Russian state-run telecommunications firm Rostelecom recently disclosed a large-scale distributed denial-of-service attack (DDoS) by unknown threat actors, which resulted in parts of the internet going down in 30 cities across the country.

“On the evening of April 6, a powerful DDoS attack on Rostelecom’s network was recorded. Incoming traffic filtering was introduced, which affected the availability of some internet resources. The actions of the cybercriminals were promptly neutralized,” the operator’s press service said.

The outages interrupted internet access, government services, online banking, telecom operators, and satellite companies. The disruptions left people in Russia unable to transfer money, withdraw cash, or make card payments for several hours, with some disruption also recorded in neighboring Belarus.

Affected parties included Alfa-Bank, television provider NTV Plus, TV operator Tricolor, state-run digital public portal Gosuslugi, Telecom T2, and electric utility company Mosenergosbyt, according to data updates.

The cause of the disruptions was not immediately known.

While the DDoS intrusion was reported as resolved by Rostelecom on Monday, some online service outages remained until Tuesday.

Various services, including those from Russian-language internet service RuNet, retailer Wildberries, Russian Railways, major Russian telecommunications operator MTS, and social media platforms VKontakte and VK Video were still down following a declaration of a fix.

Record surge in DDoS attacks in February and March

Russia’s internet regulator Roskomnadzor recently disclosed it had faced a record increase in DDoS attacks in February and March, as reported by Russian state news agency RIA Novosti.

Analysts at the Russian Public Communication Network Monitoring and Management Center (CMCN), which operates under Roskomnadzor, found a direct link between the news cycle and the intensity of cybersecurity attacks, RIA Novosti said.

“After media reports appeared about a possible full restriction on Telegram, the load on Roskomnadzor’s resources grew dozens of times over,” the agency stated.

Under usual conditions, the agency’s systems register an average of 350 attacks per week, about 23 of which target Roskomnadzor itself. During the peak period from February 26 to March 4, the total number of attacks rose to 949, the Russian state news agency TASS reported, citing Roskomnadzor.

Telecommunications companies and hosting providers were the most frequent targets, with government resources ranking third, according to the reports.

TASS also stated that despite the sharp increase in load, the National DDoS Attack Countermeasures System had confirmed its status as the primary tool for protecting Russia’s digital infrastructure.

Roskomnadzor has been actively blocking Telegram in Russia in recent weeks, as reported by Riga-based Russian- and English-language news outlet Meduza, with Russian authorities also stepping up their crackdown on VPN services in late March.