SBU Details Russian DDoS and Phishing Campaigns Against Ukrainian Broadcasters

SBU cyber department head Volodymyr Karastelyov described two unreported incidents: a three-hour botnet DDoS peaking at 200,000 requests per minute that was contained, and a 2023 dual-vector operation combining phishing with lateral movement through connected systems. Both aimed at broadcast disruption or content replacement. SSSCIP data records over 200 successful Russian operations against media since 2022 using phishing, DDoS, defacement, and wiper malware, part of a documented shift from government and energy targets.

Technical patterns show Russian operators moving beyond availability attacks to credential theft and session hijacking for narrative control. This aligns with prior campaigns documented in ESET and Recorded Future reporting where compromised Ukrainian outlets amplified fabricated stories. Physical strikes on Channel 5 studios this week compound the pressure, creating combined kinetic-cyber effects on information flow.

The evidence trail indicates prioritization of media infrastructure for both suppression and mimicry, consistent with procurement and job postings for influence-focused tools. Independent attribution remains limited to infrastructure indicators; SBU statements stop short of naming specific GRU or SVR subgroups despite matching TTPs seen in prior Sandworm activity.

Operational impact centers on eroded public trust and resource diversion from frontline defense. Expect continued targeting of regional outlets with lower security budgets through supply-chain vectors in the next quarter.