From NotPetya to Aeroflot: The 10 Biggest Cyberattacks of the Russia-Ukraine War

On the evening of November 1, 2026, Ukrainians began receiving false alerts in the “Air Raid Alert” app. Users were warned about an alleged radiation hazard, street fighting in Kyiv, and the launch of an “Oreshnik” missile. The Ukrainian Air Force reported external interference with the service.

On the night of November 2, Russia’s Ministry of Emergency Situations reported a similar cyberattack. Its app was also sending false alerts, including warnings of a nuclear threat. There is currently no reliable evidence linking the incidents.

These are the latest episodes in a cyberwar that has been ongoing for over a decade. During this time, hackers have left hundreds of thousands of people without electricity, disrupted mobile communications, and attacked satellite networks, government agencies, banks, and airlines. Some operations have caused billions in damages and affected other countries.

UA.News has compiled a list of the 10 largest cyberattacks of the Russian-Ukrainian war—five against Ukrainian infrastructure and five against Russian infrastructure.

How Hackers First Left 230,000 Ukrainians Without Power

On December 23, 2015, Ukraine experienced its first documented cyberattack, which caused a large-scale power outage. The attackers infiltrated the computer systems of three regional power distribution companies and gained access to the control systems of electrical substations.

According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), approximately 225,000 consumers were left without power. The outages lasted from one to six hours.

The hackers used the BlackEnergy malware to gain access and carried out the power outages via remote access to the equipment. Additionally, they damaged computer systems and disrupted communication channels.

Utility workers had to switch to manual control to restore power. The attack was later linked to the Russian group Sandworm, which is associated with Russian military intelligence.

The incident demonstrated that cyberattacks can not only lead to data loss but also directly disrupt the operation of critical infrastructure.

In 2016, hackers again attacked the Ukrainian power grid using the Industroyer program, which caused a power outage in parts of Kyiv. In 2022, Ukraine also thwarted an attempt to deploy an updated version of Industroyer, known as Industroyer2.

NotPetya: How the Attack on Ukraine Cost the World $10 Billion

On June 27, 2017, Ukraine suffered one of the most costly cyberattacks in history. The NotPetya malware spread through an infected update to the M.E.Doc accounting software.

The virus locked computers and corrupted data. Although users were asked to pay a ransom, the program’s true purpose was to destroy data.

In Ukraine, banks, government agencies, and businesses were affected. The virus soon spread through international corporate networks.

Among the hardest-hit were the shipping company Maersk, the pharmaceutical company Merck, and the logistics operator TNT Express. The computer infections caused disruptions in international transportation, manufacturing, and other operations.

According to widespread estimates, the total losses amounted to approximately $10 billion.

In February 2018, the British government blamed the Russian military for NotPetya. The attack demonstrated the danger of malware infecting software used by a large number of companies. Through a single compromised product, hackers were able to spread the destructive malware far beyond Ukraine’s borders.

How Hackers Shut Down Russia’s RuTube for Three Days

On May 9, 2022, a large-scale cyberattack disrupted the Russian video platform RuTube, which had been developed as an alternative to YouTube.

The service became unavailable to users, and it took nearly three days to restore it. It wasn’t until May 11 that the platform began to gradually return to normal operation.

As reported by Reuters, several teams of cybersecurity specialists were brought in to address the aftermath.

RuTube representatives stated that the attackers had attempted to take the service offline. At the same time, the company assured that the video library and user data had been preserved.

The attack took place on May 9, when Russian media were actively covering Victory Day celebrations. At the same time, there were reports of interference with electronic television broadcasts, where anti-war messages appeared in place of program titles.

How Russia Attacked Satellite Communications Before the Full-Scale Invasion

On February 24, 2022, approximately one hour before the full-scale invasion, hackers attacked Viasat’s KA-SAT satellite network.

According to estimates by Western governments, the goal was to disrupt communications for the Ukrainian military. The attackers interfered with the operation of satellite terminals, causing a significant number of devices to stop working.

Users in Ukraine and other European countries felt the impact. In particular, problems arose with equipment used for remote monitoring of wind farms in Germany.

In May 2022, the U.S., the U.K., and the EU blamed Russia for the attack. According to the U.K.’s National Cyber Security Center, the operation began shortly before the invasion and was aimed at disrupting Ukrainian communications.

How Ukrainian Intelligence Reported a Hack on Russia’s Tax Service

On December 12, 2023, Ukraine’s Main Intelligence Directorate reported a large-scale cyberoperation against Russia’s Federal Tax Service.

According to the Main Intelligence Directorate, Ukrainian specialists infiltrated the agency’s central server and gained access to more than 2,300 regional servers.

Intelligence officials stated that they had destroyed the databases, backup copies, and configuration files necessary for the tax systems to function. It was also reported that communications between the central office in Moscow and regional offices had been disrupted.

The Tax Service uses digital infrastructure for taxpayer registration, financial reporting, and interaction between businesses and the government. Therefore, damage to this infrastructure could potentially affect a significant number of administrative processes.

