Unknown Virus Attacks Dozens Of Ukrainian Companies

An unknown computer virus similar to the WannaCry ransom-ware has attacked Ukrainian banks, postal services and dozen of other private companies. The National Bank of Ukraine calls this "the biggest" hacker attack. According to Hromadske’s information, the hacker attack hit the national postal service ‘Ukrposhta’, the state-owned bank ‘Oschadbank’.

Hromadske's following the events:

18:27 Kyiv (EET) The Kyiv Prosecutor’s Office has shut down its servers, according to the department’s spokeswoman, Nadia Maksymets.

18:05 Kyiv (EET) The spokeswoman for the Ukrainian Security Services told Hromadske that, her statement that the Russian Federation could have been behind the cyberattack was “personal opinion, presented as the Security Services’ position”. However, the Security Services currently have no assumptions as to who the organisers of the cyberattack might be.

17:49 Kyiv (EET) The National Bank of Ukraine says that, despite the attack, the electronic payment system which banks use and the internal computer network of the National Bank of Ukraine are working as normal.

17:59 Kyiv (EET) The Ukrainian Minister of Infrastructure, Volodymyr Omelyan states that, despite the hacker attack, the Ukrainian transport system is still operating. He confirmed that, as of 17:00, the virus infected the Ministry of Infrastructure systems, ‘Ukrtelekom’, ‘Ukrposhta’, Ukrainian Railways, Boryspil airport, ‘Nova Poshta’ and other banking institutions.

“It is with good reason that we constantly emphasise that the issue of cybersecurity in digital infrastructure should be given the utmost importance. Cooperation with American experts in counter hacking, especially by Russians, was discussed during a visit to Washington last week. It’s no accident that the word ‘virus’ ends in RUS,” Omelyan wrote.

17:33 Kyiv (EET) Secretary of the National Security and Defense Council of Ukraine, Oleksandr Turchynov stated that cyber security specialists are currently working under rapid response. At the same time, he emphasised the fact that all state institutions that followed the recommendations of the National Cybersecurity Coordination Centre included in the protected circuit (a secure internet-access group) were not damaged.

17:25 Kyiv (EET) The virus has attacked the supermarket chain ‘Rost’ in Kharkiv, Ukraine.

Photo: Telegram

17:25 Kyiv (EET) The virus has not hit servers at the Ukrainian Cabinet of Ministers at the moment, however, some personal computers have been attacked, according to a statement on the “Government portal”.

“The cyberattacks are caused by the Petya virus which exploits weaknesses in the operating systems that are fixed on servers and personal computers. Right now personnel at the State Special Communications services of Ukraine and other relevant bodies are working on neutralising the attack. They currently recommend that network users turn off their computers. There will soon be further instruction,” the government notes.

17:17 Kyiv (EET) The widescale cyberattack does not pose any real threat to Ukrainian energy systems, according to the head of the national energy company ‘Ukrenergo’, Vsevolod Kovalchuk.

“The virus does not pose any real threat to Ukrainian energy systems, the competence of our controllers and engineers allows us to manage the United Energy Systems of Ukraine, and in the absence of part of the software systems that function with the Windows operating system. I hope that the problem will soon be resolved,” he states.

17:11 Kyiv (EET) The information systems for the Presidential Administration of Ukraine is functioning as normal, says the deputy head of the Presidential Administration, Dmytro Shymkiv.

16:51 Kyiv (EET) The official web-portal for the Kyiv City State Administration is down. As the Administration reported, the server has been turned off. The site will resume operation when the threat of the cyberattack is over.

16:43 Kyiv (EET) The Ukrainian Ministry of Internal Affairs’ website is down due to the cyberattack.

16:38 Kyiv (EET) Spokesman for the Ukrainian police, Yaroslav Trakalo, says that the cyber police department of the National Police of Ukraine has already received 22 reports of interference with personal computers.

16:34 Kyiv (EET) The Prosecutor General’s Office of Ukraine announced that cyberattack could have been organised from Russia or the self-proclaimed republics. The spokeswoman for the Prosecutor General’s Office, Olena Hitlyanska, told ‘Tyzhden.ua’ that the main target of the attack was the Ukrainian banking system.

16:30 Kyiv (EET) The cyberattack affects the Crimean Tatar television channel ATR, reports journalist Ayder Muzhdabaev.

16:28 Kyiv (EET) The virus hits Chornobyl Nuclear Power Plant. Its press-service told Hromadske that the servers are currently down.

16:00 Kyiv (EET) All the navigation systems work as normal. The state enterprise “Ukraerorukh” tells ‘Interfax” that the cyberattack hasn’t hit the air navigation system, only the internal working systems have been turned off. They do not affect the flight support system. They also state that, as of 16:00 Kyiv (EET), airports in the capital of Ukraine (“Boryspil” and “Zhuliany”) and railway company “Ukrainian Railways” are working as usual.

