Ongoing Large-Scale Cyberattack by Ukraine Disrupts Russian Banks’ Services

• A Ukrainian cyberattack on Russian banks caused significant disruptions in the country.
• This was part of a larger, ongoing Ukrainian cyber operation in the backdrop of the conflict between the two countries.
• The attack reportedly impacted social apps, internet providers, and public transportation payments as well.

The ATM services of top Russian banks were hit by a massive cyberattack on July 27, the fifth day of a large-scale Ukrainian cyberattack, as per a report from the Kyiv Post newspaper. The attack allegedly aimed to sabotage the Russian banking sector, which plays a crucial role in financing the country’s military operations.

The cyberattack impacted several prominent banks in Russia, including Dom.RF, VTB Bank, Alfa-Bank, Sberbank, Raiffeisen Bank, RSHB Bank, Rosbank, Gazprombank, Tinkoff Bank, and iBank, by targeting their payment systems and mobile applications.

The Ukrainian cyberattack that began on the morning of July 23 managed to freeze bank payment systems and apps, access major banks’ databases, and cause outages in personal offices, as per a source working in Ukrainian intelligence told the newspaper.

Russian mobile and internet providers Beeline, MegaFon, Tele2, and Rostelecom suffered disruptions as well, and popular online messengers and the largest Russian social networks were also targeted.

The source said the attack is part of a larger cyber operation and “gaining momentum.” Speaking of cyberattacks, a January cyberattack against a municipal energy company was recently disclosed. Heating systems were impacted, leaving over 600 apartment buildings in Lviv, Ukraine, in sub-zero temperatures for two days.

Last month, the U.S. returned an indictment charging a Russian citizen with conspiracy to hack into and destroy Ukrainian computer systems and data in an attack launched prior to Russia’s February 2022 invasion of Ukraine. Known as the WhisperGate malware campaign, it targeted several Ukrainian ministries, exfiltrating data and selling it online.

In early June 2024, the NoName pro-Russia hacker group claimed a cyberattack on US-based aerospace and defense company ‘General Dynamics’ subsidiary in Spain, which refurbishes old tanks for Ukraine.