Ukrainian Railways hit with ambitious cyberattack, traffic unscathed

Ukrainian Railways has been targeted in a large-scale and sophisticated cyberattack, the state railway operator said Monday morning, but the attackers failed to disrupt traffic.

Both Russia and Ukraine have been executing cyberattacks since Moscow sent troops and tanks to the neighboring country in February 2022.

Multiple companies and state agencies have been targeted in the past three years. Needless to say, most of them are by now prepared to handle the emergency. That’s what happened on Sunday, too.

According to Ukrainian Railways (Ukrzaliznytsia), the company’s online systems were hit with a cyberattack over the weekend and are still being restored, but “the enemy failed to achieve the main objective.”

“The movement of trains is stable. They run in an orderly manner, without delays,” the railway operator said in a post on its official Telegram account, explaining that due to similar incidents in the past, backup protocols were in place.

“Trains continue to move despite physical attacks on the infrastructure, and even the most vile cyberattacks cannot stop them,” the operator continued.

Ukrainian Railways also called the attack “systemic” and “multi-level,” saying it was orchestrated by “the enemy,” presumably Russian state agencies or state-sponsored hackers.

The state company is working with specialists from the Security Service of Ukraine to restore backup data.

Last month, a report by Google Threat Intelligence Group said that Russia was increasingly turning to cybercriminals to support its goals in Ukraine. To the Kremlin, it’s simply cheaper. Plus, using cybergangs increases deniability.

In December 2024, Ukraine’s state registers, which are deemed critical infrastructure in the country, were knocked out for at least two weeks after another suspected Russian cyberattack.