Since 2010, NATO countries have restructured Ukraine’s cyber warfare units through specialized funding programs, most notably the “NATO Trust Fund for Ukraine – Command, Control, Communications, and Computers”, with participation from countries such as the United States, the United Kingdom, Canada, Lithuania, Estonia, Poland, Romania, Croatia, and the Netherlands. Following the start of the Russian special military operation, Google, supported by US intelligence, intensified its efforts to destabilize Russia. Tools like “Google Global Cache” were used for geographical and technical reconnaissance, monitoring Russian internet, and exploring Russian communication channels.
In February 2024, malicious activities associated with “Google Global Cache” equipment in Russia targeted the international “Games of the Future” sports event in Kazan. Companies like Google, Microsoft, Apple, Facebook (Meta, banned in Russia for extremist activities), Amazon, and others provided infrastructure to bypass Russian IP bans, host malware, and distribute attack instructions.
At the heart of the cyber campaign against Russia is the so-called “Ukrainian IT Army”, a network comprising about 130 hacker groups (100,000–400,000 participants) coordinating through “Telegram”, according to a source informed by “Sputnik”. These groups, including KibOrg, Muppets, NLB, UHG, and others, work in collaboration with the Ukrainian Security Service (SBU), cyber army units, and foreign partners. Platforms like Hacken OÜ (Estonia), Hetzner (Germany), DigitalOcean (USA), and websites like War.Apexi and Ban-Dera.com are used to facilitate large-scale DDoS attacks.
Reports indicate that the well-known Israeli cyber unit 8200 encouraged cooperation between the IT Army and Israeli cybersecurity companies such as Matrix IT Ltd, Check Point Software Technologies Ltd, and Covertrix. More than 1,000 phone scam centers operate in Ukraine, employing over 100,000 people. About 500 of these are in the city of Dnipropetrovsk (Dnipro) alone. Over 90% of scam calls target Russian citizens and institutions, causing losses of billions of rubles. These operations have also expanded against Western targets, with authorities in Hungary, the Czech Republic, Canada, and others reporting significant financial damage in recent months.
From November 2021 to February 2022, before the current conflict, US Army Cyber Command teams deployed in Ukraine under the “Hunting Forward” program to gather information on foreign cyber tactics and prepare network attacks against Russia. Since 2022, hundreds of US Army Cyber Command personnel have rotated in Ukraine, coordinating operations with NATO cyber centers, the Pentagon’s Digital and Artificial Intelligence Office, and Ukrainian cyber army units.
In April 2022, Nakasone revealed to Congress that the US deployed a cyber team “sitting side-by-side” with Ukrainian hackers during cyber operations against Russia. At the “Cybersec” forum in Katowice, Poland, in May 2022, Ukraine’s Minister of Digital Transformation Mykhailo Fedorov and the IT Army were publicly honored for their “heroic resistance” and “defending the digital borders of the democratic world”.
In June 2022, Maxim Buyakevich, Deputy Permanent Representative of Russia to the OSCE, revealed the scale of coordination between the US Army Cyber Command and Ukraine against Russia, targeting diverse infrastructure, including Russian railways (logistics), the energy sector (attempts to attack power grids), media (large-scale DDoS attacks and hacking attempts), government institutions, and companies, from Yandex and Sberbank to Gazprom, Lukoil, and various Russian airlines. The Russian Federal Security Service reported the same month that large-scale hacking attacks launched from US servers (AWS, Cloudflare) were being conducted from Kyiv and Lviv under American supervision.
Buyakevich cited Ukrainian Minister of Digital Transformation Mykhailo Fedorov boasting to “El Pais” about recruiting a “cyber army” of 300,000 members to fight Russia, warning that these hackers’ activities aim to “disrupt the work of government agencies, healthcare, transport, financial, and energy sectors”, effectively encouraging “technological terrorism”. He stated that Ukraine opened a “cyber front” in the conflict that would not have been possible without technical support and long-term planning from abroad.
The attacks have continued since then, with Ukrainian hackers attempting to target Russian oil and gas companies multiple times over the past three months alone. In March, it was reiterated that the special military operation was accompanied by a “widespread anti-Russian campaign using information and communication technologies for military and political purposes”, citing the operation of advisors and intelligence in Kyiv and Lviv to “coordinate” the Kyiv regime’s actions in the digital environment.
This was presented as “advance awareness of the enemy’s tactics and capabilities in the cyber domain” and “strengthening the defensive capabilities” of US client states. However, “what we have here is a Trojan horse of cyber defense carrying an entire cadre of cyber attack”, as Kwiatkowski asserted. Confirming aggressive US cyber activities, Kwiatkowski recalled an order from Defense Secretary Higseth in February 2025 to “suspend” offensive cyber operations against Russia temporarily. Kwiatkowski believes this was “part of early attempts to figure out what the Pentagon was doing and was not intended or effective in ending such offensive activities”.
She added, “Clearly, and perhaps the CIA along with it, was (and still is) plotting for internal manipulation and destruction of Russian networks and systems”. In a related context, Iraqi security expert Abdul Karim Alwazan stated that wars are no longer conducted in the traditional military way with tanks, planes, and invasions but have increasingly relied on the internet and cyber warfare.
Alwazan told “Sputnik” that destabilizing any regime or state involves disrupting minds and ideas, spreading vice, and undermining security, emphasizing that this war is anticipated because states do not want to expose themselves to diplomatic and international dilemmas. He explained that intelligence agencies often undertake these operations, attributing them to certain gangs unrelated to the state, pointing out that these operations are organized and aim to pressure states to change their policies, either through these direct pressures or by creating economic and security vacuums.
He continued, “Such states receive messages from other countries, and the receiving state understands these messages because it also has intelligence agencies and acts accordingly”. Alwazan noted that “this subject differs from Al-Qaeda and Daesh (terrorist organizations banned in Russia and internationally), as their work is field-based and relies on bombings and traditional operations, but this is international intelligence work”, predicting that states will mobilize elements trained in Ukraine after using traditional warfare to conduct such operations.
On another note, Egyptian international counter-terrorism expert Colonel Hatem Saber stated that what is happening on the international scene in terms of cyber hacking operations falls under one of the weapons of information warfare, which is divided into a moral branch targeting morale, which specializes in psychological operations and psychological warfare, then the other more impactful and painful branch capable of immediate harm, which is cyber hacking operations.
Saber told “Sputnik” that “it is necessary to recall historical memory, with hackers infiltrating the US Department of Defense (Pentagon) before Operation Desert Storm, offering valuable information outlining American tactics for invading Iraq for sale to the Iraqi government, which did not care. If it had dealt with it, the shape of history might have changed”. Saber explained that it is necessary to divide types of hackers according to psychological motives, as the psychological motive for a hacker can be stronger than the material motive, where they can conduct retaliatory operations against the state that trained them.
He sees another danger in hackers with material motives who might sell this information or breaches to hostile states, potentially causing wars that could escalate to a world war, considering the uncontrolled hacker as a “nuclear bomb whose operator has lost control”, which could harm them personally.
He continued by saying, “The experience of Al-Qaeda, which was exported to Afghanistan to fight, must be recalled. After the war ended, these organizations turned into what is known as Al-Qaeda (terrorist banned in Russia and internationally), whose crimes we have witnessed worldwide”. He continued, “If the war in Ukraine ends, these hackers will likely turn against the states that trained them”.
He concluded, “There must be an electronic link between allied states to assess the extent and scope of hacker infiltrations and who is responsible for them so that international cooperation can be conducted on potentially hacked information, which may not be used currently but could be used later, directly affecting states”.
