Cyber Incident Victim: Government of Ukraine
Date:
Feb 2022
Location:
Ukraine
Summary
Ukrainian government websites were compromised by attackers spreading false claims of surrender and a peace treaty with Russia. The Security Service of Ukraine and the Parliament issued alerts confirming the breaches, which targeted regional authorities and local government platforms to disseminate fabricated capitulation narratives. Additional disinformation campaigns leveraged Telegram channels to amplify these deceptive messages, attributed to Russian military intelligence. The incidents aimed to undermine public morale through coordinated cyber intrusions and propaganda efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 3, 2022, Ukraine's Security Service (SSU) disclosed that hackers compromised multiple local government and regional authority websites to disseminate fabricated claims of Ukraine's surrender to Russia. The attackers altered website content to falsely announce Ukraine had signed a peace treaty with Russia, specifically propagating messages about "capitulation" to undermine public morale. This incident occurred amid Russia's military invasion, which began on February 24. The SSU characterized the perpetrators as "enemy" hackers, though initial reports did not specify technical details of the compromise. Separately, Ukraine's Parliament confirmed the Public Broadcaster News platform in Kherson had been hijacked with identical disinformation content prepared for distribution. These coordinated actions aimed to create panic and erode trust in Ukrainian institutions by simulating official surrender announcements through legitimate but breached communication channels.
The SSU issued a public warning via Twitter on March 3, categorically denouncing the fake capitulation narrative as "another fake" and urging citizens to disregard the claims. Ukraine's State Service for Special Communication and Information Protection (SSSCIP) amplified this alert by redistributing the SSU's message to Ukrainian Twitter users. Two days prior, on March 1, the SSU had attributed similar disinformation campaigns to Russia's GRU military intelligence agency, noting their use of Telegram channels to spread false narratives. No technical remediation details were disclosed, but the government's response focused on rapid public debunking through official social media and parliamentary communications. The incident demonstrated an operational pattern of combining website compromises with psychological manipulation tactics during active hostilities.