Loading story…
Russian drone strikes damaged commercial data-center and telecommunications infrastructure in Kyiv, disrupting connectivity for roughly 100,000 households. At least four providers—Kyiv Link, Pautina, Utels, and Crazy Network—reported outages or degraded service caused by damage to facilities, critical equipment, communications lines, and a traffic-exchange site. A strike on a Datagroup data center in Kyiv’s central business district also killed four people in the surrounding area.
Russia acknowledged targeting the Datagroup site and said it struck or sought facilities associated with New-Telco, United DC, Kyivstar, and Parkovyi, alleging links to Ukrainian military or security services; those claims were not independently verified. Ukrainian officials said the country’s decentralized network architecture should prevent nationwide failure, but warned that localized outages could impair air-raid alerts and other essential civilian services. Some companies have begun moving data abroad in response to the heightened risk.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Russia's Defense Ministry claimed it struck the New-Telco and United DC data centers in Kyiv, alleging they supported Ukrainian defense, intelligence, and security bodies. Ukrainian authorities did not confirm that either facility was hit, and the claims could not be independently verified.
A Wednesday Russian drone attack damaged Kyiv data-center and telecommunications infrastructure, causing partial connectivity losses at Kyiv Link, Pautina, Utels, and Crazy Network. Ukraine's Ministry of Digital Transformation said about 100,000 households in Kyiv and the surrounding region experienced internet problems; Utels restored most customers in about two hours.
Earlier in September 2026, Russian strikes damaged Kyivstar facilities, including an engineering office and a building housing network equipment. Kyivstar said its services continued operating.
A fire at an Exatel-operated Starlink ground station in central Poland damaged electrical infrastructure, including a switchboard and generator. Polish authorities opened a possible-sabotage investigation and said there were indications the fire was deliberate, but did not identify those responsible or establish Russian involvement.
A subsequent large-scale Russian missile strike damaged residential buildings, a maternity hospital, and energy and logistics infrastructure, according to Ukrainian officials.
Some Ukrainian companies began migrating data across the border to reduce the risk of disruptions from Russian attacks on Ukrainian data centers and network infrastructure.
A Russian drone struck and damaged a Datagroup data center in Kyiv's central business district, killing four people in the surrounding area. Russia acknowledged attacking the site and alleged it was used by Ukrainian military intelligence; it also said it was targeting facilities associated with New-Telco, United DC, Kyivstar, and Parkovyi.
A major Russian strike damaged a key Kyiv data center and disrupted several internet providers, according to reporting cited by The Record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
tomshardware.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Russian-linked cyber operations hit Ukraine at the outset of the invasion with both destructive malware and a major satellite communications disruption. Security researchers identified the **HermeticWiper** data-wiping malware on hundreds of systems in Ukraine, with additional impacts reported at a Ukrainian financial institution and government contractors in Latvia and Lithuania. The activity coincided with **DDoS** attacks against Ukrainian government entities and PrivatBank, underscoring a coordinated effort to degrade communications and critical services as military operations began. A parallel attack on Viasat’s **KA-SAT** network knocked 40,000 to 45,000 satellite modems offline, many of them permanently, after attackers compromised a VPN-connected management center in Turin and pushed wiper malware through a software update server. Viasat later said the incident unfolded in two stages, with a second wave using compromised modems to flood company systems and complicate recovery; the disruption spilled into Europe, including outages affecting **5,800 Enercon wind turbines in Germany**. U.S. and EU officials attributed the operation to Russian hackers, and the investigation helped support sanctions announced in 2022.
Jun 29, 2026
Ukraine faced a series of disruptive cyberattacks targeting government ministries, the Defense Ministry, state portals, and major banks, culminating in what officials called the largest **DDoS** campaign in the country’s history. On 15 February, attacks knocked or degraded access to services at PrivatBank, Oschadbank, the Ministry of Defense, government websites, and the **Diia** platform, with Ukrainian officials saying roughly 15 banks were affected. Authorities said the operation had been prepared in advance, originated from multiple countries, and was intended to destabilize society and trigger panic; they also said no theft of funds or personal data had been confirmed, while U.S. partners helped provide technical support and additional protections. The February disruption followed an earlier January intrusion in which multiple Ukrainian ministry websites were hit and a defacement message in Russian, Polish, and Ukrainian falsely warned that citizens’ personal data had been leaked and destroyed. Ukrainian officials said no personal data leak was verified, while the **EU** and **NATO** publicly backed Kyiv and expanded cyber assistance, including closer cooperation and access to malware-sharing resources. The incidents fit a longer pattern of cyber operations against Ukraine, including the **NotPetya** attack that previously disrupted government bodies, banks, utilities, logistics firms, and airport operations and was later publicly attributed by the UK and US to Russia, an accusation Moscow has denied in more recent cases.
Jun 29, 2026
A late-August presidential decree enables Russian authorities to temporarily assume control of critical infrastructure deemed inadequately protected, driving data-center operators to expand physical and cyber defenses. The requirements affect critical sectors including energy, telecommunications, transport and utilities, and reportedly extend to facilities serving government agencies, banks and major service providers. Operators are expected to harden exposed engineering equipment, establish backup communications, improve DDoS protections and strengthen software-vulnerability management. Russia's data-center capacity is heavily concentrated around Moscow and St. Petersburg—areas increasingly within reach of Ukrainian long-range drones—while the new measures are expected to increase operating costs amid a conflict that has already caused physical and cyber disruption to Ukrainian and Russian digital infrastructure.
Sep 4, 2026