CERT-UKRAINE

CERT-UKRAINE
Name	CERT-UKRAINE
Established	2006
Jurisdiction	Ukraine
Headquarters	Kyiv

CERT-UKRAINE CERT-UKRAINE is a national computer emergency response team operating in Ukraine, providing incident response, vulnerability coordination, and cybersecurity awareness. It engages with international actors including NATO, European Union, United Nations, Microsoft, and Google while coordinating with Ukrainian institutions such as Verkhovna Rada, National Security and Defense Council of Ukraine, Ministry of Digital Transformation of Ukraine, State Service of Special Communications and Information Protection of Ukraine, and SBU. The team interoperates with peer teams like US-CERT, CERT-EU, JPCERT/CC, CERT-UK and industry groups such as FIRST and ETSI.

Overview

CERT-UKRAINE functions as a national point of contact for cybersecurity incidents involving critical infrastructure operators including entities in sectors overseen by Naftogaz of Ukraine, Ukrposhta, PrivatBank, Monobank, and energy companies connected to Ukrenergo. It maintains situational awareness through feeds and platforms used by Cisco, Palo Alto Networks, CrowdStrike, Kaspersky Lab, and ESET while collaborating with academic centers like Taras Shevchenko National University of Kyiv, Kyiv Polytechnic Institute, and Lviv Polytechnic National University. The unit issues advisories referencing standards from ISO/IEC 27001, NIST, ENISA, ITU, and OWASP to assist operators such as Kharkiv Tractor Plant and cultural institutions like National Art Museum of Ukraine.

History

Founded in 2006, CERT-UKRAINE emerged amid post-Soviet cybersecurity developments alongside initiatives from European Commission, Council of Europe, OSCE, USAID, and bilateral partners including United Kingdom, United States, and Canada. During the 2014 Annexation of Crimea by the Russian Federation and the 2014–present Russo-Ukrainian War, the team responded to campaigns linked to actors tracked by researchers from Kaspersky Lab, ESET Research, CrowdStrike Intelligence, FireEye (Mandiant), and Microsoft Threat Intelligence. Major incidents involving destructive malware families like NotPetya, BlackEnergy, Sandworm Team, and HermeticWiper prompted cross-sector coordination with entities such as CERT-EU, Interpol, Europol, CISA, and FBI. Post-2022 escalation, CERT-UKRAINE scaled information sharing with platforms including VirusTotal, AlienVault OTX, and Abuse.ch.

Organization and Governance

CERT-UKRAINE operates under legal and policy frameworks influenced by legislation debated in the Verkhovna Rada, policies from the Ministry of Digital Transformation of Ukraine, and directives from the National Security and Defense Council of Ukraine. Governance includes liaison roles with State Service of Special Communications and Information Protection of Ukraine, coordination with law enforcement agencies like the SBU and National Police of Ukraine, and partnerships with private-sector stakeholders including PrivatBank, Raiffeisen Bank International, Deloitte, PwC, and Accenture. The team participates in multinational fora including FIRST, TF-CSIRT, NATO Cooperative Cyber Defence Centre of Excellence, and G7 cyber dialogues, while aligning practices to standards from ISO, IETF, and ETSI.

Roles and Responsibilities

CERT-UKRAINE conducts incident response, threat intelligence dissemination, vulnerability disclosure coordination, and public advisories affecting organizations such as Ukrzaliznytsia, Boryspil International Airport, Oschadbank, and media outlets like Suspilne. It provides proactive services including tabletop exercises with partners like Microsoft, Amazon Web Services, and Google Cloud Platform, vulnerability assessments referencing Common Vulnerabilities and Exposures, and training programs run with universities such as Kharkiv National University and professional bodies like ISACA and (ISC)². The team also supports recovery efforts following cyberattacks involving technologies from Siemens, ABB, Schneider Electric, and industrial control systems guided by IEC 62443.

Major Incidents and Responses

CERT-UKRAINE has been central to national responses to major cyber incidents including campaigns attributed to groups linked to Sandworm Team, destructive attacks using NotPetya, and targeted operations against broadcasters and infrastructure coinciding with kinetic events such as the 2022 Russian invasion of Ukraine. Responses have involved coordination with Microsoft Threat Intelligence, Mandiant, ESET Research, Kaspersky Lab ICS CERT, Cisco Talos, and law enforcement partners including FBI and Europol to analyze malware samples, publish indicators of compromise, and mitigate lateral movement affecting entities like Ukrenergo, PrivatBank, and transportation networks including Kyiv Metro.

International Cooperation

CERT-UKRAINE maintains bilateral and multilateral relationships with national teams such as US-CERT, CERT-UK, CERT-FR, CERT-DE, JPCERT/CC, and regional bodies like CERT-EU and ENISA. It engages in capacity building supported by USAID, European Commission, NATO CCDCOE, G7, and private partners including Google, Microsoft, Cloudflare, and Akamai. Intelligence sharing occurs through communities such as FIRST, TF-CSIRT, OpenIOC, and commercial platforms including VirusTotal and MISP instances operated with partners like SANS Institute and MITRE who publish frameworks such as ATT&CK.

Technology and Research Initiatives

CERT-UKRAINE conducts research on malware families identified by Kaspersky Lab, ESET Research, CrowdStrike, and Mandiant, publishes indicators in formats compatible with STIX and TAXII, and collaborates on telemetry ingestion using tools from Elastic Stack, Splunk, Zeek, and Suricata. The team participates in academic research with institutions like Kyiv Polytechnic Institute and Lviv Polytechnic National University on topics related to IEC 62443, NIST Cybersecurity Framework, and incident automation using platforms such as TheHive Project and Cortex. It also contributes to open-source projects and training initiatives alongside OWASP, SANS Institute, CEH, and community-driven malware analysis repositories.

Category:Computer emergency response teams Category:Cybersecurity in Ukraine