Ukrainian media organizations have been elevated to “one of the priority targets” for Russian-linked hackers, according to the Security Service of Ukraine (SBU), as the country’s broadcasters face simultaneous pressure from cyber operations and physical attacks on their infrastructure.

Two Previously Unreported Attacks Disclosed

Volodymyr Karastelyov, head of the SBU’s cyber department, revealed details of two incidents that had not been publicly reported before. In the first, Russian hackers launched a large-scale distributed denial-of-service (DDoS) attack against an unnamed nationwide television channel. The three-hour assault generated up to 200,000 requests per minute from a botnet of compromised devices. The attack was repelled before causing a disruption, Karastelyov said.

In the second incident, attackers targeted one of Ukraine’s leading television groups with the goal of seizing control of its platform to publish propaganda disguised as legitimate content. The operation combined a phishing campaign against the broadcaster’s internal systems with simultaneous attempts to gain access through connected third-party infrastructure. That attack was also contained.

Karastelyov did not attribute either incident to specific Russian threat actors or groups.

Broader Campaign Against Ukrainian Media

Since Russia’s full-scale invasion began four years ago, the SBU says it has neutralized more than 16,000 cyberattacks and cyber incidents targeting government agencies, financial institutions, defense organizations, and media outlets. Ukraine’s State Service of Special Communications and Information Protection (SSSCIP) reported last year that Russian hackers had carried out more than 200 successful cyberattacks against Ukrainian media organizations since the start of the conflict.

The documented tactics include:

  • Phishing campaigns targeting editorial and broadcast staff
  • DDoS attacks aimed at disrupting live broadcasts
  • Website defacements
  • Deployment of destructive malware
  • Unauthorized publication of disinformation on compromised media platforms

Physical Attacks Compound the Threat

The cyber campaign runs parallel to ongoing physical destruction of media infrastructure. The National Union of Journalists of Ukraine documented 80 incidents in the first half of this year alone in which Russian attacks damaged media infrastructure or put journalists at direct risk. Documented cases include destroyed editorial offices, damaged broadcasting equipment, and journalists coming under fire while reporting in the field.

The most recent incident occurred this week, when the office of Ukraine’s Channel 5 was struck for the second time during the war. A Monday strike damaged the television studio, destroyed filming equipment, and heavily damaged the newsroom, part of a broader overnight assault involving 68 missiles and nearly 400 drones launched at Ukraine.

The combination of persistent cyber operations and physical strikes signals a coordinated effort to degrade Ukraine’s independent information infrastructure, with implications for both national security and public communications resilience.