16:06 Kyiv (EET) Radio Era-FM is also hit by the cyberattack. As one employee of the radio station told Hromadske, all Windows computers have stopped working. The servers on Linux are working, as well as the broadcast.

15:59 Kyiv (EET) The cyber attack hits the pharmaceutical company ‘Arterium’. “Our company has been affected by a cyberattck. All the computers have ‘gone,’” the company told UNIAN.

15:57 Kyiv (EET) The head of Cyber Police Serhiy Demediuk told Hromadske that the specialists are working in the places affected by the attacks.

15:46 Kyiv (EET) Ukrainian state-owned bank “Oschadbank” reports that, because of attack, the services it provides for its customers will be limited. However, its mobile banking service and card services are functioning as normal.

15:33 Kyiv (EET) Boryspil airport in Kyiv informs people about possible flight delays. The information board is not working.

15:32 Kyiv (EET) The hacker attack also hits Chornomorska TV and radio company.

15:32 Kyiv (EET) ‘Privatbank’ was not affected by the hacker attack. They have reported that all systems are now operating.

UPD: On June 27, the director of the regional Privatbank press centres Inna Muzychuk wrote on her Facebook page that "Privatbank wasn't under hacker attack."

"Privatbank, its electronic complexes and the most popular online bank in Ukraine Privat24 haven't documented any hacker attacks or attempts to interfere their work..." she quoted from the official press-release.

She also added that the bank's clients could have some difficulties with online payments and using their credit cards as the virus hit some telecom companies and other banks.

15:27 Kyiv (EET)  The Vice Prime Minister of Ukraine, Pavlo Rozenko, announced the attack at the Ukrainian Cabinet of Ministers.

Та-дам! Секретаріат КМУ по ходу теж "обвалили". Мережа лежить. pic.twitter.com/B74jMsT0qs

15:22 Kyiv (EET) The virus has attacked the biggest mobile network operators in Ukraine ‘Kyivstar’ and ‘Lifecell’

15:15 Kyiv (EET) The attack has affected the Kyiv metro. Bank card payments are not working, but contactless card payments still work.

15:10 Kyiv (EET) The attack has affected ‘Ukrainian Media Holding’.  Ukrainian media’s ‘Komsomolskaya Pravda’ website is down.

15:09 Kyiv (EET) A national chain of stores in Ukraine that specializes in home improvement and gardening, ‘Epicentre’, has ceased operation due to a system breakdown.

15:02 Kyiv (EET) “Ukrtelecom”,  Ukraine's private telephone company, which provides Internet services and mobile markets, states that, despite the attack, it still provides internet services.

 “However, computer systems, which we provide to call-centres and service centres are unfortunately not working,” the company’s representative, Mykhailo Shuranov, wrote.

15:00 Kyiv (EET) Russian state gas company ‘Rosneft’ also reported a major hacker attack on its servers. It is yet unknown if it’s the same virus.

14:57 Kyiv (EET) Ukrainian TV channel “Inter” and the magazine “Korrespondent” claimed to have experienced hacker attacks. The bank “Kredobank’s” system is also not working.

14: 36 Kyiv (EET) An employee at the “Privatbank” call centre told Hromadske that all money transactions are working as normal. Office computers are also working.

14:30 Kyiv (EET) According to Hromadske’s information, the virus attacked the ‘Ukrainian Railways’ website.

14:26 Kyiv (EET) The CEO of ‘Ukrposhta’, Igor Smilyanskiy, told Hromadske that they are cooperating with the Security Service of Ukraine to minimize the consequences of the attack.

13:45 Kyiv (EET) The hacker attack also affected a company which supplies energy to Kyiv ‘Kyivenergo’. According to Interfax, the national energy company ‘Ukrenergo’ also “experienced difficulties”.

“We experienced a hacker attack. Two hours ago we had to turn off all the computers. Now we’re waiting for a permission from the security providers to turn them on.”

‘Kyivenergo’ provides energy for practically all energy facilities in the capital, with the exception of a power plant in Darnytsia district.

The cyberattack also affected non-governmental organisations. In particular, the virus attacked the company ‘Nova Poshta’, some media websites are not working.

On May 12, ransomware attacked tens of thousands of computers in different countries. The virus blocked computers with a banner requiring bitcoin payments to restore the system ($300 or 0.12 bitcoins - correct as of 27.06). If users failed to do this, WannaCry threatened to delete all files from the computer over the course of the day. Russia, Ukraine and Taiwan were among the countries worst affected.

/by Liuda Kornievych, Sofia Fedeczko