Ukraine tallies up Russian cyberattacks on local media since start of war

Russian hackers have carried out more than 200 successful cyberattacks on Ukrainian media outlets since the start of the war three years ago, targeting television channels, news agencies and state-run media, according to a new report.

The attacks were aimed at spreading pro-Russian propaganda, manipulating public opinion and sowing chaos, said researchers at the SSSCIP, the state agency responsible for protecting information and critical infrastructure.

Hackers employed a range of tactics in their operations against Ukrainian media, including publishing disinformation, wiping content and launching DDoS attacks to temporarily disrupt access to media platforms. Another common method involved compromising social media accounts belonging to journalists and news organizations to disseminate false information.

Russia has also actively used deepfake technology in its information operations. In the early days of the war, hackers created a fabricated video that appeared to show Ukrainian President Volodymyr Zelensky urging troops to surrender. The clip circulated on social media and was briefly posted on a Ukrainian news website before being debunked and removed.

“Russia used deepfakes to discredit Ukrainian military commanders, volunteers, and international partners by imitating their speeches and statements,” the researchers said.

Moscow also relies heavily on bot networks, fake accounts and paid posts to amplify pro-Russian narratives both in Ukraine and abroad. One of Russia’s most notorious propaganda operations, known as Doppelgänger, has created hundreds of thousands of fake social media profiles and cloned websites of major news outlets to spread disinformation in countries including Germany, France, the United States, Ukraine and Israel.

While the latest SSSCIP report does not specify which hacker groups were behind the cyberattacks on Ukrainian media, the agency has previously attributed such operations to state-controlled threat actors, including the notorious Sandworm unit.

In February, hackers targeted several major Ukrainian media outlets — including the prominent online newspaper Ukrainska Pravda — to spread fake news related to the war. In 2023, Russia targeted Ukraine’s national news agency, Ukrinform, causing “certain destructive effects” to its information infrastructure. 

In July 2022, two radio stations owned by one of Ukraine’s largest broadcasters, TAVR Media, were hacked to broadcast false claims that Zelensky had been hospitalized in critical condition.

In Ukraine, Russian hackers and troops are targeting Ukraine’s telecommunication infrastructure both in cyberspace and on the ground, destroying radio and television towers, as well as radio centers that broadcast to the occupied territories.

Russian cyberattacks on media outlets have also extended beyond Ukraine. Earlier in May, Azerbaijani officials accused the Russian state-sponsored hacking group APT29 of launching cyberattacks against several local media organizations. Last year, suspected Russian hackers infiltrated the Polish Press Agency’s website to publish fake news. And in September 2024, “unknown attackers from Russia” hacked a German radio station and encrypted all of its music files.