Cyber War — Russia vs Ukraine Tracker

🎯 Target: Ukrainian government websites (70+ sites defaced)

🔧 Method: WhisperGate wiper malware + web defacement

Cabinet of Ministers, Foreign Ministry, Education Ministry sites defaced. "Be afraid and expect the worst." Data wiper deployed on Ukrainian systems — disguised as ransomware.

Attribution: Microsoft MSTIC, CISA attributed to GRU-linked actors

🎯 Target: Ukrainian military, government, financial institutions

🔧 Method: HermeticWiper, IsaacWiper — data destruction malware

Destructive wiper malware deployed across hundreds of Ukrainian systems hours before invasion. Designed to brick devices permanently. Coordinated with military offensive.

Attribution: ESET, Symantec, SentinelOne; attributed to GRU

🎯 Target: Viasat KA-SAT satellite communications network

🔧 Method: AcidRain wiper targeting satellite modems

Took down ~40,000 satellite modems across Europe. Ukraine's military relied on Viasat for communications — lost connectivity for hours on invasion day. Spillover affected wind turbines in Germany.

Attribution: US, UK, EU jointly attributed to Russia (GRU); confirmed May 2022

🎯 Target: Ukrainian energy company (Ukrenergo substation)

🔧 Method: Industroyer2 — ICS/SCADA-targeting malware

Attempted to shut down high-voltage electrical substation in Ukraine. CERT-UA and ESET detected and neutralized before execution. Most sophisticated ICS attack since original Industroyer (2016).

Attribution: CERT-UA + ESET joint investigation; GRU Unit 74455

🎯 Target: NATO countries' government sites (USA, Germany, Italy, Romania, Latvia)

🔧 Method: DDoS attacks

Temporary disruptions to government websites in multiple NATO states. More noise than effect — politically symbolic rather than operationally significant.

Attribution: Self-claimed by Killnet Telegram channel; believed GRU-adjacent

🎯 Target: Russian banks, government sites, state media (TASS, RIA Novosti)

🔧 Method: Coordinated DDoS; data leaks

Temporary disruption of Sberbank, VTB, Russian state television portals. Sberbank reported largest DDoS in its history. IT Army grew to 300,000+ volunteer participants globally.

Attribution: Ukraine IT Army — Telegram-coordinated volunteer hacktivist collective, guided by Ukraine SSSCIP

🎯 Target: Ukrainian and European energy sector

🔧 Method: Spearphishing, credential theft, network intrusion

Reconnaissance of European energy suppliers providing aid to Ukraine. Pre-positioning for potential disruption during winter energy crisis. Detected and disrupted by national CERTs.

Attribution: NSA, CISA joint advisory; APT28 (GRU Unit 26165)

🎯 Target: Kyivstar — Ukraine's largest mobile network (~24M subscribers)

🔧 Method: Long-dwell network intrusion; wiper malware

Complete destruction of Kyivstar's core infrastructure. Network down 2+ days. 24 million Ukrainians without mobile service. No voice, SMS, or mobile internet. Air raid warning systems disrupted in some areas.

Attribution: Ukrainian SBU directly attributed to Sandworm (GRU). Kyivstar CEO confirmed Russian military hackers.

🎯 Target: M9com — Russian internet service provider

🔧 Method: Intrusion and destructive attack

Took down M9com — major ISP serving Moscow. Disrupted internet access for thousands of Russian users and state organizations. Retaliation for Kyivstar attack.

Attribution: Ukraine's GUR (Military Intelligence) claimed responsibility

🎯 Target: Ukrainian critical infrastructure (ongoing)

🔧 Method: Espionage, wiper malware, spearphishing, supply chain

Continuous campaign: 5,000+ cyberattacks on Ukrainian government systems in 2022–23 alone (SSSCIP data). Russia shifted strategy from destructive to persistent espionage after Ukraine hardened defenses. In 2025–2026 AI-assisted spearphishing targeting Ukrainian military networks intensified.

Attribution: CERT-UA, SSSCIP quarterly reports; multiple APT groups