Internet disruptions registered as Russia moves in on Ukraine

Posted on

Network data from NetBlocks confirm a series of significant disruptions to internet service in Ukraine from Thursday 24 February 2022. Disruptions have subsequently been tracked across much of Ukraine including capital city Kyiv as Russia’s military operation progresses.

On the morning of Thursday 24 February 2022, internet disruptions were registered in Kharkiv, Ukraine’s second largest city:

Metrics show a loss of connectivity on the Triolan network, corroborating user reports of loss of fixed-line service. The disruption began amid reports of huge explosions in the region as Russia announced a military mobilization, and intensified over the course of the day.

Also on the morning of 24 February, hours prior to the commencement of Russia’s invasion of Ukraine, the Viasat satellite internet network which serves Ukraine and much of Europe was knocked offline in a targeted cyberattack:

Later in the day, a significant internet disruption was registered in the strategic port city of Mariupol, Donetsk. The incident came amid reports of civilian casualties and the loss of telecoms services for many subscribers:

 

In Kyiv, connectivity started to decline gradually from Thursday morning as civilians fled the capital or sought shelter:

On Saturday morning as the conflict reached Kyiv, a major disruption was registered to backbone internet provider GigaTrans, which supplies connectivity to several other networks.

While connectivity remained available through other routes and the disruption was brief, the incident is understood to have had significant impact to telecommunications infrastructure:

From Monday 28 February, fixed-line internet connectivity and some mobile service has collapsed in Sievierodonetsk, the acting administrative centre of Luhansk Oblast, leaving friends and family cut off. The city has been under intense artillery fire per reports:

NetBlocks metrics shoed progressing disconnections on network operator Kyivstar by 2 March. The operator reports over 500 base stations have been knocked out due to power outages and damage to infrastructure in conflict zones:

By the end of February, the besieged port city of Mariupol was knocked largely offline, amid disconnections attributed to power cuts and a humanitarian crisis caused by heavy combat:

On Thursday evening, 3 March, a major blackout was registered across Sumy Oblast, north-eastern Ukraine, as residents reported massive blasts at the thermal power plant and electrical substation that turned the sky ‘yellow and red’ for miles.

The incident marks the largest single region-wide disruption to telecoms service since the onset of the conflict, and is attributed to the destruction of the region’s electricity production and transmission infrastructure:

From 4 March 2022 NetBlocks tracked a loss of connectivity at the Zaporizhzhia nuclear power plant in southeast Ukraine, affecting fixed-lines and mobile services. The loss of communications was subsequently raised as a point of concern by the International Atomic Energy Agency:

On the morning of 9 March, metrics corroborated reports of a power blackout at the mothballed Chernobyl nuclear power plant, which continues to host spent nuclear fuel that requires cooling and monitoring:

On 9 March 2022, internet provider Triolan was targeted by a cyberattack for a second time, with the first instance having been observed on the morning of 24 February when invasion began. Both events have caused significant losses to connectivity at nation scale:

On the night of Thursday 10 March, an attack on the Kharkiv Institute of Physics and Technology, which hosts an ADS neutron source facility, was labelled an “act of nuclear terrorism” by the State Nuclear Regulatory Inspectorate of Ukraine. The incident following attacks at Zaporizhzhia and Chernobyl has heightened concerns that Russia might be intentionally targeting nuclear sites:

On Sunday 13 March, a major internet disruption was registered on the Vinasterisk network which serves Vinnytsia Oblast, western Ukraine. A staff member at the operator reported a massive cyberattack with elements of sabotage and theft via social media, promising more details soon:

 

On the morning of Wednesday 16 March, Internet provider Uacity was knocked offline before making a partial recovery. The incident followed Russian shelling targeting the urban district of Shevchenkivskyi, Kyiv, just hundreds of meters from the provider’s listed headquarters:

Financial problems have also presented challenges for network operators. On Tuesday 15 March, internet provider LocalNet announced that it would have to “lock down subscribers with debt on their account” due to difficulty paying the company’s own bills. The next day, Wednesday, connectivity collapsed and users who had missed a bill payment reported losing access to the internet:

On Monday 28 March, Ukraine’s national provider Ukrtelecom experienced an extended, nation-scale network disruption, following a major cyberattack. The extent of the incident has progressed over the course of the day, causing an increasing number of subscribers to fall offline, with over a thousand user complaints on the provider’s official Facebook page. On Monday night, the operator said it had mitigated the attack and a restoration of service was observed some 15 hours after the initial disruption.

On 1 April, leading provider Kyivstar announced that it had disconnected subscribers with outstanding bills, citing het need to repair damaged network infrastructure and pay taxes.

