Kyivstar Sandworm wiper attack

On December 12, 2023, Sandworm operators executed a destructive wiper attack against Kyivstar, Ukraine's largest mobile-network operator (approximately 24.3 million subscribers; subsidiary of VEON Ltd.). Investigation by Ukraine's Security Service (SBU) determined that the attackers had been inside Kyivstar's network since at least May 2023, having gained initial access via a compromised employee account, and had achieved full network access by November. The destructive payload wiped thousands of virtual machines and workstations across Kyivstar's IT estate, taking mobile and home-internet services offline for periods ranging from hours to days. Air-raid warning services in the Kyiv and Sumy regions, dependent on Kyivstar connectivity, were materially affected during ongoing Russian missile strikes against Ukrainian cities. The pro-Russia hacktivist persona Solntsepyok claimed responsibility on Telegram; SBU cyber-chief Illia Vitiuk publicly attributed the operation to Sandworm (GRU Unit 74455), and Ukraine subsequently began gathering evidence for possible International Criminal Court referral. The incident is the largest publicly known destructive cyberattack on a single commercial telecommunications operator on record.

Approximately 24.3 million mobile subscribers offline for hours to days; air-raid warning systems impaired in two regions during active missile strikes; thousands of virtual machines and workstations destroyed; hundreds of millions in remediation and business cost to VEON; doctrinal precedent for treating commercial telecom infrastructure as a combat target.