Russian Cyberattacks Disrupted Ukraine Communications via Viasat and Wiper Malware

Russian-linked cyber operations hit Ukraine at the outset of the invasion with both destructive malware and a major satellite communications disruption. Security researchers identified the HermeticWiper data-wiping malware on hundreds of systems in Ukraine, with additional impacts reported at a Ukrainian financial institution and government contractors in Latvia and Lithuania. The activity coincided with DDoS attacks against Ukrainian government entities and PrivatBank, underscoring a coordinated effort to degrade communications and critical services as military operations began.

A parallel attack on Viasat’s KA-SAT network knocked 40,000 to 45,000 satellite modems offline, many of them permanently, after attackers compromised a VPN-connected management center in Turin and pushed wiper malware through a software update server. Viasat later said the incident unfolded in two stages, with a second wave using compromised modems to flood company systems and complicate recovery; the disruption spilled into Europe, including outages affecting 5,800 Enercon wind turbines in Germany. U.S. and EU officials attributed the operation to Russian hackers, and the investigation helped support sanctions announced in 2022.