subscribers unable to access the network and pay for services due to damage to the billing system.

Mirtelecom subscribers were unable to access the network in occupied Crimea and in occupied parts of Zaporizhzhya and Kherson oblasts. Another Russian provider, Farline, suffered significant damage, primarily in Crimea.

Similar attacks continued the following month, targeting propaganda media servers, local occupation authorities, contact centers, registration and traffic control systems on the Kerch Bridge, critical airport and network infrastructure, and payment systems, causing disruptions and delays in occupied Crimea.

On June 27, a HUR source told NV about a second consecutive day of attacks on Russia's communications infrastructure in occupied Crimea.

The disruption was compounded by widespread phishing attacks on local internet users and disruptions to digital accounting services, leaving shops in Kerch and Sevastopol with non-functioning cash registers.