Kyiv said late Friday it had uncovered preliminary clues that Russian security services could have been behind the cyberattack.
Ukraine's SBU security service said the attacks in the early hours of Friday had targeted a total of 70 government websites.
The website of the foreign ministry for a time displayed a message in Ukrainian, Russian and Polish that said "be afraid and expect the worst".
Within hours of the breach, the security service said access to most affected sites had been restored and that the fallout was minimal.
But Microsoft warned Sunday that the cyberattack could prove destructive and affect more organisations than initially feared.
The US software giant said it continued to analyse the malware and warned it could render government digital infrastructure inoperable.
"The malware, which is designed to look like ransomware but lacking a ransom recovery mechanism, is intended to be destructive and designed to render targeted devices inoperable rather than to obtain a ransom," Microsoft said in a blog post.
Microsoft said it had not so far identified a culprit but warned that the number of affected organisations could prove larger than initially thought.
"Our investigation teams have identified the malware on dozens of impacted systems and that number could grow as our investigation continues," it said.
"These systems span multiple government, non-profit, and information technology organisations, all based in Ukraine. We do not know the current stage of this attacker's operational cycle or how many other victim organisations may exist in Ukraine or other geographic locations."
LANGUAGE OF FORCE
Senior government official Viktor Zhora told AFP on Friday that the hack was one of the "biggest" cyberattacks of the past few years.
Russia has amassed tanks, artillery and tens of thousands of troops near the border of Ukraine and demanded guarantees that its neighbour will never join NATO.
Senior Russian and Western officials held three rounds of talks in Geneva, Brussels and Vienna over the past week but there was no breakthrough.
By the end of the week, Washington warned that Moscow could stage a false flag operation within weeks to precipitate an invasion.
Ukrainian Foreign Minister Dmytro Kuleba said Kyiv and its Western partners were working on a broad "package to contain Russia" that would include "painful" new sanctions and moves to ramp up defence cooperation with the West.
Speaking to Germany's Bild newspaper, Kuleba said Putin "only understands the language of force".
"If Putin wants to know why neighbours are seeking to join NATO he only needs to look in the mirror," he said in remarks released by the foreign ministry on Sunday.