ALT-41 · Analysis · 23 Oct 2026
Kyivstar: a mobile network wiped in wartime
In December 2023 Ukraine's largest mobile operator went dark for days after attackers destroyed much of its core infrastructure. What Ukraine's security service said about how long they had been inside.
- May 2023Earliest intrusion, according to the SBU.
- 12 Dec 2023Services fail nationwide.
- Following daysServices restored in stages.
- 4 Jan 2024The SBU's cyber chief describes the intrusion to Reuters and attributes it to Sandworm, a unit of Russian military intelligence.
Why it mattered
A telecom operator is infrastructure for everything else: payments, alerts, emergency calls. Recovery in days rather than weeks came from engineers rebuilding systems while the war continued.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Months of quiet access usually precede a destructive day.
- Telecoms need restore plans measured in hours, not just backups.
- Critical alert systems should not depend on a single network.
What to do
- Hunt for long-dwelling access, not only for active malware.
- Keep isolated, immutable backups of core network configuration.
- Give alerting systems a second, independent delivery path.
Sources
- The Kyiv Independent — Reuters: SBU cybersecurity chief says Russian hackers had access to Kyivstar for months
- RFE/RL — Russian hackers were inside Ukrainian telecoms giant for months
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-41 — Kyivstar: a mobile network wiped in wartime. 23 Oct 2026. altumptic.com/research/kyivstar-2023