Russia-Ukraine Cyberwar: The Shadow War That Never Sleeps
Its actors are nation-states, terrorist groups, and hacktivists, and their main goal is to seek power and dominance.
The bombs make headlines, but the quietest war is fought by the Black Hats. The cyber battlefield is a constantly shifting domain.
Its actors are nation-states, terrorist groups, and hacktivists, and their main goal is to seek power and dominance. Cyber warfare has become a critical element of modern conflict. It has the ability to steal sensitive data and threaten critical infrastructure. This column examines tactics used in cyber conflicts and their countermeasures.
The geographic core is Ukraine and Russia, with allies and non-state actors drawn into a shadow war. Russia has used drone strikes on the SBU headquarters in Kyiv, targeting the office of the acting head of Ukraine’s Security Service. Both sides seek intelligence and attack telecommunications, critical infrastructure, and military systems.
Reports say data on 10% of Ukrainian computers was erased. Ukrainian officials describe the war as one fought in the shadows. Last June, petrol stations and internet providers in Russia were shut down. Key players include Russia, Ukraine, Russia’s FSB and GRU, Ukraine’s SBU and CERT-UA, Anonymous, NB65, Sandworm, GHOSTWRITER/UNC1151, Conti, Beregini, XaKNet Team, Killnet, CoomingProject, Belarusian Cyber Partisans, and the IT Army.
Russia has used DDoS attacks and malware against Ukraine’s finance and energy sectors. It deployed eight malware families: Whisperkill, FoxBlade, SonicVote, Caddy Wiper, DesertBlade, Industroyer2, Lasainraw, and Fiber Lake. It later launched four new variants, collectively named Armageddon.
Armageddon, also tracked as Gamaredon, is a Russian state-sponsored threat group attributed by Ukraine’s SBU to the FSB. Ukraine’s SBU reported that SpaceX’s Starlink terminals used by the Ukrainian government were jammed for a time. Ukrtelecom, a Ukrainian internet provider, was also disrupted. Sandworm, linked to Russia’s GRU, tried to deploy Industroyer2, but CERT-UA protected its network. Russia also targeted Ukraine’s allies. Ukrainian authorities claim Russia’s FSB used spear-phishing attacks against EU governments.
In response, non-state actors targeted Russia to support Ukraine and its allies. RuTube, a Russian video platform, was hacked and stayed down for two days. YourAnonSpider, linked to Anonymous, claimed responsibility.
Major Russian television networks briefly went offline; NB65, an Anonymous-affiliated group, also claimed responsibility. Anonymous hacked Russian UAV plans. Russian businesses and institutions, including primary intelligence services, were also targeted by Anonymous, Network Battalion 65, and Distributed Denial of Secrets.
Many cyber threat actors support Russia. GHOSTWRITER/UNC1151, associated with Belarus’s government, handles disinformation, credential harvesting, hack-and-leak operations, false flags, and espionage. Some cybercrime groups have declared support for Russia. Conti, a ransomware group, vowed to retaliate against anyone attacking Russian computer networks.
It publicly backed Russia after the invasion of Ukraine and warned of retaliation against Western cyberattacks on Russian infrastructure. Before that, Conti was an influential ransomware operation that also affected Canada. Beregini and XaKNet Team also work for Russia against Ukraine and its allies. Killnet, another pro-Russia group, has conducted DDoS attacks on websites of states helping Ukraine.
It recently targeted Italian critical infrastructure, including the Defense Ministry, Senate, and National Health Institutes. CoomingProject is another ransomware group supporting Russia.
Ukraine also has hacker allies. Anonymous is one of its major supporters. It has leaked data, wiped files, launched DDoS operations, and hacked Russian television networks, affecting the Russian government and film industry. Belarusian Cyber Partisans is a pro-Ukraine hacker group working against Russia. Ukrainian officials claim more than 300,000 IT volunteers have joined the IT Army to protect Ukrainian networks.
Both countries should implement strong security measures, such as encryption, multi-factor authentication, and firewalls, to protect the cyber terrain. Machine-learning security tools can help counter cyberattacks. Russian hackers have already used AI, specifically Anthropic’s Claude model, to automate cyberespionage against Ukraine and European countries.
More than 20 sites were attacked between December 2025 and August 2026. Both countries should implement a zero-trust security model to remain secure from cyber threats. Regular software updates can reduce the risk of attacks. Finally, cyber education and awareness are essential on the cyber battlefield.
The key point is that cyber warfare has become a critical element of modern conflict. More than four and a half years into the full-scale escalation, the war continues. Both Russia and Ukraine actively conduct cyber operations. There is a need for practical preventive measures to curb the repercussions of cyber warfare. Otherwise, the shadow war will keep threatening critical infrastructure.