Ukraine Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Ukraine
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Ukraine's cyber threat posture and 2026 incidents, checked 7 Nov 2026. Ukraine publishes no national cyber alert level; CERT-UA signals threats through dated alerts that name tracked clusters such as UAC-0001 (APT28).
Source: CERT-UA
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
| Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Government email addresses sent one APT28 phishing lure exploiting CVE-2026-21509 | More than 60 | January 2026 | CERT-UA |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| APT28 (UAC-0001) | State-aligned | CERT-UA reported Office exploit attacks in January 2026; prosecutors were targeted in April 2026. | CERT-UA · The Record | |
| UAC-0244 | Unattributed | Targeted hospitals and local authorities in March and April 2026, per CERT-UA. | CERT-UA | |
| IT Army of Russia | Hacktivist | Claimed the Ukrposhta breach in June 2026. | The Record |
Laws and rules this year
- 17 Jun 2026Ukraine admitted to the EU Cybersecurity Reserve. EU member states approved Ukraine's access to the ENISA-managed pool of incident responders for large-scale cyberattacks. Source
Full stories
Official statements
- 15 Sep 2026President Zelensky appointed Ihor Klymenko to head the National Cybersecurity Coordination Center. The Record
- 15 Apr 2026CERT-UA reported a surge of attacks on hospitals and local authorities. CERT-UA
- 3 Apr 2026CERT-UA said Russian hackers were revisiting past breaches where root causes were not fixed. The Record
- 1 Feb 2026CERT-UA warned that APT28 was exploiting Office flaw CVE-2026-21509 against Ukraine and EU states. CERT-UA
Incidents
7 of 7 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedThe Kyiv Independent | 4 Nov 2026 | Media | Intrusion | None | Confirmed. Editor-in-chief Olga Rudenko confirmed attackers took over the website management and newsletter systems to send fake messages; the outlet suspects Russia. | The Record✓ 7 Nov |
| ✅ ConfirmedAir Alert app | 1 Nov 2026 | Other | Intrusion | Confirmed. The app's developers said unauthorised individuals interfered with it, and Ukraine's Air Force said it was likely compromised by the enemy after fake nuclear and chemical alerts went out. Claimed. A group calling itself Hitcore Corp claimed responsibility. | The Record✓ 7 Nov | |
 ✅ ConfirmedATB | 5 Oct 2026 | Retail | Intrusion | Confirmed. ATB, Ukraine's largest grocery chain, confirmed a cyberattack and denied that customer data was compromised. Claimed. DataSuckers claimed data on 7.9 million customers and demanded 400,000 dollars. | The Record✓ 7 Nov | |
 ✅ ConfirmedUkrposhta | 25 Jun 2026 | Other | Intrusion | Confirmed. Ukrposhta said an enemy cyberattack on its IT systems temporarily disrupted its mobile app. Claimed. IT Army of Russia claimed on Telegram that it had exfiltrated a user database weeks earlier. | The Record✓ 7 Nov | |
| ✅ ConfirmedProsecutors and anti-corruption bodies (SAP, ARMA) | 17 Apr 2026 | Government | Intrusion | Confirmed. SSSCIP official Taras Dzyuba confirmed attacks on prosecutors' email accounts, and ARMA's acting head said staff were targeted without access to internal systems. Claimed. Researchers attributed the campaign to APT28, and Dzyuba said all indications point to that group. | The Record✓ 7 Nov | |
| ✅ ConfirmedMunicipal hospitals and local authorities | 15 Apr 2026 | Health | Intrusion | Confirmed. CERT-UA reported intensified attacks on local government bodies and municipal hospitals, including emergency care hospitals, in March and April 2026. | CERT-UA✓ 7 Nov | |
 ✅ ConfirmedNational Bank of Ukraine online coin storeVia a vendor | 19 Feb 2026 | Finance | Supply chain | None | Confirmed. The National Bank of Ukraine said attackers breached a contractor supporting its numismatic store and may have accessed customer registration data, with no payment data affected. | The Record✓ 7 Nov |
FAQ
Does Ukraine have a national cyber threat level?
No published national cyber threat level was found for Ukraine's cyber threat posture and 2026 incidents (checked 7 Nov 2026). Ukraine publishes no national cyber alert level; CERT-UA signals threats through dated alerts that name tracked clusters such as UAC-0001 (APT28).
Which organisations in Ukraine confirmed cyber incidents recently?
7 incidents confirmed since January 2026: The Kyiv Independent, Air Alert app, ATB, Ukrposhta, Prosecutors and anti-corruption bodies (SAP, ARMA), Municipal hospitals and local authorities and National Bank of Ukraine online coin store.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.