State Treasury Service of Ukraine
Incident posture
Linked entities
- Victim
- State Treasury Service of Ukraine
- Threat actors
- 0 actors
- Sources
- 1 source
Timeline
Summary
The State Treasury Service's website was compromised, redirecting visitors to an external site for several hours, while the Ministry of Finance's homepage experienced loading failures. The incident disrupted access to both agencies' online resources, with no immediate official statements provided regarding the disruptions.
Motives
Detailed motive labels are available to members.
TTPs
Detailed technique labels are available to members.
Description
On December 6, 2016, the State Treasury Service of Ukraine experienced a cybersecurity incident involving unauthorized interference with its official website. For several hours that Tuesday, visitors attempting to access www.treasury.gov.ua were automatically redirected to an external domain, www.whoismrrobot.com, rather than the legitimate government portal. This redirection disrupted normal access to treasury services and information resources during operational hours. Simultaneously, the website of Ukraine’s Ministry of Finance encountered technical disruptions preventing users from loading its homepage, though no redirect was reported for this secondary system. The coordinated timing of both incidents suggested potential systemic vulnerabilities across Ukrainian financial infrastructure platforms. Neither agency’s press service provided immediate public statements regarding the disruptions during the active incident window.
The website disruptions impaired public access to critical government financial portals, though the full operational impact remained unquantified due to lack of official disclosures. The redirection to whoismrrobot.com—a domain referencing a fictional hacker character from television—implied demonstrative intent by the perpetrators, though no explicit claims of responsibility or motives were documented in available sources. Both the State Treasury Service and Ministry of Finance maintained silence regarding technical mitigation measures, restoration timelines, or investigative responses throughout the initial reporting period. The absence of confirmed attribution or detailed impact assessments left unresolved questions regarding data integrity, service recovery, and potential collateral effects on dependent systems interfacing with the compromised web infrastructure.
Sources
Sources available to members: 1 source.