The incident follows similar measures by LocalNet. The company said that it had spared active combat zones and occupied territories from disconnection. Telemetry indicate that service was cut off and partially restored after some hours:

On Friday 8 April, multiple networks in Ukraine suffered a significant decline in connectivity, with operator WNET reporting an emergency situation affecting international connectivity to Europe:

On Wednesday, 13 April, metrics confirmed a collapse of connectivity across Cherkasy Oblast, attributed to the loss of service on McLaut, the region’s largest internet provider. The company is reporting a DDOS attack on its infrastructure, with the incident resolved after several hours:

On the early morning of Friday 15 April, attacks knocked out power and internet connectivity around Kyiv Oblast. The disruption has high impact to connectivity Vyshneve, where a transformer supplying power to various districts of Kyiv was damaged.

The attacks are believed to have targeted the Vizar Plant which manufactures Neptune missiles that allegedly sank Russia’s Black Sea flagship Moskva:

Between 22 and 23 April, internet provider Maxnet in Kharkiv, northeast Ukraine, suffered a series of disruptions that resulted in the total loss of service, which the provider attributed to combat damage to infrastructure:

On Saturday 30 April, NetBlocks tracked a near-total internet blackout across the occupied region of Kherson in south Ukraine, affecting multiple Ukrainian providers including Ukrtelecom, Kyivstar, and Volia. Mobile operator Vodafone reported that the incident was “unfortunately not an accident” and at least one anonymous Russian source claimed that Russia was now seeking to deploy its own replacement network:

On 1 May, hours after the internet blackout in Kherson, regional provider Skynet (Khersontelecom) partially restored access. However, connectivity on the network has been routed via Russia’s internet instead of Ukrainian telecoms infrastructure and is hence likely now subject to Russian internet regulations, surveillance, and censorship:

Metrics show that Khersontelecom’s traffic was rerouted to pass through provider Miranda, which serves Russian-occupied Crimea, and which in turn is supplied by upstream provider Rostelecom in Russia. Authorities responded to the incident and were able to reconnect the Kherson region via Ukrainian infrastructure on Wednesday 4 May. However, the network was again rerouted via Russia, seemingly permanently, at the end of May.

On the morning of Monday 10 October, several cities in Ukraine were targeted by coordinated Russian missile strikes in retaliation for the bombing of a bridge connecting Crimea to Russia, resulting in significant impact to energy and telecoms infrastructure in multiple regions. Following rapid repair efforts, much of the lost connectivity was restored by Tuesday:

On the morning of Saturday, 22 October, ongoing Russian missile strikes impacted power supply in multiple cities in southern Ukraine.

Meanwhile on Saturday afternoon as Ukraine made military headway into Russian-held Kherson, occupying forces ordered residents to evacuate ‘immediately’ and all networks that had previously been rerouted to Russia via Crimea’s Miranda Media fell offline:

On Tuesday 15 November 2022, major internet disruptions were registered in Ukraine and Moldova amid reports of one of the most intense Russian missile bombardments to date:

Moldova’s Deputy Prime Minister attributed the country’s power disruption to Russia’s attack on Ukraine:

On Wednesday 23 November, Ukraine’s saw a second massive collapse due to power outages as Russia initiated a new round of targeted attacks on energy infrastructure with national connectivity falling to 35% of previously observed levels, and again also impacting Moldova. Authorities reported that some of the last remaining nuclear power plants had been disconnected from the power grid:

Work is ongoing to assess the incidents and their contexts. Telecoms disruptions in Ukraine have so far been attributed to power outages, cyberattacks, sabotage, and kinetic impacts.

What’s happening in Ukraine?

Russian leader Vladimir Putin announced military mobilization on the morning of Thursday 24 February 2022 and artillery was fired while as moved into Kharkiv about 25 miles from the Russian border. The security situation deteriorated through subsequent days with Ukrainian authorities advising civilians to get off the streets and seek shelter.

Beside the disruptions to telecommunications infrastructure documented in this report, cyber-attacks have disrupted Ukraine’s defence and banking sectors.

Further reading:

Previously:

Methodology

NetBlocks diffscans, which map the IP address space of a country in real time, show internet connectivity levels and corresponding outages. Purposeful internet outages may have a distinct network pattern used by NetBlocks to determine and attribute the root cause of an outage, a process known as attribution which follows detection and classification stages.

NetBlocks is an internet monitor working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives to deliver a fair and inclusive digital future for all.

[ press | contact ] Graphics and visualizations are provided for fair use in unaltered form reflecting the meaning and intent in which they were published, with clear credit and source attribution to NetBlocks. Intellectual property rights are protected including but not limited to key findings, facts and figures, trademarks, copyrights, and original reporting, are held by NetBlocks. Citation and source attribution are required at the point of use.