WEAPONIZING CYBERSPACE: THE RUSSIA-UKRAINIAN WAR

  • Eleni Kapsokoli University of Piraeus
Keywords: Russia-Ukrainian war, cyberspace, cybersecurity, hacking, artificial intelligence, cyber-army, intelligence, disinformation

Abstract

Review paper

DOI: https://doi.org/10.37458/ssj.6.2.3

In recent years, cyberspace has emerged as a critical fifth operational domain, where state and non-state actors engage in complex confrontations. Malicious cyber activities frequently target military assets, critical infrastructure, the private sector, citizens, and essential national services, resulting in significant political, social, and economic repercussions. This paper examines the strategic significance of cyberspace in the Russia-Ukrainian war, framing it as a new battlefield in modern warfare. This war exemplifies how activities like cyber-espionage, cyberattacks, hacking, disinformation campaigns, and cyber-surveillance are conducted to achieve military and geopolitical outcomes. The paper examines the frequency, complexity, and impact of these cyber activities during the conflict. Russia has employed state-directed and state-sponsored cyber activities, focusing on espionage, infrastructure disruption, and information manipulation, though often hampered by limited coordination with kinetic operations. Ukraine’s resilient responses, including external support from the private sector, foreign governments, and individual hackers, alongside the formation of a ‘cyber-army’, serve as case studies of resilience to this evolving form of warfare. Lastly, the paper identifies key lessons on the role of cyberspace and information and communication technologies (ICTs) in modern conflicts and highlights the importance of developing resilient strategies.

References

America’s cyber defense agency (20 July 2021). Cyber-attack against Ukrainian critical infrastructure. https://www.cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01

Antoniuk, D. (2023). ‘Ukraine’s intelligence claims cyberattack on Russia’s state tax service’. The Record. https://therecord.media/ukraine-intelligence-claims-attack-on-russia-tax-service

Antoniuk, D. (2024). ‘Pro-Ukraine hackers claim attack on agency that certifies digital signatures in Russia’. The Record. https://therecord.media/russia-osnavanie-digital-signatures-cyberattack-ukraine

Antoniuk, D. (2024). ‘Sandworm-linked hackers target users of Ukraine’s military app in new spying campaign’. The Record. https://therecord.media/ukraine-military-app-espionage-russia-sandworm?utm_medium=email&_hsenc=p2ANqtz-9Xfrusd8755Hwknr35j1UrpLmTRQa1PnWfF25Ij9ksrGYwlCIlBiZXZOPYp_6P4BgsswgJqmRAD2PQrHygi9RDDM-SG1urmPhWzEXsMwHXMhxqvOI&_hsmi=339424039&utm_content=339430154&utm_source=hs_email

Antoniuk, D. (2024). Ukrainian hackers claim attack on Russian scientific research center. The Record. https://therecord.media/ukrainian-hackers-hit-russian-scientific-center

Antoniuk, D. (2025). ‘Russian espionage and financial theft campaigns have ramped up, Ukraine cyber agency says’. The Record. https://therecord.media/russian-espionage-financial-theft-campaign

Antoniuk, D. (2025). ‘Suspected Ukrainian hackers impersonating Russian ministries to spy on industry’. The Record.

Baig, R. (18 March 2022). The deepfakes in the disinformation war. Deutsche Welle. https://www.dw.com/en/fact-check-the-deepfakes-in-the-disinformation-war-between-russia-and-ukraine/a-61166433

Barichella, A. (2022). Cyberattacks in Russia’s hybrid war against Ukraine and its ramifications for Europe. Europe in the World, no.281

Bateman, J. (16 December 2022). Russia’s Wartime Cyber Operations in Ukraine: Military Impacts, Influences, and Implications. Carnegie. https://carnegieendowment.org/research/2022/12/russias-wartime-cyber-operations-in-ukraine-military-impacts-influences-and-implications?lang=en

BBC Monitoring. (11 April 2022). Bucha killings: Satellite image of bodies site contradicts Russian claims. BBC. https://www.bbc.com/news/60981238

Beecroft, N. (2022). Evaluating the International Support to Ukrainian Cyber Defense. Carnegie. https://carnegieendowment.org/research/2022/11/evaluating-the-international-support-to-ukrainian-cyber-defense?lang=en

