Cyberattack paralyses communications in Ukraine. Day 659 of the war

On 13–15 December, the Russians drove the defenders from their last positions in Marinka. The fall of the town and the defending troops’ withdrawal from its ruins (the town has been completely destroyed during the fighting) were confirmed by local Ukrainian sources. However these reports were denied by the commander of the Ukrainian operational-strategic grouping of the Taurida army, General Oleksandr Tarnavsky, who called them an attempt at disinformation provocation. He stated that the enemy had not occupied the entire town and that its defence was continuing. The loss of the town, however, was indirectly confirmed by the Ukrainian General Staff, although they stopped short of identifying it as the site of clashes on 14 December. According to them, fighting in the Marinka area is now taking place to the south and north of the town. Ukrainian forces, probably small in number, still remain on its north-western outskirts within its administrative borders, but they are already outside the remnants of the built-up area.

The invaders expanded the area they control north of Avdiivka, consolidating on the western side of the railway line near the village of Stepove, as well as south of Siversk and north-west of Bakhmut. In the other directions, the defenders have either managed to retain their existing positions, or the advances made by the invaders have been negligible. On 13 December, further records were set for the number of Russian assaults per day. According to the Ukrainian General Staff, a total of 57 were repulsed by the Ukrainians north and south of Avdiivka, and 120 on the entire front. The Kharkiv Oblast Military Administration reported that a circular defence line was under construction around Kupyansk and the Kupyansk-Vuzlovyi railway junction lying south of it. This means that Ukrainian forces are reckoning not only with the need to fall back to a defence line based on the towns east of Synkivka (the main fighting is still taking place around that town), but also with a potential attack by the enemy from the west (once they have crossed the River Oskil or struck from the Russian border).

On 14 December, the Russians launched what is believed to have been the first attack in several weeks using at least three Kh-47M Kinzhal hypersonic missiles. At least two of them struck the area of the Starokostiantyniv airfield in Khmelnytskyi oblast, and some sources also reported an explosion near the Zhuliany airfield in Kyiv (where a Patriot air defence system battery is deployed). The Air Force Command said it did not intend to comment on where the missiles hit, and its spokesman Colonel Yurii Ihnat announced that one missile had been neutralised by the capital’s air defences. On the night of 13 December, Kyiv was targeted by ballistic missiles. According to the Air Force Command’s message, the invaders allegedly fired 10 missiles, all of which were shot down. Official reports say civilian infrastructure was damaged as a result of falling shrapnel and 53 people were injured. Later in the evening of that day, six Russian missiles from S-300 systems hit Kherson and Mykolaiv oblasts.

On the evening of 12 December, kamikaze drones struck in the Odesa oblast, damaging a repair company among other facilities. Two people were injured, of whom one later died in hospital. The Air Force Command reported that all nine Shahed-136/131 drones had been shot down (a tenth was also destroyed over Khmelnytskyi oblast). Another attack on Odesa oblast occurred 24 hours later, with targets including the port infrastructure near Izmail. Storage facilities and 11 buildings were damaged and 11 people were injured. Ukrainian air defences neutralised 41 of the 42 Shaheds used by the invaders. On 13 December, even before another drone attack on Odesa oblast, the Seaport Administration of Ukraine stated that in the attacks carried out since 18 July, the Russians had hit 105 facilities of the port infrastructure (including 10 grain elevators) and six civilian buildings. Three people were killed and 12 wounded. On the night of 15 December, Ukraine was attacked by 14 Shaheds, and explosions caused by the strikes were reported from Khmelnytskyi oblast (all the enemy drones were shot down).

According to Russian sources, on the morning of 14 December nine Ukrainian drones were destroyed over the Moscow (including one approaching the capital) and Kaluga oblasts. Late in the evening of that day, three Ukrainian missiles were reported to have hit Mariupol (the occupation forces’ facilities at a concrete plant and a commercial complex were hit). According to some reports, the Ukrainians used Storm Shadow cruise missiles.

On 12 December, during a meeting in Washington with Volodymyr Zelensky, Joe Biden announced the release of a new military support package for Ukraine (the second this month). It is worth $200 million, and will include AIM-9M missiles for ground-based air defence systems, ammunition for HIMARS launchers (including GMLRS guided missiles), 155-mm and 105-mm artillery shells, HARM anti-radiation missiles, TOW & Javelin anti-tank guided missiles and AT-4 anti-tank grenade launchers, more than 4 million small arms cartridges, and demolitions munitions for obstacle clearing. A day later, the Norwegian government announced the transfer of additional NASAMS air defence systems to Kyiv. The package, worth 335 million kroner ($24.4 million), includes systems from the Norwegian army’s stockpile that can be quickly shipped to Ukraine, as well as new systems ordered from the manufacturer that will be delivered at a later date.

On 14 December, during Zelensky’s visit to Germany, the government in Berlin announced another military support package to Kyiv. This will include the second battery of the Patriot air defence system promised by Germany in the summer, along with missiles, nine Bandvagn 206 articulated tracked transporters, 7390 155-mm artillery shells and more than 47,000 rounds for 40-mm automatic grenade launchers, eight Zetros trucks and four HX81 tractor trailers, 14 drone detection systems and three sapper drones. On the same day, a new military support package worth €80 million was announced by Estonia’s defence minister Hanno Pevkur. It includes a “large number” of Javelin anti-tank missiles, machine guns and small-arms ammunition, boats and ground transport. In turn, the US Congress approved its defence spending plans for the financial year 2024–5 (up to September 2025). Of a total of $886 billion, $300 million is to be allocated for Pentagon military assistance to Ukraine. On the same day, the Argentine industry website Pucara reported that Buenos Aires may hand over two Mi-171E search and rescue helicopters to Kyiv as part of the settlement of Argentina’s purchase of F-16 fighter jets from the US (a suggestion that was said to have come from Washington). During a security forum in Riga, the secretary of state at the Latvian defence ministry Jānis Garisons estimated Russia’s capacity to produce and overhaul tanks at 100–150 per month. In doing so, he stressed that this was far more than Europe could do.

