CERT-UA

CERT-UA
Name	Computer Emergency Response Team of Ukraine
Native name	Команда реагування на комп'ютерні надзвичайні події України
Formation	2006
Headquarters	Kyiv
Region served	Ukraine
Leader title	Head
Parent organization	State Service of Special Communications and Information Protection of Ukraine

CERT-UA

CERT-UA is the national computer emergency response team serving Ukraine, established to coordinate cybersecurity incident response, vulnerability disclosure, and resilience across public and private sectors. It operates within Ukraine's national security and critical infrastructure frameworks and participates in international cyber incident information sharing and capacity building. CERT-UA engages with a wide range of actors including national agencies, telecommunications operators, financial institutions, energy companies, and international partners to reduce cyber risk and respond to threats.

History

CERT-UA traces roots to early 2000s efforts by Ukrainian technical communities and academic centers to address cyber incidents following regional incidents affecting Eastern Europe. Formalization occurred in 2006 under the auspices of the State Service of Special Communications and Information Protection of Ukraine amid rising concerns after cyber campaigns targeting energy infrastructure and telecommunications in the region. During the 2010s CERT-UA expanded capabilities in parallel with events such as the 2014 Ukrainian revolution and the Annexation of Crimea by the Russian Federation, when cyber operations increasingly targeted Ukrainian government institutions, media outlets, and critical infrastructure. The team's operational tempo and public profile rose sharply during the 2022 Russian invasion of Ukraine, as CERT-UA published advisories, coordinated incident response for attacks attributed to state-aligned actors, and worked with partners like NATO, European Union Agency for Cybersecurity, Microsoft, and Google on mitigations and attribution support.

Organization and Governance

CERT-UA is embedded within the State Service of Special Communications and Information Protection of Ukraine, with governance structures that align with national security and civil protection authorities. Its internal organization typically includes incident response, vulnerability handling, threat intelligence, forensic analysis, and outreach units that liaise with sectors such as energy sector organizations, financial institutions, and telecommunications operators. Leadership coordinates with the Cabinet of Ministers of Ukraine, the Security Service of Ukraine, and civil administration bodies to ensure policy integration and legal compliance. CERT-UA participates in interagency centers alongside entities like the Ministry of Digital Transformation of Ukraine and the Ministry of Defence of Ukraine for strategic planning and crisis response.

Roles and Responsibilities

CERT-UA’s principal responsibilities include detection and coordination of response to cybersecurity incidents affecting Ukrainian networks, issuing threat advisories, coordinating vulnerability disclosures, and conducting post-incident analysis. The team provides technical assistance to organizations such as Naftogaz, Ukrenergo, and major banking institutions during cyberattacks, offers indicators of compromise to vendors like Cisco, IBM, and Kaspersky, and publishes guidance aligned with standards from bodies such as ISO/IEC and NIST. CERT-UA also engages in capacity building through training with universities like Taras Shevchenko National University of Kyiv and research centers including the Verkhovna Rada-linked cybersecurity think tanks to raise resilience across public administrations and private sector entities.

Major Incidents and Advisories

CERT-UA has issued advisories and coordinated responses for high-profile incidents including destructive malware campaigns that affected Ukrainian entities and international partners, intrusion campaigns targeting energy companies, and supply-chain compromises affecting software providers. Notable episodes where CERT-UA played a central role include responses related to malware families and operations reported alongside analyses from ESET, Symantec, CrowdStrike, and FireEye. During major kinetic confrontations such as episodes linked to the Donbas conflict and the 2022 Russian invasion of Ukraine, CERT-UA released advisories on widespread phishing campaigns, distributed denial-of-service attacks, and data-wiping malware, collaborating with vendors including Microsoft Defender teams and cloud providers like Amazon Web Services to mitigate impact.

Collaboration and Partnerships

CERT-UA maintains partnerships with international and domestic actors to share threat intelligence, coordinate incident response, and develop joint exercises. International collaborations include bilateral and multilateral exchanges with US Cyber Command affiliates, NATO Cooperative Cyber Defence Centre of Excellence, Europol, and national CSIRTs such as CERT-EU, US-CERT, JPCERT/CC, and CERT-UK. Private-sector engagement spans major technology companies like Microsoft, Google, Cisco, Cloudflare, and cybersecurity vendors including Kaspersky, ESET, CrowdStrike, and Palo Alto Networks. CERT-UA also participates in capacity-building initiatives with academic institutions such as Kyiv Polytechnic Institute and donor programs coordinated by United Nations Development Programme and European Commission mechanisms.

Legal and Regulatory Framework

CERT-UA operates under Ukrainian legislation governing information security and special communications, including statutes administered by the Verkhovna Rada of Ukraine and regulatory directives from the National Security and Defense Council of Ukraine. Its activities intersect with laws on classified information, critical infrastructure protection statutes overseen by the Ministry of Energy of Ukraine and financial supervision rules by the National Bank of Ukraine. International regulatory influences include alignment efforts with European Union cybersecurity directives and standards promoted by Council of Europe instruments, shaping incident reporting obligations and cross-border cooperation.

Technology and Tools Used

CERT-UA employs an array of threat intelligence platforms, network intrusion detection systems, digital forensics suites, and malware analysis sandboxes from vendors and open-source projects. Commonly referenced technologies and tools in CERT-UA workflows include threat intelligence feeds compatible with STIX/TAXII formats, forensic tools like Volatility, FTK, and packet capture utilities alongside commercial offerings from Splunk, Elastic, Cisco Secure, and Palo Alto Networks appliances. For collaborative analysis and disclosure, CERT-UA uses platforms interoperable with standards from FIRST and coordinates indicators with vendor telemetry from Microsoft Threat Intelligence, Google Threat Analysis Group, and cloud providers such as Amazon Web Services and Microsoft Azure.

Category:Cybersecurity in Ukraine