Background: Pre-War Cyber Warfare

Ukraine was already the most cyber-attacked nation in the world before the 2022 full-scale invasion:

• 2015 BlackEnergy attack: Russia's Sandworm APT group cut power to ~225,000 Ukrainians — the first confirmed cyberattack to cause a power outage
• 2016 Industroyer/CrashOverride: A second, more sophisticated grid attack in December 2016 affected Kyiv's distribution system
• 2017 NotPetya: Sandworm disguised malware as a ransomware attack; it actually wiped data permanently from Ukrainian government and business systems. Spread globally causing ~$10 billion damage — the most destructive cyberattack in history at the time
• Years of sustained attacks ironically prepared Ukraine better than most nations for cyber conflict — creating institutional knowledge and hardened defenders that proved vital from February 2022

Russian Cyber Attacks 2022–2026

Russia launched its most intensive cyber campaign in the hours before the 24 February 2022 invasion:

• WhisperGate / HermeticWiper (January–February 2022): Destructive wiper malware deployed against Ukrainian government systems; disguised as ransomware but designed to permanently destroy data
• Viasat KA-SAT attack (24 February 2022): Minutes before the invasion, Russia disabled Ukraine's Viasat satellite internet network across Europe, disrupting military communications and also affecting wind farms in Germany
• Industroyer2 (April 2022): Sandworm attempted to trigger a blackout affecting ~2 million Ukrainians; Ukraine's Computer Emergency Response Team (CERT-UA) detected and neutralised it within hours
• Sustained infrastructure targeting (2022–2026): Russian hacking groups have consistently targeted Ukrainian energy, rail, telecoms, and government systems — sometimes in coordination with missile strikes on the same infrastructure
• APT28 (Fancy Bear / GRU) runs parallel operations focused on espionage — collecting intelligence rather than causing destruction

Ukrainian Cyber Defense Evolution

Ukraine's cyber defenses have improved dramatically across the war:

• Cloud migration: Ukraine rapidly migrated critical government data to commercial cloud infrastructure (AWS, Google, Azure, Azure government) before the invasion — preventing data destruction even when physical government servers were targeted
• CERT-UA expansion: The Computer Emergency Response Team grew significantly, receiving unprecedented Western intelligence sharing and technical assistance
• Network segmentation: Critical infrastructure operators implemented air-gap and segmentation strategies — the Industroyer2 attack failed partly because of network changes made after CERT-UA detected it early
• Speed of response: Ukraine's incident response time — from detection to containment — has improved from days to hours for known attack patterns
• Lessons applied systemically: Each attack has been analysed and corresponding defenses deployed across all similar systems within Ukraine's network

Western Cyber Support

Western nations have provided unprecedented cyber assistance to Ukraine:

• US Cyber Command "hunt forward" operations: In December 2021 — before the invasion — US Cyber Command deployed "hunt forward" teams to Ukraine at Ukraine's request, helping identify and remove Russian malware pre-positioned in Ukrainian networks
• CISA support: The US Cybersecurity and Infrastructure Security Agency has provided technical personnel, tools, and direct incident response assistance
• Microsoft: Microsoft's Digital Crimes Unit and Threat Intelligence team have actively monitored and published threat intelligence on Russian operations, helping Ukraine and NATO allies respond. Microsoft's threat data confirmed Industroyer2 attack early
• ESET: Slovak firm ESET partnered with Ukraine and has been central to detecting and analysing malware campaigns
• UK NCSC: UK National Cyber Security Centre has provided substantial intelligence sharing and technical advisory to Ukraine
• EU cyber solidarity: The EU Cyber Rapid Response Team has deployed experts and provided coordinated assistance

Ukrainian Offensive Cyber

Ukraine has developed its own offensive cyber capability — less discussed but significant:

• Ukraine's IT Army — a loosely coordinated volunteer hacking collective formed in February 2022 — has conducted distributed denial of service attacks against Russian government, propaganda, and commercial targets
• The IT Army claims to have disrupted Russian state TV, banking systems, and logistics websites repeatedly — though impact attribution is difficult
• Ukraine's government cyber capabilities (GUR and SBU cyber units) have conducted more sophisticated operations including against Russian railway booking systems, surveillance camera networks in occupied territories, and information systems supporting Russian military logistics
• The hack of Russian satellite systems providing situational awareness data has been reported; Russia has been forced to upgrade satellite security protocols
• Ukraine has not publicly claimed many of its most sensitive offensive cyber operations for operational security reasons

Wiper Malware Campaign History

Russia has deployed an exceptional variety of wiper malware specifically against Ukraine:

2026 Cyber Threat Landscape

The cyber threat landscape in Ukraine has evolved significantly by 2026:

• Destructive attacks on infrastructure continue but Ukraine intercepts or limits impact on the majority — Russia no longer achieves the systemic disruption it caused in 2017
• Espionage operations have intensified — Russia prioritises collecting intelligence on Ukrainian military movements, weapons positions, and Western support operations
• Supply chain attacks targeting Western defence contractors providing equipment to Ukraine have been documented
• Disinformation and influence operations using AI-generated content remain a significant ongoing threat — targeting both Ukrainian domestic morale and Western public support
• The frontline information environment — where digital comms are jammed and monitored continuously — has forced innovative solutions including shortwave and satellite communications outside traditional internet infrastructure
• Lessons from Ukraine are being applied across NATO — the alliance's cyber resilience has measurably improved, acknowledging that Ukraine served as an advance warning against tactics that would be used against NATO members

Frequently Asked Questions