MegaFon

Summary

Cyber specialists of Ukraine's Main Intelligence Directorate (HUR) conducted a significant cyberattack on one of Russia's largest mobile and internet operators, disrupting services for the telecom giant along with downstream operators Yota and NetByNet. The morning assault affected mobile and internet connectivity in Moscow, St. Petersburg, and multiple central regions, and temporarily blocked access to platforms such as Steam, Twitch, and Discord, which are reportedly used by Russian military and intelligence personnel. Russian communications watchdog Roskomnadzor confirmed the disruption, while Russian media characterized the event as a successful carpet DDoS attack. The targeted operator publicly maintained that its network was operating normally, attributing access problems to independent reasons.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On the morning of January 24, 2025, cyber specialists from the Main Intelligence Directorate (HUR) of Ukraine's Defense Ministry conducted a significant cyberattack targeting MegaFon, one of Russia's largest mobile and internet operators. The operation was reported by sources to The New Voice of Ukraine on January 25. The attack focused on MegaFon's systems and produced immediate operational disruption, with the impact extending beyond MegaFon itself to affect other Russian telecom and internet operators that rely on or interconnect with the same infrastructure. Among the operators that experienced problems were Yota and NetByNet, both of which are associated with the broader MegaFon group. As a result of the attack, residents in Moscow, St. Petersburg, and many central regions of Russia encountered issues with both mobile and internet services throughout the morning of the incident. Roskomnadzor, the Russian communications regulatory authority, confirmed the disruption affecting MegaFon, lending official acknowledgment to the scale of the event.

Russian media attributed the outage to a "successful carpet DDoS attack," describing it as a broad, distributed denial-of-service operation aimed at overwhelming MegaFon's network capacity. This characterization aligned with the observed effects, which involved widespread service degradation rather than reports of data destruction or long-term system compromise described in the available reporting. The disruption had visible downstream effects on popular online platforms. Russians temporarily lost access to services such as Steam, Twitch, and Discord, which are actively used by the country's military and intelligence services, according to the sources cited in the reporting. The loss of these platforms during the attack window had operational implications beyond ordinary consumer inconvenience, as it interrupted communication and gaming services that personnel relied upon. The geographic spread of the disruption, reaching major metropolitan areas including Moscow and St. Petersburg, underscored the scale of the impact.

In its public communications, MegaFon claimed that its network was operating "normally" while warning of access issues attributed to "independent reasons." This framing sought to minimize the appearance of a successful targeted attack while acknowledging that users were experiencing problems. Roskomnadzor's confirmation of the disruption provided an external validation that contradicted the operator's attempt to downplay the incident, as the regulator's acknowledgment indicated that the service degradation was significant enough to warrant official notice. The discrepancy between MegaFon's public statement and the regulator's confirmation illustrated the tension between corporate messaging during an incident and the operational reality observed by users and authorities.

The HUR attack on MegaFon followed a similar pattern of operations targeting Russian infrastructure supporting the country's military activities. On January 4, 2025, Ukraine's Defense Intelligence had previously targeted Regiontransservice, a service company maintaining freight wagons that also supports the operations of the Russian army. This prior operation demonstrated a pattern of focusing on entities that contribute to Russian military logistics and communications. The MegaFon operation extended this approach into the telecommunications sector, aiming to degrade the infrastructure that supports both civilian connectivity and military communications. The targeting of MegaFon, a major carrier with extensive network reach across Russia, amplified the operational effect of the attack beyond the initial system intrusion.

The response from MegaFon centered on public messaging rather than detailed technical disclosure, with the company attributing service issues to "independent reasons" while asserting normal network operation. This response pattern reflected a common approach among targeted organizations seeking to reassure customers and stakeholders while internal remediation efforts proceeded. Roskomnadzor's confirmation of the disruption provided an additional layer of acknowledgment that extended beyond MegaFon's own communications, indicating regulatory awareness of the service impact. The combination of MegaFon's limited acknowledgment and the regulator's confirmation, along with widespread user reports and observable loss of access to major online platforms, established a documented record of the attack's effects across multiple sources. The HUR's claimed responsibility for the operation, as reported by sources to The New Voice of Ukraine, framed the incident as part of Ukraine's broader efforts to target Russian infrastructure supporting military operations, with the attack on MegaFon positioned as an extension of ongoing operations against entities contributing to Russian military capabilities.

Sources

Sources available to members: 1 source.