Cybersecurity incident — 2022-01-14 00:00:00
Affected organization: Undetermined
Affected country: Ukraine
Industry: Finance and Insurance
Event type: Disruptive
Event subtype: Message Manipulation
Motive: Sabotage
Actor: DEV-0586
Actor type: Nation-State
Actor country: Russian Federation

On January 14, 2022 Orthodox New Year, over 70 Ukrainian government websites were defaced with political imagery and a statement in Russian, Ukrainian, and Polish before going down temporarily. Most sites were restored within hours. The attack crippled much of the government's public-facing digital infrastructure, including the most widely used site for handling government services online, Diia. Diia also has a role in Ukraine's coronavirus response and in encouraging vaccination. It also crippled the sites of the Cabinet of Ministers, and the ministries of energy, sports, agriculture, veterans' affairs, and ecology. The Ukrainian company Kitsoft also confirmed that it found the WhisperGate malware on some of its systems. At least 50 of the 70 sites targeted for defacement were developed and maintained by Kitsoft. Kitsoft was compromised, which allowed the hackers to gain access to Kitsoft's administrator panel and use the company's credentials to deface customer web sites.