Ukraine's SBU Has Neutralized More Than 16,000 Russian Cyberattacks Since 2022

A Number That Reveals the Scale of the Digital Front

The cybersecurity department of Ukraine's Security Service, the SBU, has announced it has neutralized more than 16,000 Russian cyberattacks since the start of the full-scale war in February 2022. This figure, confirmed by Brigadier General Volodymyr Karastelov, head of the department, illustrates the scale of a digital front largely invisible to the general public, yet just as strategic as the ground combat lines.

According to Karastelov, the preferred targets of these Russian attacks are Ukrainian government agencies, financial institutions, the defense sector, and, increasingly, Ukrainian media, seen as a prime strategic target in this information war.

Why the Media Became a Russian Priority

This systematic targeting of Ukrainian media is no accident: controlling or sabotaging a wartime country's information channels lets the aggressor sow confusion, spread propaganda under an appearance of local legitimacy, and weaken the informational cohesion of a population already under constant bombardment pressure.

This strategy fits Russia's hybrid warfare doctrine, which has for years combined physical strikes with digital influence operations to maximize the destabilizing effect on Ukrainian society.

A Digital Offensive of Rare Intensity

The most recent case documented by the SBU involves a distributed denial-of-service attack, or DDoS, lasting three hours, directed at the website of a Ukrainian national television channel. At its peak, the attack generated up to 200,000 requests per minute, a traffic volume designed to completely overwhelm the targeted servers.

The botnet used to carry out this attack was made up of nodes spread across Asia, Europe and the United States, an international architecture deliberately designed to mimic real user behavior, making detection harder and exhausting the target's server resources.

Technical Resilience That Averted the Worst

Thanks to the intervention of SBU cybersecurity specialists, the television channel's website remained operational without interruption despite the intensity of the attack, a result that reflects a digital defense capability considerably strengthened since the conflict began.

This technical resilience, though rarely covered in the media, is a tangible victory in a war where every public service kept running represents a direct failure for Russian destabilization objectives.

A Two-Stage Attack Against Another Broadcast Group

In 2025, another Ukrainian television group was the target of a more sophisticated attack, carried out in two distinct stages: an initial phishing campaign aimed at obtaining fraudulent access, followed by an attempt to penetrate information infrastructure through adjacent systems connected to the main network.

The final goal of this operation was not simple technical disruption but the complete takeover of the digital resource in order to broadcast Russian propaganda under the name and credibility of the legitimate Ukrainian outlet targeted.

Timely Detection That Averted an Information Catastrophe

SBU specialists managed to detect this intrusion in time, preventing the takeover of the outlet and thereby averting an information catastrophe that could have misled thousands, even millions, of Ukrainian viewers about the authenticity of the broadcast content.

This precedent illustrates an escalation in the sophistication of Russian methods, moving from simple saturation attacks to complex attempts at hijacking media identity for mass disinformation purposes.

A Russian Military Unit Built for Cyberwarfare

Behind several of these campaigns looms the shadow of Unit 29155 of Russian military intelligence, the GRU, initially designed as a dedicated cyberwarfare arm before broadening its scope to other forms of hostile operations against Ukraine and its Western partners.

This unit has run spear-phishing campaigns directly targeting President Volodymyr Zelensky's office as well as several Ukrainian ministries, aiming to gain unauthorized access to sensitive communications at the highest levels of the state.

The Deployment of the Destructive WhisperGate Malware

Even before the full-scale invasion began, this same unit had deployed the destructive WhisperGate malware, designed to irreversibly wipe data from Ukrainian computer systems, a digital sabotage operation preparing the ground for the military aggression that would follow.

This prior deployment shows that Russia's hybrid war against Ukraine began well before the first tanks crossed the border, confirming that preparation for this invasion played out simultaneously on military and digital fronts.

A Joint Initiative Between the SBU and the Broadcasting Regulator

Faced with this persistent threat, the SBU launched a cybersecurity resilience project for local and regional media outlets, in partnership with Ukraine's National Council of Television and Radio Broadcasting, the country's broadcasting regulator.

This program acknowledges an important strategic reality: major national outlets are not the only potential targets, and regional structures, often less technically equipped, represent a vulnerable link that urgently needed reinforcement.

Nationwide Coverage in 2026

In 2026, the SBU organized a series of hands-on cybersecurity training sessions in 20 regional locations, covering media representatives from all 21 oblasts in Ukraine, near-complete territorial coverage that reflects the scale of the effort deployed.