Biggerstaff, W.C. (2022). Ukraine Symposium photos of the dead. Lieber Institute. https://lieber.westpoint.edu/photos-of-dead/

Biggerstaff, W.C. (2023). The status of Ukraine’s IT Army under the Law of Armed Conflict. Lieber Institute https://lieber.westpoint.edu/status-ukraines-it-army-law-armed-conflict/

Canadian Centre for Cyber Security. (2022). ‘Cyber Threat Bulletin. Cyber Threat Activity Related to the Russian Invasion of Ukraine’. https://www.cyber.gc.ca/sites/default/files/cyber-threat-activity-associated-russian-invasion-ukraine-e.pdf

Champion, M. (8 September 2023). ‘Elon Musk has power in Ukraine. Does he know how to use it?’. Bloomberg. https://www.bloomberg.com/opinion/articles/2023-09-08/ukraine-war-it-doesn-t-matter-how-elon-musk-got-involved-he-s-in-it

Coker, J. (3 January 2024). ‘Russia Spies on Kyiv Defenses via Hacked Cameras Before Missile Strikes’. Infosecurity Magazine. https://www.infosecurity-magazine.com/news/russia-spies-kyiv-hacked-cameras/

Communications Security Establishment. (2023). ‘Communications Security Establishment Annual Report 2022-2023’ https://www.cse-cst.gc.ca/en/accountability/transparency/reports/communications-security-%20establishment-annual-report-2022-2023

Cyber Peace Institute. (2023). ‘Cyber Dimensions of the Armed Conflict in Ukraine’. https://cyberpeaceinstitute.org/wp-content/uploads/2023/12/Cyber-Dimensions_Ukraine-Q3-2023.pdf

Danylov, O. (2022). ‘The unique Ukrainian situational awareness system Delta was presented at the annual NATO event. ’ Mezha. The unique Ukrainian situational awareness system Delta was presented at the annual NATO event • Mezha.Media

Defence Intelligence of the Ministry of Defence of Ukraine. (2023). Defence Intelligence of Ukraine conducted a cyber operation against Rosaviatsia - sanctions accelerate Russia's aviation collapse. https://gur.gov.ua/en/content/voienna-rozvidka-ukrainy-zdiisnyla-kiberspetsoperatsiiu-shchodo-rosaviatsii-sanktsii-pryskoriuiut-aviakolaps-rf.html

EDA. (24 February 2022). Activation of first capability developed under PESCO points to strength of cooperation in cyber defence. https://eda.europa.eu/news-and-events/news/2022/02/24/-of-first-capability-developed-under-pesco-points-to-strength-of-cooperation-in-cyber-defence

ESET. (1 March 2022). ESET Research: Ukraine hit by destructive attacks before and during the Russian invasion with HermeticWiper and IsaacWiper. https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-ukraine-hit-by-destructive-attacks-before-and-during-the-russian-invasion-with-hermet/

ESET. (15 March 2022). CaddyWiper: New wiper malware discovered in Ukraine. https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/

EU Disinfo Lab. (Last update 15 May 2025). ‘What is the Doppelganger operation? List of Resources’. https://www.disinfo.eu/doppelganger-operation

European Parliament. (2022). Russia's war on Ukraine: Timeline of cyber-attacks. https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/733549/EPRS_BRI(2022)733549_EN.pdf

European Parliamentary Research Service. (2022). Russia's war on Ukraine: Timeline of cyber-attacks https://www.europarl.europa.eu/RegData/etudes/BRIE/2022/733549/EPRS_BRI(2022)733549_EN.pdf

FP Analytics. (2023). Digital front lines. A sharpened focus on the risks of, and responses to, hybrid warfare https://digitalfrontlines.io/2023/05/25/the-evolution-of-cyber-operations-in-armed-conflict/

Giles, K. (2016). Handbook of Russian Information Warfare. NATO Defense College

Greig, J. (12 May 2022). ‘Italy stops wide-ranging Russian attack of websites of parliament, military, health agency’. The Record. https://therecord.media/italy-killnet-hacking-military-parliament-national-health-institute

