A look at volunteer hackers in the Russia-Ukraine war, many scattered globally with unverifiable identities, as both sides recruit them to launch cyberattacks
The hackers have claimed a number of disruptions over the past week, blurring the lines between amateurs and groups linked to governments.
Context & Ripple Effects
Ukraine opened the door on February 25 by asking its hacker community to volunteer for infrastructure defense and spying missions against Russian troops; within a week, self-declared hackers on both sides were claiming disruptions they could not be verified to have carried out. The recruitment playbook is not new for Moscow: reporting since 2016 documents Russia [[a:915359|bolstering its cyberwarfare capabilities through outside firms and recruited convicted hackers]], building on the loose alliance between its criminal hackers and intelligence services that has operated since around 2005.
First-order effects
- Both governments gain a pool of deniable operators whose unverifiable identities let each side claim — or disclaim — any given attack, while Ukraine's volunteers defend critical infrastructure and conduct spying missions in parallel.
Second-order effects
- Because amateur claims are indistinguishable from state-linked ones, each side must treat every disruption as potentially official, and targets extend beyond military systems to civilian assets like the Wildberries warehouses Ukraine has repeatedly struck.
Third-order effects
- If the volunteer-recruitment pattern holds, wartime cyber mobilization becomes a standing feature of statecraft on both sides, eroding the norm — noted in later reporting that hacking Russian targets was once considered off-limits by some — and pushing attribution and escalation decisions further into ambiguity.
The trend: State cyberwarfare is absorbing volunteer hackers as deniable proxies, extending Russia's long-standing outsourcing model to Ukraine and normalizing unattributable attacks in interstate conflict.