Nearly 450 participants took part in these sessions, including media managers, journalists, editors-in-chief and technical specialists, a diversity of profiles that reflects the need for cybersecurity awareness at every level of a media organization.

A Sector Vital to Economic Stability in Wartime

Beyond the media, Ukrainian financial institutions are among the priority targets identified by the SBU, a threat that takes on particular weight in a country whose economy must stay functional despite constant bombardment and the logistical challenges of a prolonged war.

A successful attack on Ukraine's banking infrastructure could paralyze routine transactions, affect the payment of salaries and pensions, and undermine citizens' already fragile confidence in their country's economic stability in the middle of a war.

Financial Defenses Strengthened by the Experience of Conflict

Experience accumulated since 2022 has allowed Ukrainian financial institutions, in coordination with the SBU, to develop increasingly sophisticated defense protocols, significantly reducing the window of opportunity for successful attacks against this critical sector.

This collective skill-building illustrates a broader dynamic observed across the entire Ukrainian cybersecurity sector: every repelled attack becomes a lesson built into future defenses, a virtuous circle forged under the pressure of war.

Attacks Aimed Directly at Ukrainian Military Capability

Ukraine's defense sector remains a prime target for Russian cyberattacks, the goal being to obtain information on military capabilities, troop movements or weapons supply chains, data whose strategic value to the aggressor is immediately exploitable on the battlefield.

This dimension explains why the SBU devotes considerable resources to protecting this specific sector, since every potential breach could translate directly into human and material losses on the front lines.

Strengthened Cooperation With Western Partners

Given the scale of this threat, Ukraine has developed increased cooperation with its Western partners on cyberdefense, a sharing of intelligence and best practices that benefits Kyiv as much as it benefits Western countries themselves, now facing similar campaigns from Russia.

This transatlantic cybersecurity cooperation illustrates a broader strategic reality: Ukrainian digital defense is no longer just a national issue, it has become a learning laboratory for all Western democracies facing the same hybrid threat.

From Simple Denial-of-Service to Complex Social Engineering

The evolution of methods documented by the SBU, from simple traffic-saturation denial-of-service to complex phishing campaigns followed by infrastructure penetration, reveals a growing technical sophistication among Russian operators over the years of conflict.

This technical escalation is unsurprising: it reflects sustained investment by Moscow in its offensive cyber capabilities, viewed as a full-fledged tool of war, cheaper and politically less risky than a conventional military strike.

Constant Adaptation Required on the Ukrainian Side

This growing sophistication forces the SBU and its partners into permanent technical adaptation, with every newly detected attack method requiring immediate analysis to anticipate future variants and strengthen defenses accordingly.

This digital cat-and-mouse game, though less visible than ground combat, engages considerable human and technological resources on both sides, with stakes just as real for the overall outcome of the conflict.

A Hybrid War That Never Pauses

This ongoing cyber campaign, documented by the SBU for more than four years, confirms that Russian strategy against Ukraine is never limited to a single front. Missile strikes, ground offensives and cyberattacks fit into the same doctrine of total war aimed at exhausting every dimension of Ukrainian resilience.

This multidimensional approach explains why Ukrainian defense, to be effective, must itself operate on several fronts simultaneously, a reality that demands exceptional coordination among the armed forces, intelligence services, and civilian institutions.

A Model of Resistance That Inspires Beyond Ukraine's Borders

Ukraine's ability to keep its critical infrastructure operational despite thousands of documented cyberattacks is a model of digital resistance increasingly studied by Western experts facing similar, though generally less intense, threats.

This expertise, accumulated literally under fire, now places Ukraine among the world's most experienced nations in applied cyberdefense, a skill acquired at great cost but one that could prove valuable in postwar negotiations on security cooperation with the West.

What the SBU Cannot Reveal Publicly

By nature, cyberdefense operations require a degree of necessary confidentiality: publicly revealing every detection and neutralization method used by the SBU would hand Russian attackers valuable information for bypassing these defenses in the future.

This confidentiality constraint explains why certain technical details of the 16,000 neutralized attacks remain deliberately vague in the Ukrainian security service's public communications, an understandable methodological caution given the context of active war.

A Trust That Must Still Rest on Verifiable Facts

Despite this necessary confidentiality, the specific figures and cases made public by the SBU, such as the 200,000-requests-per-minute DDoS attack or the 2025 media hijacking precedent, offer enough verifiable detail to establish the general credibility of the security service's claims.

