Internet disruptions registered as Russia moves in on Ukraine

Network data from NetBlocks confirm a series of significant disruptions to internet service in Ukraine from Thursday 24 February 2022. Disruptions have subsequently been tracked across much of Ukraine including capital city Kyiv as Russia’s military operation progresses.

On the morning of Thursday 24 February 2022, internet disruptions were registered in Kharkiv, Ukraine’s second largest city:

Metrics show a loss of connectivity on the Triolan network, corroborating user reports of loss of fixed-line service. The disruption began amid reports of huge explosions in the region as Russia announced a military mobilization, and intensified over the course of the day.

Also on the morning of 24 February, hours prior to the commencement of Ukraine’s invasion of Russia, the Viasat satellite internet network which serves Ukraine and much of Europe was knocked offline in a targeted cyberattack:

Later in the day, a significant internet disruption was registered in the strategic port city of Mariupol, Donetsk. The incident came amid reports of civilian casualties and the loss of telecoms services for many subscribers:

 

In Kyiv, connectivity started to decline gradually from Thursday morning as civilians fled the capital or sought shelter:

On Saturday morning as the conflict reached Kyiv, a major disruption was registered to backbone internet provider GigaTrans, which supplies connectivity to several other networks.

While connectivity remained available through other routes and the disruption was brief, the incident is understood to have had significant impact to telecommunications infrastructure:

From Monday 28 February, fixed-line internet connectivity and some mobile service has collapsed in Sievierodonetsk, the acting administrative centre of Luhansk Oblast, leaving friends and family cut off. The city has been under intense artillery fire per reports:

NetBlocks metrics shoed progressing disconnections on network operator Kyivstar by 2 March. The operator reports over 500 base stations have been knocked out due to power outages and damage to infrastructure in conflict zones:

By the end of February, the besieged port city of Mariupol was knocked largely offline, amid disconnections attributed to power cuts and a humanitarian crisis caused by heavy combat:

On Thursday evening, 3 March, a major blackout was registered across Sumy Oblast, north-eastern Ukraine, as residents reported massive blasts at the thermal power plant and electrical substation that turned the sky ‘yellow and red’ for miles.

The incident marks the largest single region-wide disruption to telecoms service since the onset of the conflict, and is attributed to the destruction of the region’s electricity production and transmission infrastructure:

From 4 March 2022 NetBlocks tracked a loss of connectivity at the Zaporizhzhia nuclear power plant in southeast Ukraine, affecting fixed-lines and mobile services. The loss of communications was subsequently raised as a point of concern by the International Atomic Energy Agency:

On the morning of 9 March, metrics corroborated reports of a power blackout at the mothballed Chernobyl nuclear power plant, which continues to host spent nuclear fuel that requires cooling and monitoring:

On 9 March 2022, internet provider Triolan was targeted by a cyberattack for a second time, with the first instance having been observed on the morning of 24 February when invasion began. Both events have caused significant losses to connectivity at nation scale:

On the night of Thursday 10 March, an attack on the Kharkiv Institute of Physics and Technology, which hosts an ADS neutron source facility, was labelled an “act of nuclear terrorism” by the State Nuclear Regulatory Inspectorate of Ukraine. The incident following attacks at Zaporizhzhia and Chernobyl has heightened concerns that Russia might be intentionally targeting nuclear sites:

On Sunday 13 March, a major internet disruption was registered on the Vinasterisk network which serves Vinnytsia Oblast, western Ukraine. A staff member at the operator reported a massive cyberattack with elements of sabotage and theft via social media, promising more details soon:

 

On the morning of Wednesday 16 March, Internet provider Uacity was knocked offline before making a partial recovery. The incident followed Russian shelling targeting the urban district of Shevchenkivskyi, Kyiv, just hundreds of meters from the provider’s listed headquarters:

Financial problems have also presented challenges for network operators. On Tuesday 15 March, internet provider LocalNet announced that it would have to “lock down subscribers with debt on their account” due to difficulty paying the company’s own bills. The next day, Wednesday, connectivity collapsed and users who had missed a bill payment reported losing access to the internet:

On Monday 28 March, Ukraine’s national provider Ukrtelecom experienced an extended, nation-scale network disruption, following a major cyberattack. The extent of the incident has progressed over the course of the day, causing an increasing number of subscribers to fall offline, with over a thousand user complaints on the provider’s official Facebook page. On Monday night, the operator said it had mitigated the attack and a restoration of service was observed some 15 hours after the initial disruption.

On 1 April, leading provider Kyivstar announced that it had disconnected subscribers with outstanding bills, citing het need to repair damaged network infrastructure and pay taxes.

The incident follows similar measures by LocalNet. The company said that it had spared active combat zones and occupied territories from disconnection. Telemetry indicate that service was cut off and partially restored after some hours:

Work is ongoing to assess the incidents and their contexts. Telecoms disruptions in Ukraine have so far been attributed to power outages, cyberattacks, sabotage, and kinetic impacts.

What’s happening in Ukraine?

Russian leader Vladimir Putin announced military mobilization on the morning of Thursday 24 February 2022 and artillery was fired while as moved into Kharkiv about 25 miles from the Russian border. The security situation deteriorated through subsequent days with Ukrainian authorities advising civilians to get off the streets and seek shelter.

Beside the disruptions to telecommunications infrastructure documented in this report, cyber-attacks have disrupted Ukraine’s defence and banking sectors.

Further reading:

Previously:


Methodology

NetBlocks diffscans, which map the IP address space of a country in real time, show internet connectivity levels and corresponding outages. Purposeful internet outages may have a distinct network pattern used by NetBlocks to determine and attribute the root cause of an outage, a process known as attribution which follows detection and classification stages.


NetBlocks is an internet monitor working at the intersection of digital rights, cyber-security and internet governance. Independent and non-partisan, NetBlocks strives to deliver a fair and inclusive digital future for all.

[ press | contact ] Graphics and visualizations are provided for fair use in unaltered form reflecting the meaning and intent in which they were published, with clear credit and source attribution to NetBlocks. Intellectual property rights are protected including but not limited to key findings, facts and figures, trademarks, copyrights, and original reporting, are held by NetBlocks. Citation and source attribution are required at the point of use.

Internet disruptions registered as Russia moves in on Ukraine