- SkyNet, a St. Petersburg ISP, says a DDoS attack has disrupted its network since October 6. A Ukrainian hacking group claims much wider damage, which SkyNet has not confirmed.
- SkyNet blamed a mid-September outage on a technical failure. The Record says it is unclear whether that outage was linked to the group's claimed attack.
- Ask which services depend on one provider, whether contracts require a stated outage cause, and whether your logs can separate a traffic flood from intrusion.
When a service goes down, the first question is rarely "who did this?" It is "is this a fault or an attack?" The outage at SkyNet, an internet provider in St. Petersburg, Russia, shows how hard that is to judge from outside. The company and a hacking group tell different stories. Outsiders cannot yet tell which one is complete.
What has been reported
The Record reported that SkyNet put out a statement on Friday. It says a DDoS attack has hit its network since October 6. DDoS stands for distributed denial of service. Gaming, voice calls and video conferencing are affected.
SkyNet told customers to expect sluggish connections and choppy audio and video. It gave no date for a return to normal.
On Tuesday, the Russian outage monitor Detector404 still showed customer complaints. They included fiber-optic outages, Wi-Fi failures and high latency. SkyNet has operated since 2003. It sells internet access to homes and businesses, along with digital television, telephone and data center services.
A claim is not a finding
A Ukrainian hacking group, BO Team, says it attacked SkyNet on September 14 and October 5. It says it disabled more than 15,000 network devices. It also posted screenshots that purportedly show access to SkyNet's internal systems.
The group calls its campaign payback for Russian strikes on Ukrainian data centers.
SkyNet has not confirmed the claims about disabled equipment or unauthorized access. The two accounts also differ in kind. The company describes a DDoS attack. The group describes broken devices and system access. The report does not say how any devices were disabled.
How the technology works
A DDoS attack floods a network with more traffic than it can handle. Real customers then see slow connections and dropped sessions. Voice and video calls suffer quickly because they need steady, fast delivery. That fits the services SkyNet named.
A traffic flood and a break-in are different problems with different fixes. SkyNet has described a flood. The group describes disabled devices and system access, which is a different kind of incident. Until the company says more, outsiders cannot tell which account is complete.
The September outage may or may not be linked
SkyNet had a major outage in mid-September. It blamed a technical failure. Some customers had connectivity problems for several days.
BO Team claims it attacked SkyNet on September 14. The Record says it is unclear whether the outage was connected to that claimed attack.
The lesson here is plain. The cause SkyNet stated and the group's claim of an attack have not been reconciled in public. Customers and partners are left to weigh two accounts.
A group that does more than disrupt
BO Team, also called Black Owl, first appeared in early 2024. The Record lists Vega-Internet, Kraft-S, SimStar and Orion Telecom among the Russian telecom providers it says it has attacked. The Record also reports that it has worked with Ukrainian military intelligence on some past operations.
Kaspersky, a Russian security firm, says the group has moved beyond disruption. It now also carries out spying and quieter intrusions. Its researchers say the group usually gets in through targeted phishing emails with malicious attachments. It then uses backdoors and other malware to keep access.
Kaspersky also reports a growing focus on manufacturing, telecom, and oil and gas firms.
Questions to put to your team
First, which of our services depend on one network provider? What is the fallback if that provider is degraded for days, not hours?
Second, do our provider contracts require a stated cause and timeline for outages? Who decides whether an incident was a fault or an attack?
Third, do our own logs let us tell, afterward, whether an outage involved access to systems and not only traffic?
Fourth, how well do we filter phishing attachments? That is the entry route Kaspersky describes for this group.
An outage tells you something is wrong. It does not tell you what.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