Hakala, J. and Melnychuk, J. (2021), Russia’s Strategy In Cyberspace, NATO Strategic Communications Centre of Excellence, https://stratcomcoe.org/cuploads/pfiles/Nato-Cyber-Report_11-06-2021-4f4ce.pdf

Hunder, M., Landay, J., and Bern, S. (13 December 2023). Ukraine’s top mobile operator hit by biggest cyberattack of war. Reuters. https://www.reuters.com/technology/cybersecurity/ukraines-biggest-mobile-operator-suffers-massive-hacker-attack-statement-2023-12-12/

Hybrid CoE. (18 March 2022). Hybrid CoE continues to work to support European security and Ukraine. https://www.hybridcoe.fi/news/hybrid-coe-continues-to-work-to-support-european-security-and-ukraine/

Kapsokoli, E. (2020). ‘European Union and Cybersecurity: institutions and strategies’, in Daskalakis, I. (ed.) The Defense Integration of the European Union, Infognomon (in Greek).

Kapsokoli, E. (2021). The security challenges that the EU is facing in cyberspace”, in Sidiropoulos, S., Tzagkarakis, I. and Kritas, D. (eds.) 1st POLITEIA International Conference Proceedings - Europe at the Crossroads: Leadership, Challenges and State of Play, Hellenic Association of Political Scientists (HAPSc), Athens, pp.50-63

Kaushik, A. (2023). ‘The War on Ukraine: a look at underemphasized Russian cyber operations’. GLOBSEC. https://www.globsec.org/what-we-do/publications/war-ukraine-look-underemphasised-russian-cyber-operations

KELA Cyber Intelligence Center. (25 February 2024). Russia-Ukraine war: pro-Russian hacktivist activity two years on. https://www.kelacyber.com/russia-ukraine-war-pro-russian-hacktivist-activity-two-years-on/

Kelley, M. (2024). ‘Understanding Russian Disinformation and How the Joint Force Can Address It’. US Army War College. https://publications.armywarcollege.edu/News/Display/Article/3789933/understanding-russian-disinformation-and-how-the-joint-force-can-address-it/

Korotunenko, S. and Rayevskyi, D. (5 August 2024). ‘Ihor Mosiychuk is a Ukrainian politician with a bad reputation, a popular blogger and Russian propaganda darling. Why he is so loved’. Babel. https://babel.ua/en?utm_source=page&utm_medium=main

Kyiv Post. (9 May 2024). Russian Hackers Hack Ukrainian, Latvian Channels to Broadcast Moscow Victory Day Parade. https://www.kyivpost.com/post/32400

Li, D., Allen, J. and Siemaszko, C. (24 February 2022). ‘Putin using false ‘Nazi’ narrative to justify Russia’s attack on Ukraine, experts say’. NBC. https://www.nbcnews.com/news/world/putin-claims-denazification-justify-russias-attack-ukraine-experts-say-rcna17537

Liaropoulos, A. (2012). Deterrence in cyberspace: implications for National Security. MCIS Yearbook 2012.

Liaropoulos, A.N. (2023). ‘Victory and Virality. War in the age of social media’. Georgetown Journal of International Affairs 24, no.2.

Marquardt, A. and Fisher, K. (9 February 2023). ‘SpaceX admits blocking Ukrainian troops from using satellite technology’. CNN https://www.cnn.com/2023/02/09/politics/spacex-ukrainian-troops-satellite-technology

Masters, J. (26 January 2024). ‘Russia-Ukraine War: Cyberattack – Kinetic Warfare Timeline’. MSSP Alert. https://www.msspalert.com/news/ukraine-russia-cyberattack-timeline-updates-amid-russia-invasion

Maundrill, B. (7 March 2023). ‘Russia's Cyber Tactics in Ukraine Shift to Focus on Espionage’. Infosecurity Magazine. https://www.infosecurity-magazine.com/news/russias-cyber-tactics-shift-to/

Menn, J. (1 May 2022). Hacking Russia was off-limits. The Ukraine war made it a free-for-all. The Washington Post.

