Ukrainian radio broadcaster hacked to spread fake news about Zelensky’s health

Two radio stations owned by one of Ukraine’s largest broadcasters, TAVR Media, were hacked on Thursday to spread fake messages that Ukrainian President Volodymyr Zelensky was hospitalized and in critical condition.

TAVR Media, which operates nine popular radio stations in Ukraine, told The Record that the music programs of Melodia FM and Radio Bayraktar were interrupted by hackers at around 1 p.m. local time. 

Cybercriminals tried to hack all nine radio stations, but most of the attacks were intercepted by the company’s cybersecurity team, according to Oksana Shavel, a spokeswoman for the broadcaster.

In a fake news report, hackers announced that Zelensky was under intensive care, and his duties were being performed by the Chairman of the Ukrainian parliament. 

Later that day, Zelensky posted a video on his official Instagram page denying the report. “I’m in my office and I’m healthier than ever,” he said. While the attack hasn't yet been attributed to any group, Zelensky has accused Russia of spreading misinformation.

The incident is the latest tit-for-tat between Russian and Ukrainian hackers as the war on the ground approaches its 150-day mark.

“They compete to see who can do it better,” Ukrainian telecom expert Olexandr Gluschenko told The Record. Earlier in June, a pro-Ukrainian hacker group attacked a Russian radio station to broadcast the Ukrainian national anthem and anti-war songs. Several Russian TV channels have also been repeatedly hacked to show on-the-ground scenes of the war in Ukraine.

The hacking collective #Anonymous hacked into the Russian streaming services Wink and Ivi (like Netflix) and live TV channels Russia 24, Channel One, Moscow 24 to broadcast war footage from Ukraine [today] pic.twitter.com/hzqcXT1xRU

— Anonymous (@YourAnonNews) March 6, 2022

It is not yet clear how the attackers breached TAVR Media, and Ukraine's CERT is still investigating the case. 

Radio Bayraktar, one of the stations attacked, was launched in March this year to play patriotic Ukrainian music. The station gets its name after a Turkish drone that has become a symbol of Ukraine’s resistance. 

Shavel said that there is probably no symbolism in the choice of targets — hackers attacked TAVR Media because its radio stations are the most listened to in the country, she said (independent ratings also confirm it).

The attack wasn’t thoroughly-planned either, according to Shavel. “The message did not sound like our ordinary news program,” she said. “The hackers used a robotic voice that spoke in poor Ukrainian and with stylistic errors.”

“We didn't even have time to get confused and blocked the message immediately,” Shavel added. A fake news report was aired for about 30 seconds. It is not yet clear how many Ukrainians heard it.

This is not the first attack on the Ukrainian media. In fact, online media, publishing, and broadcasting companies were targeted by more distributed denial-of-service attacks (DDoS) in the second quarter of 2022 than any other industry, according to Cloudflare.

Earlier in June, hackers attacked the Ukrainian streaming service Oll.tv and replaced the broadcast of a football match between Ukraine and Wales with Russian propaganda. In February, Ukraine’s national public broadcaster also suffered a DDoS attack, according to its general producer Dmytro Khorkin. “Russia has been attacking us all the time since the beginning of the war in Ukraine,” he told The Record.

Russian hackers and troops are targeting Ukraine’s telecommunication infrastructure both in cyberspace and on the ground. Since February 24, Russian rockets have destroyed 11 Ukrainian radio and television towers, as well as radio centers that broadcast to the occupied territories, according to Khorkin.