Cyberwarfare by Russia

• 1. Introduction

  ›

  Cyberwarfare by Russia is not a single dramatic strike. It is a sustained, decades-long campaign woven from denial-of-service floods, covert hackers, forged documents, and psychological operations, all coordinated by Russian security and intelligence agencies since the 1990s to advance Kremlin geopolitical objectives. In April 2007, Estonia's banking system went dark, its government email collapsed, and its media outlets fell silent, all because a diplomatic row over a Soviet war memorial had triggered something the world had never quite seen before: a nation targeted by coordinated cyberattacks on a national scale. What does it mean when a country's critical systems can be switched off from across a border? Who controls these operations, and how far do they reach? Those questions became urgent in Tallinn in 2007, and they have not stopped being urgent since.

• 2. The Doctrine Behind the Attacks

  ›

  A 2017 United States Defense Intelligence Agency assessment described Russia's approach as having two interlocking components. The first is informational-technical operations: hacking, sabotage, and surveillance of computer networks. The second is informational-psychological operations: campaigns designed to shift beliefs and destabilize institutions. Together they fall under a Russian concept called informatsionnoye protivoborstvo, or information confrontation, a framework that has Soviet-era roots.

  Russia's 2016 Information Security Doctrine gave this framework formal standing in national law. The doctrine defines information security broadly enough to encompass data systems, physical infrastructure, and the behavior of human beings online. Its stated aims include protecting information sovereignty, securing state secrets, and promoting domestic technology development. Foreign states, organizations, and individuals are named as potential threats, and all branches of government are directed to coordinate responses.

  In 2013, Chief of the General Staff Valery Gerasimov published an article arguing that non-military tools can be decisive in modern conflict when coordinated with limited military force. Western analysts have frequently cited the article as a kind of blueprint, though experts caution that it reflects long-standing Russian military thinking rather than announcing a new doctrine.

  The Federal Security Service, the FSB, manages internal surveillance and counterintelligence, including the SORM system used to monitor online activity inside Russia. Military intelligence, the GRU, runs external operations including cyberattacks and network intrusions. Civil agencies and state-aligned media add messaging capacity both at home and abroad. Researchers at the Centre for Eastern Studies and the Kennan Institute have noted that this combination of legal, technical, and narrative tools is the defining feature of the approach.

• 3. The Hacker Groups

  ›

  US Department of Justice indictments and cybersecurity company reports have identified several recurring groups linked to the Russian state. APT28, also known as Fancy Bear, is commonly attributed to GRU Unit 26165. It has run operations against parliaments, broadcasters, and election campaigns across Europe. APT29, also known as Nobelium or Midnight Blizzard, is linked to Russia's foreign intelligence service, the SVR, and conducts long-running espionage campaigns against governments and technology companies.

  Sandworm, assessed as GRU Unit 74455, has deployed destructive malware against Ukrainian targets and is responsible for global campaigns including NotPetya. Turla, tracked by Microsoft as Secret Blizzard, is associated with FSB infrastructure and continued espionage operations as recently as 2025, when it targeted foreign embassies in Moscow. Star Blizzard, also known as Callisto or ColdRiver and linked to the FSB, has faced sanctions, criminal charges, and technical takedowns for spear-phishing campaigns aimed at officials, academics, and non-governmental organizations.

  In December 2023, US authorities charged two men, Andrey Korinets and alleged FSB officer Ruslan Peretyatko, in connection with Star Blizzard's spear-phishing operations. The US State Department offered a reward of up to ten million dollars for information leading to their whereabouts and arrest. By October 2024, the Justice Department and Microsoft had seized more than a hundred internet domains tied to Star Blizzard. Microsoft's Digital Crimes Unit reported that from January 2023 to August 2024, the group targeted more than thirty different organizations and at least eighty-two Microsoft customers, roughly one attack per week.

• 4. Estonia and the First Cyber Siege

  ›

  In April 2007, a dispute over the relocation of a Soviet-era war memorial in Tallinn escalated into something that security experts later described as a turning point in the history of conflict. Over several days, botnets flooded Estonian financial, media, and government websites with enormous volumes of spam traffic in what is called a distributed denial-of-service attack. Online banking went offline. Government employees lost email access. Journalists could not publish news.

  Estonian officials traced the systems directing the attacks back to Russian IP addresses, and the instructions coordinating the attack were written in Russian. Some experts nonetheless questioned whether the Russian government itself ordered the campaign. The ambiguity of attribution would become a recurring feature of Russian cyber operations.

  A year later, NATO founded the Cooperative Cyber Defence Centre of Excellence in Tallinn as a direct response to what Estonia had experienced. The centre became an institutional anchor for allied thinking about cyber conflict. When Estonia removed a Soviet-era tank monument near Narva in response to Russia's 2022 invasion of Ukraine, Estonian authorities reported the most extensive cyberattacks the country had experienced since 2007.