Microsoft. (Last update 5 August 2025). ‘What is typosquatting?’. https://support.microsoft.com/en-us/topic/what-is-typosquatting-54a18872-8459-4d47-b3e3-d84d9a362eb0

Microsoft Threat Intelligence. (15 March 2023). A year of Russian hybrid warfare in Ukraine. https://www.microsoft.com/en-us/security/business/security-insider/wp-content/uploads/2023/03/A-year-of-Russian-hybrid-warfare-in-Ukraine_MS-Threat-Intelligence-1.pdf

Mitchell, R. (15 December 2022). ‘How Amazon put Ukraine’s ‘government in a box’ – and saved its economy from Russia’, Los Angeles Times, https://www.latimes.com/business/story/2022-12-15/amazon-ukraine-war-cloud-data Moses, C.J. (24 October 2024). ‘Amazon identified internet domains abused by APT29’. AWS Amazon. Amazon identified internet domains abused by APT29 | AWS Security Blog

Mueller, G.B., Jensen, B., Valeriano, B., Maness, R.C. and Macias, J.M. (2023). Cyber operations during the Russo-Ukrainian War. On future War.

NATO. (10 May 2024). Relations with Ukraine. https://www.nato.int/cps/en/natolive/topics_37750.htm

Nelson, A. and Wilde, G. (18 April 2023). ‘How cyber support to Ukraine can build its democratic future’. Cyberscoop. https://cyberscoop.com/ukraine-cyber-aid-russia-war/

NewsGuard. (16 December 2024). ‘Russia-Ukraine Disinformation Tracking Center: 645 Websites Spreading War Disinformation and The Top Myths They Publish’. https://www.newsguardtech.com/special-reports/russian-disinformation-tracking-center/

Ngendakumana, P.E. (4 January 2024). ‘Ukraine says Russian hackers penetrated major telecoms network for months’. https://www.politico.eu/article/ukraines-cyber-spy-chief-vitiuk-says-russia-hackers-penetrated-kyvstarg-telecoms-system-for-months/

Osorio, N. (6 June 2022). ‘Russia’s Cyber Warfare Reputation Lies in Ruins As Anonymous Hacktivists Raid Central Bank Again’. International Business Times. https://www.ibtimes.com/russias-cyber-warfare- reputation-lies-ruins-anonymous-hacktivists-raid-central-bank-3530912

Page, C. (31 March 2022). Viasat cyberattack blamed on Russian wiper malware. TechCrunch. https://techcrunch.com/2022/03/31/viasat-cyberattack-russian-wiper/?guccounter=1

Politico. (3 March 2024). ‘Germany investigating leak in Russia of audio purportedly showing talks on Ukraine aid’. https://www.politico.eu/article/germany-investigating-leak-in-russia-of-audio-purportedly-showing-discussion-of-ukraine-aid/

PolySwarm Tech Team. (9 March 2022). HermeticWiper & IsaacWiper Target Ukraine. https://blog.polyswarm.io/hermeticwiper-isaacwiper-target-ukraine

Posaner, J. and Donovan, H. (3 March 2024). ‘Germany accuses Moscow of ‘disinformation attack’ in leaking senior officers’ call’. Politico. https://www.politico.eu/article/german-defense-minister-accuses-moscow-of-a-disinformation-attack-in-leaking-call-by-senior-officers-taurus-pistorius-ukraine-war/

Raffray, E. (2022). ‘Ukraine: 100 days of war in cyberspace’. Cyber Peace Institute. https://cyberpeaceinstitute.org/news/ukraine-100-days-of-war-in-cyberspace/

Reuters. (10 March 2022). U.S. dismisses Russian claims of biowarfare labs in Ukraine. https://www.reuters.com/world/russia-demands-us-explain-biological-programme-ukraine-2022-03-09/

Rising, D. (11 March 2022). ‘China amplifies unsupported Russian claim of Ukraine biolabs’. Associated Press. https://apnews.com/general-news-39eeee023efdf7ea59c4a20b7e018169

Roussi, A. (11 March 2024). ‘French government hit with cyberattacks of ‘unprecedented’ intensity’. Politico. https://www.politico.eu/article/french-government-hit-with-cyberattacks-of-unprecedented-intensity/

Sheftalovich, Z. (18 May 2022). ‘Ukraine targeting Russians in information war, Kyiv says’. Politico. https://www.politico.eu/article/ukraine-targeting-russians-in-information-war-kyiv-says/