This partial transparency, balanced against operational security imperatives, allows the Ukrainian and international public to gauge the real scale of this digital war without compromising the country's defensive capabilities.

Journalists on the Front Line of a Digital War

Behind every neutralized cyberattack statistic are journalists, technicians and Ukrainian media employees who work daily under the constant threat of a digital intrusion, on top of the already considerable physical risks of covering an active war on their own territory.

This dual pressure, technical and physical, weighs on media professionals already worn down by more than four years of conflict, who must now treat cybersecurity as a basic professional skill rather than a technical subject reserved for IT specialists.

Professional Resilience Forged Under Pressure

The training sessions organized by the SBU across Ukraine's 21 oblasts reflect this need for rapid professional adaptation, turning journalists and media managers into active participants in their own cyberdefense rather than passive victims of outside attacks.

This collective skill-building, though born of the tragic necessity of war, could become a lasting legacy for Ukraine's media sector well beyond the hoped-for end of the conflict.

A Preview of Future Threats for Europe and North America

The methods documented against Ukraine, from massive DDoS attacks to sophisticated media hijacking attempts, offer a troubling preview of the tactics Russia could deploy against other Western democracies should geopolitical tensions intensify further.

Several Western cybersecurity experts are now actively studying the Ukrainian experience to strengthen their own defense protocols, recognizing that what is happening in Kyiv today could well foreshadow similar threats elsewhere tomorrow.

A Need for Stronger Collective Vigilance

This situation calls for greater international cooperation on cyberdefense, where intelligence sharing between Ukraine and its Western partners becomes a strategic investment in the collective security of the entire democratic world.

Ignoring these Ukrainian lessons would mean repeating the under-preparation mistakes that allowed Russia to develop its offensive cyber capabilities for years without a sufficiently coordinated response from the international community.

A Front That Fits Into the Global Rivalry With Authoritarian Regimes

This Russian cyberwar against Ukraine cannot be separated from a broader dynamic in which China, Iran and North Korea are also developing considerable offensive digital capabilities, often in tacit or explicit coordination with Moscow as part of their growing strategic convergence.

This authoritarian convergence in the cyber domain adds another dimension to the structural challenge these regimes pose to the collective security of Western democracies, far beyond the Ukrainian theater alone.

Why This File Reaches Well Beyond Ukraine's National Borders

Ukraine's digital resistance, documented through these 16,000 neutralized cyberattacks, must therefore be understood as part of a global confrontation between democracies and authoritarian regimes, where every Ukrainian defensive victory also represents a strategic gain for the entire free world.

This broader perspective justifies increased international support, not only military and humanitarian, but also technical and financial, to further strengthen the cyberdefense capabilities of a country that is ultimately protecting far more than its own digital borders.

A Considerable Budgetary Effort in the Middle of War

Maintaining a cyberdefense capability able to neutralize more than 16,000 attacks requires considerable budgetary resources, in a context where every available hryvnia must also fund the conventional military effort, the reconstruction of destroyed infrastructure, and support for populations displaced by the war.

This structural budgetary tension explains why international support for cybersecurity, whether financial, technical or in training, represents a valuable complement to Ukraine's national effort, allowing the SBU to maintain and improve its defensive capabilities despite severe budget constraints.

Technology Partnerships That Strengthen National Resilience

Several Western technology companies have developed direct partnerships with Ukrainian authorities to strengthen the country's digital defenses, support that goes beyond the strictly governmental framework to include the global private technology sector in this collective effort.

These partnerships, often less visible than conventional military aid, nonetheless play a decisive role in the SBU's continued ability to identify, analyze and neutralize increasingly sophisticated cyber threats coming from Russia.

A Record That Commands Respect Despite the Odds

More than 16,000 neutralized Russian cyberattacks since 2022, a massive DDoS attack repelled without service interruption, and a media hijacking attempt foiled in time: this record, compiled by the SBU, reflects a Ukrainian digital resilience forged under the most extreme adversity.

This defensive performance, achieved amid active war and limited resources, deserves international recognition equal to its strategic importance, both for Ukraine itself and for all the Western democracies watching and learning from this experience.

A Fight That Continues, Invisible but Decisive

As the physical war continues along Ukraine's eastern front lines, this parallel digital war also continues without letup or pause, demanding constant vigilance from SBU teams and their Western partners.

This invisible fight, however little media coverage it gets compared with images of trenches and bombardments, remains just as decisive for the final outcome of a conflict that is shaping Ukraine's future and, by extension, that of European security as a whole.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.