Cyber Incident Victim: SimStar
Date:
Dec 2025
Location:
Russia
Summary
Ukrainian hackers compromised SimStar, a Crimean internet service provider, by wiping its network routers during a New Year's Eve attack, causing prolonged connectivity outages. The incident, claimed by the Ukrainian hacktivist group BO Team, disrupted services for days and mirrored simultaneous attacks against another Russian ISP.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
Ukrainian hacktivist group BO Team executed a disruptive cyberattack against Russian internet service provider SimStar during the New Year's Eve period in late December 2025 or early January 2026. The attackers compromised SimStar's network infrastructure in Crimea, a disputed territory annexed by Russia in 2014. Using unauthorized access, the hackers systematically wiped configuration data from network routers, causing widespread service disruption that left customers without internet connectivity for multiple days. The attack coincided with a similar operation against Kraft-S, another Russian ISP based in Samara, though the incidents appear geographically distinct. Both disruptions occurred during a period of heightened cyber hostilities between Ukrainian and Russian entities following Russia's full-scale invasion of Ukraine in 2022.
The BO Team publicly claimed responsibility for both ISP attacks through undisclosed channels, though technical evidence confirming their involvement wasn't detailed in public reports. SimStar's Crimea operations were particularly vulnerable due to the region's contested political status and potentially weaker infrastructure integration with mainland Russian networks. No data theft or financial motives were reported - the operation focused exclusively on causing service disruption through destructive router wiping. Russian telecommunications regulators and SimStar's technical teams worked to restore services by reinstalling router firmware and reconfiguring network settings. The incident highlighted ongoing vulnerabilities in critical internet infrastructure during geopolitical conflicts, particularly for organizations operating in disputed territories with complex administrative oversight. Connectivity was fully restored several days after the initial compromise through manual reconfiguration efforts by technicians.