
Cyberattacks in Ukraine 2025: How to Protect Business and Infrastructure Amid Growing Threats
In 2025, cybersecurity in Ukraine has ultimately become a matter of national scale not only for government agencies but also for businesses, citizens, and international partners. The number of cyberattacks and cyber operations in the country has doubled compared to 2022, and the spectrum of threats is rapidly expanding. What is the new reality of Ukraine’s cyberspace, who and how is trying to protect its borders, and do we have a real response strategy for future challenges?
Cyberwarfare has become an integral part of modern conflicts. According to Yevhen Bryksin, a representative of the State Service of Special Communications and Information Protection (SSSCIP), “cyberspace and cyber operations are used as an inseparable component of waging a full-scale war.” For several years now, Ukraine has been under constant pressure from attacks on government structures, critical infrastructure, businesses, and the media.
The growing activity of hacker groups is confirmed by both national and international experts. SSSCIP and CERT-UA register not only an increase in the number of attacks but also the emergence of new groups specifically targeting the Ukrainian cyberspace. The spectrum of threats includes cyberespionage, financial crimes, destructive activities, attacks on energy, transport, and communications.
The Number of Attacks Is Not Just a Figure
Data from 2024 and the first half of 2025 show an alarming trend. If in 2022, CERT-UA recorded about 2,000 incidents, by 2024-2025 this number had already exceeded 4,000. This is not just statistics every attack brings real risks to the economy, social stability, and even the physical safety of people.
The complexity of attacks has also increased: hackers use sophisticated social engineering schemes, combine phishing, ransomware, DDoS, and malicious software. According to experts, new attacks have become more targeted often aimed not only at “breaking in” but at destruction, manipulation, or disinformation.
Key Threat Vectors
Among the main cyberthreats to Ukraine are:
- Cyberespionage – attempts to steal confidential information from state registries, strategic enterprises, military structures.
- Financial crimes – attacks on banks, financial services, cryptocurrency exchanges, including fraud and extortion.
- Destructive operations – aimed at destroying infrastructure, blocking services, spreading malware.
Experts pay special attention to the increase in email attacks (phishing over 70%), data leaks (70%), account breaches (41%), and bot attacks on social networks (43%).
Why Business Remains Vulnerable
The rapid growth of attacks is accompanied by an alarming signal: most Ukrainian companies do not have a clear cyber incident response strategy. Industry research for 2024-2025 shows that 62% of businesses do not prepare crisis communication plans, and 41% do not conduct regular employee training.
This situation increases risks for the private sector: even if a company is not the direct target of an attack, it can become a “proxy” for an attack on a larger target or fall into a chain of incidents due to interconnectedness.
Ukraine on the Map of International Cooperation
International cooperation in cybersecurity is a critically important area. SSSCIP actively cooperates with EU countries, NATO, and major private partners (Microsoft, Google, Cisco) both for information sharing and for obtaining technological support.
“To successfully respond to cyber incidents, it is necessary to have high-quality data about cyberthreats,” Yevhen Bryksin emphasizes.
As a result of this work, a national system of cyberthreat attribution appeared and the ability to receive real-time information about new types of attacks was established.
Post List
Preparedness Drops Attacks Rise
In surveys among managers and IT professionals, more than half of respondents admit that the risk of cyberattacks in the coming year is very high. However, only a third of companies have a full crisis plan and established response teams. The rest act reactively, not proactively, which makes businesses especially vulnerable.
Real Working Recommendations
- Check your attack surface: regularly scan your infrastructure, use up-to-date analysis tools (Nmap, Shodan).
- Implement multi-factor authentication: minimize the risk of breaches via vulnerable passwords, especially for remote access and email services.
- Isolate critical systems: reduce the number of devices with direct internet access.
- Filter traffic: implement proxy servers, monitoring systems, and restrictions for suspicious connections.
- Expand log retention: store event logs for at least 180 days for rapid response.
- Conduct trainings: update your team’s knowledge of new threats and crisis scenarios at least once a year.
- Develop a response plan: appoint those responsible, describe response scenarios, provide backup communication channels.
Ukrainian cyberspace in 2025 is an arena of daily struggle, where attackers adapt, evolve, and look for new ways to break through. The dynamics of cyberattack growth are not abstract statistics, but a real threat to the economy, statehood, and society. The main challenge today is not only technological, but organizational: most organizations are still not ready to respond quickly and systematically.
At the same time, Ukraine is demonstrating resilience and rapidly increasing its cybersecurity potential, setting an example for many countries. However, without systemic changes in the preparation of businesses, the public sector, and citizens for digital threats, the price of being compromised may be too high. Every attack is a wake-up call that forces us to act proactively: invest in protection, educate people, build partnerships. And only in this way is it possible to maintain balance in this daily digital confrontation.














