Hacking Russian targets was once considered off-limits by some, but after invading Ukraine the country has been hit by an unprecedented wave of cyberattacks
Experts anticipated a Moscow-led cyber-assault; instead, unprecedented attacks by hacktivists and criminals have wreaked havoc in Russia
Context & Ripple Effects
Russia entered the war with a long-running record of a loose alignment between criminal hackers and intelligence services directed at perceived foreign enemies. The reported attacks reverse that familiar direction of pressure: Russian targets are now being hit by hacktivists and criminals rather than by the expected Moscow-led campaign.
Related coverage also describes volunteer hackers with unverifiable identities and locations in the Russia-Ukraine war, with both sides recruiting participants. That decentralization makes the wave against Russia consequential beyond any single government operation.
First-order effects
- Russian organizations and infrastructure operators must respond to disruption from hacktivist and criminal attacks while Moscow does not receive the anticipated state-led cyber offensive in its favor.
- Volunteer hacker activity becomes an active part of the conflict alongside state operations, placing poorly attributable actors at the center of attacks on Russian targets.
Second-order effects
- Russia's cyber defenders face a broader set of adversaries than a conventional state campaign, because the reported attackers span both hacktivists and criminals.
- Ukraine and its allies' later cyberdefense effort against Russian wiper malware reflects the reciprocal operational burden of a conflict in which cyberattacks and defense run alongside the war.
Third-order effects
- The conflict points toward cyberwarfare in which governments contend not only with rival states but also with globally scattered volunteer and criminal networks whose identities and affiliations are difficult to verify.
- If this pattern persists, the distinction between patriotic volunteer action, criminal activity, and state-directed cyber operations will be harder for defenders and policymakers to maintain.
The trend: Russia's invasion is accelerating the incorporation of decentralized hacktivist and criminal networks into interstate cyber conflict.