Ukraine’s domestic security agency says Russian hackers are paying more attention to the country’s media outlets, with broadcasters facing attacks meant to knock programming offline or turn trusted platforms into propaganda pipes.
Volodymyr Karastelyov, head of the cyber department at the Security Service of Ukraine, or SBU, said media organizations have become “one of the priority targets” for Russian hackers. He described two previously undisclosed attacks on Ukrainian television broadcasters, though he did not name the Russian groups he believes were behind them.
One case involved a distributed denial-of-service attack earlier this year against an unnamed national TV channel. According to Karastelyov, the attackers used a botnet, a network of compromised devices, to flood the channel with traffic. The attack lasted three hours and reached as many as 200,000 requests per minute.
The goal was ordinary enough in cyberwar terms: bury the broadcaster’s systems under bogus requests until legitimate users and internal services could not get through. Karastelyov said defenders stopped the attack before it achieved its objective.
A second case, from last year, targeted one of Ukraine’s leading television groups. Karastelyov said the hackers tried to take over the broadcaster’s platform and publish Russian propaganda under the appearance of Ukrainian media content. That is a more corrosive operation than a temporary outage, because the target is not only uptime. It is audience trust.
According to the SBU official, the attackers used phishing against the broadcaster’s information systems while also trying to enter through connected infrastructure. The agency said that attack was contained as well.
More than website vandalism
The SBU said it has neutralized more than 16,000 cyberattacks and cyber incidents since Russia began its full-scale invasion of Ukraine four years ago. The agency said the targets have included government bodies, banks, defense organizations and media outlets.
Ukraine’s State Service of Special Communications and Information Protection said in a report last year that Russian hackers had carried out more than 200 successful attacks on Ukrainian media organizations since the invasion began. The agency listed phishing, denial-of-service attacks, website defacements, destructive malware and unauthorized publication of disinformation on compromised media platforms among the methods used.
Those categories matter because they describe different kinds of damage. A denial-of-service attack tries to interrupt access. Phishing tries to steal credentials or deliver malware by tricking staff. Defacement is public vandalism. Destructive malware can erase or disable systems. Compromised publishing access lets an attacker use a real newsroom’s own infrastructure to spread false material.
For broadcasters, the technical target can be the public website, internal newsroom systems, streaming infrastructure, distribution tools or connected vendors. Karastelyov’s description of the second incident suggests attackers were not relying on one door.
Cyberattacks and physical strikes overlap
Ukrainian media organizations are also being hit by Russia’s conventional attacks. The National Union of Journalists of Ukraine said it documented 80 verified incidents in the first half of this year in which Russian attacks damaged media infrastructure or affected journalists at work.
The union said the cases included destroyed and damaged editorial offices, damaged broadcasting infrastructure and journalists coming under Russian fire while reporting.
The latest case cited this week involved Ukraine’s Channel 5, whose office was damaged for the second time during the war. A Monday strike damaged the studio, destroyed part of the station’s filming equipment and severely damaged the newsroom, according to the account. The strike came during an overnight Russian attack involving 68 missiles and nearly 400 drones aimed at Ukraine.
Taken together, the SBU and Ukrainian media groups describe a pressure campaign with two tracks: cyber operations that try to disrupt or hijack information channels, and physical attacks that damage the people and infrastructure needed to report the war.
This story draws on original reporting from The Record.
