Ukraine — Cyber Threat Profile
CERT-UA reports that cyber incident volume declined in the second half of 2025 versus the first half, the first such drop since Russia's 2022 invasion. No critical incidents were recorded, and low-severity cases fell 87 percent. Rather than an escalating surge, CERT-UA describes a shift in tactics: after early-2025 "steal-and-go" credential theft, Russian-linked groups moved toward maintaining long-term access, revisiting previously breached infrastructure to see whether old credentials and footholds still work; APT28 and Void Blizzard are among the groups CERT-UA names. Ukraine's new cybersecurity law, aligning the country with the EU's NIS2 directive, took effect in April 2025, replacing the old CISS certification regime with a risk-based security authorization framework.- National CERT/CSIRT: CERT-UA
- Data protection authority: The Ukrainian Parliament Commissioner for Human Rights (the Ombudsman Office) (source: CNIL)
- World Cybercrime Index 2024 (origin significance): 36.44 / 100, #2 worldwide
- Secure Internet servers per 1M people (2024): 9,936.9 (source: World Bank)
- Internet users (2024): 82.5% of population (source: World Bank)
Latest Ukraine coverage
- One command exposed a 14,500 camera hijacking operation 2026-08-24 · Cyber Incidents
- Russia's Sandworm poses as a recruiter to trap IT admins 2026-08-10 · Nation-State
- Russian spies steal email with poisoned calendar invites 2026-08-07 · Nation-State
- Russia's Gamaredon hides Ukraine spying behind everyday web services 2026-06-26 · Nation-State
- Russia's FSB-linked Turla hits Ukraine with a stealthy new backdoor 2026-06-25 · Nation-State
- Russia-aligned hackers keep hitting Ukraine through an old WinRAR bug 2026-06-09 · Nation-State
Threat actors targeting Ukraine
- APT28 APT
- Ember Bear APT
- FrostyNeighbor APT
- Gamaredon Group APT
- Sandworm Team APT
- Star Blizzard APT
- Turla APT
- Winter Vivern APT
- Qilin Ransomware · 4 incident(s)
- DragonForce Ransomware · 1 incident(s)
Most targeted sectors
- Government & Public Sector 2 incident(s)
- Manufacturing 2 incident(s)
- Business & Professional Services 1 incident(s)
Recent claimed incidents
- SHERIFF 2026-05-12 · Public Sector
- Lexus 2026-05-04 · Manufacturing
- wmsopko.com 2026-04-27 · Manufacturing
- Ministry of Foreign Affairs of Ukraine 2025-03-06 · Public Sector
- favbet 2024-12-16 · Business Services