Co-owner and chief designer of Ukrainian miltech company Fire Point, Denis Shtilerman, believes that the networks have installed Russian spyware «SORM». In his opinion, it is necessary to «turn off both operators alternately for several days» to clean their equipment. Kyivstar refutes Shtilerman’s words.
Co-owner and chief designer of Ukrainian miltech company Fire Point, Denis Shtilerman, believes that the networks have installed Russian spyware «SORM». In his opinion, it is necessary to «turn off both operators alternately for several days» to clean their equipment. Kyivstar refutes Shtilerman’s words.
Denis Shtilerman commented on a video where a Shahed suicide drone flies at the height of the roof of a five-story building in the city of Myrhorod, Poltava region.
«This cannot be stopped by turning off Starlink — because they simply don’t need it. Every Ukrainian who uses Kyivstar or Vodafone actually has spyware installed on the network — „SORM“,» said the co-owner of Fire Point.
SORM (System of Technical Means for Ensuring the Functions of Operational-Investigative Measures) is a nationwide system of automated and remote infrastructure for legal interception. It includes a set of technical means and measures designed to conduct operational-investigative measures in Russian telecom networks and monitor the Internet activity of Russians.
Last year, Microsoft Threat Intelligence warned that the hacker group Secret Blizzard was infecting diplomatic staff connected to Russian ISPs with the ApolloShadow spyware. Microsoft said the group used SORM, a Russian-built infrastructure, to carry out its cyberattacks.
«Since 2014, the core of the Kyivstar networks, which were partly owned by VimpelCom, and Vodafone, which were owned by MTS, has had the FSB of the Russian Federation’s operational and investigative measures system — SORM,» claims Denis Shtilerman.
According to him, the Russians fly in FPV mode over Ukrainian cities mostly using the Kyivstar and Vodafone networks, which, through SORM, do not see how Shahed connects to their network.
Myrhorod. Shahed right above the houses. https://t.co/GLExONwd4u pic.twitter.com/sYJUrOxoRc
— Anatoly Stefan (Shtirlitz) (@Shtirlitz53) March 4, 2026
«That is, if there is a mobile operator’s tower nearby, the enemy drone takes all the Internet signal necessary for FPV flight from it. In addition, thanks to SORM, the FSB gains access to all traffic going through the mobile operator in consumers' phones. Fortunately, most of this traffic is encrypted,» wrote the co-owner of Fire Point.
In his opinion, the problem can be solved «relatively simply» — by turning off both operators one by one for a few days, «replacing the hardware and re-rolling the kernel with new equipment.»
«Given that when one operator is disconnected, roaming automatically switches to another, this will not even lead to a significant network overload,» says Stillerman.
Military expert on communications and drones, advisor to the Minister of Defense Sergey «Flash» Beskrestnov noted that in Ukraine, captured Russian drones are being studied by «dozens of services and departments.»
«Currently, Shahed does not have the PHYSICAL ABILITY to control via mobile networks. All that is available is a tracker that has two modems and modem control via a Raspberry Pi single-board computer. The two modems have 4 external antennas. The tracker has the functionality to transmit Shahed’s location and engine operating parameters,» the expert pointed out.
dev.ua has reached out to Kyivstar and Vodafone for comment.
«The information disseminated in the post is not true. Kyivstar’s infrastructure operates in accordance with Ukrainian legislation and the requirements of international cybersecurity standards,» the Kyivstar press service emphasized.
The company assured that its network uses only technical solutions provided for by Ukrainian legislation and controlled by authorized state bodies. The infrastructure regularly undergoes the necessary inspections and certification, Kyivstar noted.
Earlier, advisor to the Minister of Defense and radio technology specialist Sergey «Flash» Beskrestnov indicated that some Russian drones have trackers with SIM cards that transmit basic telemetry: coordinates, speed and flight altitude via mobile communication to a Telegram bot. SIM cards can be Ukrainian, Russian or international, and they are found in large numbers in the wreckage.
In February 2026, Flash called on the authorities and society to consider introducing strict restrictions on the mobile communications market due to the fact that the Russians began to massively use Ukrainian LTE networks to guide their drones.