How Russian Hackers Cut Off Millions of Kyivstar Subscribers

On December 12, 2023, a large-scale cyberattack disrupted operations at Kyivstar, Ukraine’s largest mobile operator.

Approximately 24 million of the company’s subscribers experienced problems accessing mobile services and the internet. The disruptions also affected businesses and equipment that relied on the operator’s network.

According to representatives of the Security Service of Ukraine (SBU), Russian hackers had access to Kyivstar’s internal systems since at least May 2023. They were able to study the network and prepare the attack for months.

According to the company’s president, Oleksandr Komarov, approximately 70% of its virtual infrastructure was affected.

In May 2024, Reuters reported that the operator had allocated approximately $90 million to address the fallout, restore infrastructure, and support subscribers.

Ukrainian authorities linked the attack to the Russian group Sandworm. The Solntsepyok group, which Ukrainian intelligence agencies believe is linked to Russian military intelligence, also claimed responsibility.

How Ukrainian Hackers Attacked Russia’s Largest Banks and Payment Systems

On July 23, 2024, a large-scale series of cyberattacks on Russian financial infrastructure began. According to Ukrainian media reports citing sources in the Main Intelligence Directorate (GUR), the targets included Sberbank, VTB, Alfa-Bank, Gazprombank, and other financial institutions.

Users of some banks experienced difficulties accessing online services. Disruptions were also reported in the operations of payment systems and telecommunications providers. In late July, the attacks also affected the website of the Central Bank of Russia.

The primary method used was DDoS attacks, which overload servers and can temporarily render online services inaccessible.

According to The Kyiv Independent, problems with accessing the Russian Central Bank’s website arose on July 29. However, these reports did not indicate any loss of customer funds or a complete shutdown of the Russian banking system.

Ministry of Justice Registers Compromised: Why Ukrainians Couldn’t Register Real Estate or Process Documents

On December 19, 2024, a large-scale cyberattack disrupted the operation of the state registries of the Ministry of Justice of Ukraine. Systems for registering real estate, businesses, civil status records, and other legal transactions became temporarily unavailable.

Citizens, notaries, entrepreneurs, and government agencies were affected by the issues. Some registration procedures had to be suspended. The then-Minister of Justice, Olga Stefanishyna, reported that restoring the main registries could take approximately two weeks.

As reported by Reuters, Ukrainian authorities blamed Russia for the attack and began restoring the information systems. At the same time, there was no evidence of a massive leak of personal data during the initial stage of the investigation.

How Hackers Disrupted Operations at Russia’s Largest State-Owned Media Holding Company

On October 7, 2024, a cyberattack disrupted operations at the All-Russian State Television and Radio Broadcasting Company (VTRK), which includes “Rossiya 1,” “Rossiya 24,” and other channels.

The attack caused problems with online services, internal systems, the internet, and telephone communications. Some online broadcasts became unavailable.

According to Reuters, the Kremlin described the incident as unprecedented in scale. At the same time, main television broadcasts continued to operate. Russian media reported that information may have been deleted from servers, but it was not possible to independently verify all the damage.

A Ukrainian government source told Reuters that Ukrainian hackers were involved. The agency was unable to verify this information.

The attack took place on Vladimir Putin’s birthday and became one of the most high-profile disruptions to Russian state media.

How Hackers Paralyzed Aeroflot and Caused the Cancellation of Over a Hundred Flights

On July 28, 2025, a cyberattack disrupted operations at Russia’s largest airline, Aeroflot. Due to damage to the company’s computer systems, over a hundred flights had to be canceled. The biggest problems occurred at Moscow’s Sheremetyevo Airport.

The Silent Crow group and the Belarusian “Cyberpartisans” claimed responsibility for the attack. The attackers claimed that they had been inside the company’s internal network for a long time, gained access to confidential information, and took thousands of servers offline. However, these claims have not been fully and independently verified.

The Russian Prosecutor General’s Office confirmed the cyberattack and opened a criminal investigation.

As reported by the Associated Press, the massive outage led to the cancellation of more than 100 flights and disrupted operations at Russia’s largest airline.

How the cyberwar between Ukraine and Russia has changed over 12 years

Over the course of more than 12 years of the Russian-Ukrainian war, cyberattacks have become a tool of confrontation capable of disrupting critical infrastructure, the economy, and government institutions.

Attacks on Ukrainian power grids have shown that hackers can cause actual power outages. NotPetya demonstrated the danger of the international spread of malware, while Viasat highlighted the dependence of military and civilian communications on shared infrastructure.

After the start of the full-scale invasion, cyber operations became more closely linked to combat operations. Ukrainian mobile operators, government registries, and energy companies came under attack.

At the same time, attacks on the Russian tax service, banks, media outlets, and airlines demonstrated the vulnerability of Russia’s digital infrastructure.

Recent incidents involving emergency alert apps on November 1–2, 2026, revealed yet another front in the conflict—the spread of false information through systems that the public trusts during times of danger.

Modern infrastructure needs protection not only from missiles, drones, and physical sabotage. The consequences of cyberattacks can also extend far beyond computer networks and affect millions of people.