Ukraine's state news agency, Ukrinform, confirmed on November 11 that it suffered a significant cyberattack. The incident involved unauthorized changes to the organization's primary digital platforms, including its main website and its profile on the social media network X. Technical teams are currently investigating the specific circumstances of the breach while working to restore normal operations across the affected resources.
The visual impact of the attack was immediate and noticeable to the public. The homepage of the Ukrinform website was replaced with the word ZELENET, an image of the Ukrainian flag with a cross through it, and a direct link to a Telegram channel. Simultaneously, the agency's X account was renamed to ZELENET, and a pro-Russian slogan was added to the account description. These alterations served as a clear signal of the disruption, though a technical maintenance notice appeared shortly after, apologizing for the temporary inconvenience and promising a swift return to service.
Serhii Cherevatyi, the Director General of Ukrinform, confirmed the details of the attack in a comment to Ukrainska Pravda. He stated that the agency is actively collaborating with the Security Service of Ukraine and the State Service of Special Communications and Information Protection to manage the aftermath. Cherevatyi noted that this event is not an isolated incident, pointing out that the agency has faced similar attacks in recent months.
In discussing the ongoing threat landscape, Cherevatyi highlighted recent upgrades to the agency's infrastructure. He mentioned that new equipment was installed during the 2024 to 2025 period with the assistance of US partners. However, he acknowledged that attackers are continuously refining their methods, now incorporating artificial intelligence systems into their strategies. In response, Ukrinform is striving to react as quickly as possible to mitigate these advanced threats.
Following the initial reports, Ukrinform issued an official statement on its Telegram channel. The statement emphasized that the agency maintains constant contact with the State Service of Special Communications and Information Protection. It also noted ongoing coordination with the Security Service's Department for Counterintelligence Protection of State Interests in the Information Security Sphere and other relevant bodies to reinforce its cyber defenses.
The agency's statement clarified that experts are currently focused on establishing the precise circumstances of the incident. Their work includes assessing the full consequences of the breach and restoring the normal operation of all agency resources. Ukrinform added that the adversary is utilizing new cyberattack methods and tools, which necessitates a continuous effort to strengthen the organization's defensive capabilities.
This incident occurs against a backdrop of heightened digital activity targeting Ukrainian media. Just days earlier, on the night of November 5 and 6, hackers compromised the account of Ukrainska Pravda on an email distribution service. The attackers sent a fake email to some readers in the name of the UP.Ranok project, claiming a terrorist attack had occurred in Kyiv. The editorial team clarified that they did not write or send the message and that the information contained within was false.
Readers of Ukrainska Pravda were urged not to follow the link in the fake email or share its contents. The series of attacks on both Ukrinform and Ukrainska Pravda underscores the persistent pressure on Ukraine's media sector. As these organizations continue to operate, they face the challenge of maintaining trust and accuracy while defending against increasingly sophisticated digital intrusions.
Ukrinform has indicated that it will provide further updates on the situation as the investigation progresses. The agency remains committed to transparency and is working to ensure that its digital platforms are secure and reliable for the public. The coordination with national security services aims to not only resolve the current incident but also to prepare for future challenges in the evolving cyber environment.
