Ukrainian hackers take credit for hacking Russian ISP that wiped out servers and caused internet outages

Russian internet provider Nodex said it was in the process of restoring its systems after a destructive cyberattack earlier this week that saw hackers compromise its network and wipe its internal servers, causing an immediate and complete collapse of internet connectivity to its Russian customers.

According to data from networking giant Cloudflare, which monitors internet trends and traffic, the Russian regional ISP’s outage began late on January 6 and continues to show customer internet traffic levels at 0%.

In a post on Russian social networking site VK, Nodex confirmed the cyberattack. “The network has been destroyed. We are raising it from backup copies,” the post read, according to a machine translation. The internet provider said it had no immediate timeline for its recovery.

The company later attributed the cyberattack to Ukrainian hackers, which it says caused a “complete failure” in its infrastructure, per the translation.

A hacking group called the Ukrainian Cyber Alliance took credit for the cyberattack, posting screenshots from key servers inside of Nodex’s network.

“The Russian internet provider Nodex in St. Petersburg was completely looted and wiped. Data exfiltrated, while the empty equipment without backups was left to them,” according to the group’s post on Telegram. The screenshots show access to Nodex’s internal network, including one of its systems for its virtual machines, its backups, and other critical systems.

According to The Record, which first reported on the breach, the Ukrainian Cyber Alliance is a group of pro-Ukrainian activists formed in 2016 and has targeted Russian entities following its full-scale invasion of Ukraine in 2022.

As of Wednesday evening in St. Petersburg, Russia, where Nodex provides its internet service, the company said its restoration work “continues.”