Simonite, T. (2022). The Race to Archive Social Posts That May Prove Russian War Crimes. Wired. https://www.wired.com/story/open-source-russia-war-crimes-ukraine/

Smith- Boyle, V. (2022). ‘How OSINT Has Shaped the War in Ukraine’, American Security Project https://www.americansecurityproject.org/osint-in-ukraine

SPRAVDI. (2024). ‘Exploiting TikTok for malicious influence on ukrainian audience’. https://spravdi.gov.ua/en/exploiting-tiktok-for-malicious-influence-on-ukrainian-audience/

SPRAVDI. (2023). ‘Advertising Captivity and Smear Ads against Ukrainian Counter-Offensive: Spring Activation of Russian Propaganda’. https://spravdi.gov.ua/en/advertising-captivity-and-smear-ads-against-ukrainian-counter-offensive-spring-activation-of-russian-propaganda/

SSSCIP. (2024). ‘Cyber operations by russia: new goals, tools and groups. Analytics on the hacker attacks against Ukraine in H1 2024’. https://cip.gov.ua/en/news/cyber-operations-rf-h1-2024-report

Stano, P., Massrali, N., and Quatresols, X.C. (2021). Cyberspace: EU and Ukraine launch a dialogue on cyber security. European Union External Action.

Statista. (February 2023). ‘Timeline of cyber events involved in Russia's war in Ukraine from February to November 2022’. https://www.statista.com/statistics/1428613/russia-cyber-incidents-war/

Stilwell, B. (7 February 2024). Polish filmmaker deepfaked an entire movie starring Vladimir Putin and screened it for Ukrainian troops. Military.com. https://www.military.com/off-duty/movies/2024/02/07/polish-filmmaker-deepfaked-entire-movie-starring-vladimir-putin-and-screened-it-ukrainian-troops.html

The Economist. (22 February 2023). ‘How a chatbot has turned Ukrainian civilians into digital resistance fighters’. https://www.economist.com/the-economist-explains/2023/02/22/how-a-chatbot-has-turned-ukrainian-civilians-into-digital-resistance-fighters

The State Cyber Protection Centre. (8 January 2025). ‘The Vulnerability Detection and Cyber Incidents / Cyber Attacks Response System helped to detect and process 1,042 cyber incidents in 2024’. https://scpc.gov.ua/en/articles/383

The Telegraph. (17 March 2022). Deepfake video of Volodymyr Zelensky surrendering surfaces on social media. YouTube. https://www.youtube.com/watch?v=X17yrEV5sl4

Tidy, J. (15 April 2023). Meet the hacker armies on Ukraine's cyber front line. BBC. https://www.bbc.com/news/technology-65250356

Tidy, J. (2022). Ukraine cyber-attack: Russia to blame for hack, says Kyiv. BBC. https://bbc.com/news/world-europe-59992531

Tracking Exposed. (10 August 2022). ‘Shadow-promotion: TikTok’s algorithmic recommendation of banned content in Russia’. https://tracking.exposed/pdf/tiktok-russia-ShadowPromotion.pdf

Twomey, J.J., Linehan, C., and Murphy, G. (26 October 2023). Deepfakes in warfare: New concerns emerge from their use around the Russian invasion of Ukraine. The Conversation. https://theconversation.com/deepfakes-in-warfare-new-concerns-emerge-from-their-use-around-the-russian-invasion-of-ukraine-216393

US Department of Defence. (2025). ‘Joint Cybersecurity Advisory: Russian GRU Targeting Western Logistics Entities and Technology Companies’. https://media.defense.gov/2025/May/21/2003719846/-1/-1/0/CSA_RUSSIAN_GRU_TARGET_LOGISTICS.PDF

Vazquez, M., Judd, D., Lyngaas, S., and Cohen, Z. (21 March 2022). Biden warns business leaders to prepare for Russian cyber-attacks. CNN. https://www.cnn.com/2022/03/21/politics/biden-russia-cyber-activity

Watts, C. (2024). ‘How Russia is trying to disrupt the 2024 Paris Olympic Games’. Microsoft. https://blogs.microsoft.com/on-the-issues/2024/06/02/russia-cyber-bots-disinformation-2024-paris-olympics/

Published
2025-12-30