Cyber specialists and investigators of the Security Service of Ukraine have identified hackers from Russian Military Intelligence who attacked one of the Ukrainian national mobile operators Kyivstar, and are gathering evidence against them.

As reported on the website of the Security Service of Ukraine on Thursday, after all examinations and serving charges, the materials of this investigation will be transferred to the International Criminal Court in The Hague.

Currently, the Ukrainian Security Service has established that Kyivstar was attacked by the hacker group SandWorm, which is a regular unit of the Russian Military Intelligence. The Ukrainian Security Service is now conducting a series of examinations and has sent requests for additional information from international partners.

"Not only the specific hacker but at least the commander of the military unit and the leadership of the intelligence service performing destructive activities should be held accountable," said Illia Vityuk, head of the cybersecurity department of the Security Service of Ukraine.

He emphasized that there are only three cases in the world where charges have been served against hackers for cyberattacks on infrastructure. One of them is the successful case of the Security Service of Ukraine.

Vityuk also said that during the full-scale war, the Security Service of Ukraine annually repels about 4,500 cyberattacks.

As reported, hit by biggest cyberattack early in the morning of December 12, 2023, Kyivstar began to restore voice services on the evening of December 13. A day later, mobile internet from the company resumed in certain regions of the country, and the company reported its full restoration on December 15. The company notified about the restoration of the main services, including SMS and mobile internet in roaming, on December 20.

The president of the company, Oleksandr Komarov, reported that the hacker attack led to the destruction of about 40% of the operator's infrastructure, which caused a large-scale failure in operation. "They had two goals. One fundamental – to destroy as much infrastructure as possible and to sow chaos. The destruction of the infrastructure turned out to be about 40%: the virtual network layer was very heavily damaged," he said.

Later, the Security Service of Ukraine reported that the hacker group SandWorm was behind the attack, which is a regular unit of the Russian Military Intelligence.