Several Ukrainian media outlets attacked by Russian hackers

Russian hackers attacked several popular Ukrainian media outlets over the weekend, posting fake news related to the war.

Among the hackers' targets were Ukrainska Pravda — one of the largest Ukrainian online newspapers — as well as the business media site Liga.net and news websites Apostrophe and Telegraf.

All of these websites were hacked to spread the same piece of fake news — that Russia destroyed a unit of Ukrainian special forces in the eastern Ukrainian city of Avdiivka.

The Russian military captured Avdiivka earlier in February after Ukrainian forces had withdrawn from the city to “preserve the lives and health of servicemen,” according to Ukraine’s army chief, Oleksandr Syrskyi. There was no official information from Ukrainian authorities indicating that local special forces in the city had been destroyed by Russians.

Liga.net said that it immediately removed a fake news story from its feed, but it remained active for some time and was also automatically shared on the organization's X account (formerly Twitter).

“We apologize to our readers and are investigating where we may have security gaps to address the situation and prevent similar incidents in the future."

Ukrainska Pravda — the most visited news website in Ukraine — reported that it lost access to its X account late on Sunday. Hackers also used it to post fake content about Avdiivka.

Ukraine’s state cybersecurity agency (SSSCIP) attributed the attack to a Russian threat actor but didn’t specify which group was behind the incident. SSSCIP called this incident part of Russia’s “information warfare” against Ukraine. The agency is now investigating the attack.

Ukrainian media is a common target for Russian hackers. The attacks on media are typically non-destructive, instead focusing on the spread of disinformation, according to Yevheniia Nakonechna, the head of Ukraine's Computer Emergency Response Team (CERT-UA).

Russian hacker groups targeting Ukrainian media include notorious state-controlled threat actors like Sandworm.

Last year, CERT-UA detected several dozen cyberattacks on Ukrainian media outlets and their employees. The agency said that this is only a small fraction of all cases, as many organizations do not report cyber incidents.

The most intense period of Russian cyber activity against Ukrainian media was the beginning of the full-scale invasion in February 2022 and the subsequent months. “During this period, Russian authorities likely anticipated a quick victory and attempted to influence Ukrainians through media channels,” SSSCIP said.

Some of the attacks on media combine defacement and destructive methods. For example, in an attack on Ukraine's public broadcaster Suspilne in June, hackers temporarily disrupted the operation of some of its websites and then posted fake news there.

“By attacking our media, the enemy seeks to destabilize the situation in Ukraine, sow panic, cause Ukrainians to mistrust the state authorities or the military, spread their false propaganda and fakes, gain access to important information, including the personal data of media workers,” SSSCIP said.

Earlier this month, The Washington Post discovered a large-scale disinformation campaign aimed at undermining trust in Ukrainian authorities, including President Volodymyr Zelensky. According to the report, Kremlin-backed trolls made thousands of social media posts and hundreds of fabricated articles that circulated in Ukraine and Europe, intending to divide and destabilize Ukrainian society.