Ukraine’s year of war exposes changing roles for cyber weapons

On the one-year anniversary of Russia’s invasion, Ukraine is commemorating horrific losses — and remarkable defiance.

The country’s fierce resistance on the battlefield has been echoed on the digital front — where Kyiv has unique experience. The conflict with Russia has become the world’s first full-scale cyberwar, but Ukraine was a test bed for digital weapons long before the invasion of 24 February, 2022. Since Putin’s troops began flooding across the border, the cyber tactics have shifted dramatically.

These developments have made Ukraine a bellwether for digital warfare. And to the surprise of analysts, cyber attacks have had a limited impact over the past year.

“We’re going to see cyber activity as a pre-emptive tactic to physical war.

In the lead-up to the invasion, cyber assaults were prominent. On 15 February, Russian hackers launched the most powerful DDoS attack in the history of Ukraine. A day before the full-scale invasion, several government and banking websites were struck once again.

Yet in the months that followed, reports of major cyberattacks declined. Zachary Warren, Chief Security Advisor EMEA at Tanium and a regular advisor to NATO, regards this as a portent for digital warfare.

“Moving forward, we’re going to see cyber activity as a pre-emptive tactic to physical war… it’s a tool to weaken a target before moving in,” he said.

Ukraine’s government, meanwhile, asserts that Russia’s targets have changed. In a January report, security officials said the cyberattacks initially centred on Ukraine’s communication department, which aimed to disrupt military and government operations. But after Russia’s first defeat at the front, the focus shifted to maximising damage to civilians.

Notably, the officials found that all the assaults had harnessed previously known techniques.

“The attacks used by Russia have long been categorised and have straightforward solutions for counteraction,” said the report’s authors.

Many analysts expected cyberattacks to be more prevalent and devastating. Adam Meyers, Head of Intelligence at security firm CrowdStrike, believes Russia had expected a quick and decisive victory. As a result, the Kremlin may have initially avoided destructive cyberattacks, because it would have needed Ukrainian infrastructure to prop up a friendly government.

“As Russian operations failed to take Kyiv and make advances as rapidly as planned, we saw more tactical cyber operations paired with kinetic effects targeting Ukraine and did not see broad attacks against the West — as we all had prepared for,” said Meyers.

The modest impact of Russia’s cyber weapons has not been for want of trying. In January, Viktor Zhora, a senior figure at Ukraine’s cybersecurity agency, said cyberattacks in the country had tripled over the past year. Zhora wants the digital assaults to be prosecuted as war crimes.

Despite the onslaught, Ukraine’s networks have remained remarkably resilient. Analysts give much of the credit to Ukraine’s repair crews, its widespread connectivity to networks outside the country, and its large number of internet exchange points.

Some pundits argue that digital weapons are simply less effective than physical warfare, while others believe Russia’s capabilities were overrated.

Another factor is Ukraine’s persistent efforts to strengthen its defences. The lengthy conflict with Russia have provided immense experience of mitigating cyberattacks.

“This made us stronger,” Zhora said last year. “We took our lessons from this cyber aggression.”

There will be more more lessons to come, but Ukraine already has much to teach its allies about cyber warfare.