During his annual press conference on 14 December, Vladimir Putin answered questions on mobilisation. Of the 300,000 personnel mobilised in autumn 2022, 244,000 are currently in the zone of the so-called ‘special military operation’, and 41,000 have been released from service, including for health reasons. Indirectly, this means that 15,000 mobilised have been killed, gone missing or been taken captive. The recruitment plan for contract service has allegedly been exceeded: by the end of 2023 412,000 soldiers were to have been recruited, but it is claimed that 486,000 have already signed contracts. According to Putin, an average of 1500 men enter service each day, which he said made it unnecessary to carry out a second wave of mobilisation. Putin stated that a total of 617,000 people are taking part in the so-called special military operation, with Putin considering not only the frontline in Ukraine, but also the hitherto uncrossed border line, which totals more than 2000 kilometres, as the line of contact & the combat operation zone. A few weeks earlier, Ukrainian military intelligence (HUR) reported that there were more than 400,000 Russian military personnel on the occupied territories of Ukraine (including Crimea), while US intelligence estimated the number involved in combat operations at 200,000.

On 12 December, the largest hacking attack since February 2022 occurred, blocking the services of the Ukrainian mobile operator Kyivstar. More than 25 million subscribers temporarily lost access to telecommunications services. The attack partially paralysed communications with businesses and government institutions, and also hampered the operation of other mobile operators, who were unprepared for the significant increase in traffic as users tried to switch to networks which were operational. Banking services were partially unavailable, with 5% of ATMs not working, and the air attack warning system was unavailable in some cities. The Security Service of Ukraine reported that Russian special services may have been behind the attack. On 13 December, Russian hackers linked to the Solntsepek group and working with local military intelligence services took responsibility for the damage to the communications infrastructure. On 15 December, Kyivstar restored some services, but the system has still not completely recovered from the attack.

On 12 December, HUR revealed that it itself had carried out a successful cyberattack on the IT resources of the Federal Tax Service of the Russian Federation. After hacking into one of the well-protected key central servers, data from more than 2300 regional offices of the service was accessed. The entire database was destroyed, along with its backups. The attack occurred on 8 December, and the work of the institution is expected to be paralysed for at least a month.

Also on 12 December, Ukraine’s defence minister Rustem Umierov stated that the resignation of Commander-in-Chief of the Armed Forces Valerii Zaluzhnyi and Commander of the Combined Armed Forces Serhiy Nayev was not currently under consideration. On the same day, Umierov and Zaluzhnyi conducted a joint inspection of troops on the eastern section of the frontline. Together with the ground forces commander Oleksandr Syrsky, they discussed issues of material replenishment, expansion of fortifications, and how to train recruits.

On 14 December Commander Nayev confirmed that two defence lines are being constructed in Chernihiv oblast. The work, including the erection of anti-tank barrages, is being carried out by a civilian company under the supervision of military engineers. The general announced that Russian sabotage and reconnaissance groups had entered the territories of Chernihiv, Sumy and Kharkiv oblasts seven times in the past two weeks. In five cases, Ukrainian forces were able to successfully repel the attacks; in the other two, the enemy withdrew as a result of artillery fire.

On 14 December at night, a Russian Shahed used to attack the port infrastructure in Odesa oblast went down in an uninhabited area in Romania. The remains of the unmanned aircraft were found about 4 km north-west of the Danube village of Grindu (about 300 km from Odesa as the crow flies). In a communiqué issued by the Romanian Ministry of Foreign Affairs, the incident was considered as another violation of airspace which violates international law. It also reported that consultations with Romania’s NATO allies were taking place.

Commentary

• The seizure of Marinka improves the tactical situation for the Russians in Donetsk oblast, as the town flanks the occupied regional capital, which borders it from the west. A similar role north of Donetsk is played by Avdiivka, as its capture also allows the invaders to move into the so-called operational space. To the west of the regional capital, this could only happen if the invaders seize Kurakhove, around 10 kilometres away from Marinka. However, the fall of Marinka is of great symbolic significance; fighting for it had been taking place intermittently since 2014, and in June 2015 it was the site of one of the major battles of the first period of the Russian invasion, in which the defenders came out victorious. Short-lived clashes and exchanges of fire on the eastern outskirts of the town took place over the following years. The finale of the fight for it revealed the differences between the local units and the Ukrainian army command in their approach to reporting on the situation at the front; this stemmed primarily from the fatigue of the defenders, as they had to put up prolonged resistance without due rotation.
• The successful hacking attack on Ukraine’s largest telecoms operator demonstrates the importance of maintaining cyber defence capabilities in wartime. It also highlighted that the weakest link in cyber defence is the human being. The Russians did not break through the digital firewalls, but by all indications took advantage of a mistake by one person who was not careful in his online communications. This led to a paralysis of telecommunications on a gigantic scale that affected not only ordinary citizens but also security institutions (among other things, warnings about air strikes were disabled). The actual losses suffered by the operator attacked are hard to assess, but they are certainly severe, as evidenced by the fact that the network was not restored to full functionality even some days after the attack. It is noteworthy that both sides of the conflict are engaged in an intense cyber-war, aimed not only at stealing data and blocking websites but also at destroying digital assets. An earlier attack by Ukrainian hackers on the Russian tax service appears to have resulted not only in the acquisition and deletion of data, but it also prevented taxpayers from submitting documents electronically.