• 5. Ukraine as a Testing Ground

  ›

  A Russian cyber weapon called Snake, also known as Ouroboros, began spreading into Ukrainian government computer systems in 2010, and was publicly reported in March 2014. The tool performed both network exploitation and sophisticated network attacks on Ukrainian government infrastructure.

  From 2014 to 2016, the Russian group Fancy Bear used malware hidden inside an infected Android application to target the Ukrainian Army's Rocket Forces and Artillery. The app was designed to control targeting data for the D-30 Howitzer. It was loaded with X-Agent spyware and distributed on military forums. The hacking group CyberBerkut, meanwhile, attacked the May 2014 Ukrainian presidential election over several days: it released hacked emails, attempted to alter vote tallies, and launched denial-of-service attacks that delayed results. A file that would have declared far-right candidate Dmytro Yarosh the winner was discovered inside the Central Election Commission's network less than an hour before polls closed. Channel One Russia reported that Yarosh had won and broadcast the fabricated graphic, citing the election commission's website, even though it had never appeared there.

  In December 2015, a malware attack attributed to Sandworm or the Russian government struck Ukrainian infrastructure, leaving more than two hundred thousand people temporarily without power. A similar attack on the power grid followed in December 2016. In February 2022, before and after Russian troops moved into eastern Ukraine, a series of cyberattacks took down major Ukrainian government and business websites. US officials attributed those attacks to Russian actors.

• 6. Interference in Western Democracies

  ›

  In May 2017, on the eve of the French presidential election, more than twenty thousand emails belonging to Emmanuel Macron's campaign were dumped on an anonymous file-sharing website, shortly after the campaign announced it had been hacked. Analysis by the American cybersecurity firm Flashpoint determined with moderate confidence that APT28 was behind the breach and the subsequent leak. An earlier attack in 2015 had already struck the French broadcasting network TV5Monde; that operation was initially claimed by a group calling itself the Cyber Caliphate, but French authorities later connected it to APT28.

  In Poland, a three-year pro-Russian disinformation campaign on Facebook with an audience of four and a half million Poles was uncovered in early 2019 by OKO.press and Avaaz. The campaign published fabricated news and supported specific Polish politicians. Facebook removed some of the pages after reviewing the analysis.

  In February 2016, senior Kremlin cyber official Andrey Krutskikh told Russia's national security conference that Russia was developing new strategies for the information arena that he compared to testing a nuclear weapon, saying it would allow Russia to speak to Americans as equals. Later that year, hacked emails belonging to the Democratic National Committee, John Podesta, and Colin Powell were released through DCLeaks and WikiLeaks. Private sector analysts and US intelligence agencies attributed the operation to Russian origin. In 2020, the group APT29 breached a top cybersecurity firm and multiple US government agencies, including the Treasury, Commerce, and Energy departments and the National Nuclear Security Administration, through the SolarWinds Orion network management platform. In May 2021, the Colonial Pipeline was struck by ransomware deployed by the Russian-language group DarkSide. The Department of Justice later recovered the bitcoin ransom paid to the attackers.

  In the Czech Republic, authorities in 2023 exposed a Kremlin-funded influence network called Voice of Europe, based in Prague and led in part by Ukrainian politician Viktor Medvedchuk. Czech intelligence investigations in 2024 revealed the network had attempted to bribe European lawmakers and sway the 2024 European Parliament election, using local intermediaries to channel funds to far-right and Eurosceptic politicians while amplifying pro-Kremlin narratives.

• 7. The Long Shadow of Attribution

  ›

  A 1999 US investigation called Moonlight Maze traced a 1996-1999 Russian cyberattack against NASA, the Pentagon, civilian academics, and government agencies. It was one of the earliest formal attributions of a state-sponsored cyber operation, and it established a pattern: attacks are often discovered and attributed long after they begin.

  The 2007 Estonia attacks illustrated the problem clearly. Even when IP addresses, language, and coordination pointed toward Russia, experts disagreed about whether the Russian state had directly ordered the campaign. In Georgia in 2008, a report by the US-based research institute US Cyber Consequences Unit concluded that the attacks on Georgian government websites had little or no direct involvement from the Russian government or military, finding that many originated from civilian computers whose owners were supporters of Russia during the conflict.

  False alarms have compounded the challenge. On the 30th of December 2016, Vermont's Burlington Electric Department announced that code associated with the Russian hacking operation dubbed Grizzly Steppe had been found on one of its computers. Early reporting created the impression that the US electric grid had been compromised. A subsequent correction clarified that the affected computer was not connected to the grid at all. Multiple governments have since moved toward coordinated formal attribution statements as a response to these ambiguities, pairing technical evidence with classified intelligence to publicly name Russian state entities responsible for specific attacks. The Viasat satellite attack at the start of Russia's 2022 invasion of Ukraine prompted one such coordinated international response, bringing allied governments together in a joint attribution that carried direct diplomatic and legal weight.