Loading story…
Nations are increasingly integrating cyberspace into their military and national security strategies, developing both defensive and offensive capabilities to project power and protect their interests. Experts highlight that while technological advances in forensics and artificial intelligence have improved cyber defense, attributing responsibility for cyber operations remains a significant challenge. The formal recognition of cyberspace as a domain of warfare by organizations like NATO has led to the establishment of specialized units and procedures for both conducting and attributing cyber activities, often in coordination with other domains of conflict.
Recent conflicts, such as the war in Ukraine, have demonstrated the evolving nature of offensive cyber operations, with countries like Ukraine leveraging both state and non-state actors to conduct attacks that target military and civilian infrastructure. These operations have sometimes challenged established international norms and legal frameworks, as seen in Ukraine's willingness to militarize hacktivist groups and target a broad range of assets to achieve strategic objectives. The adaptation of adversaries and the ongoing debate over responsible behavior in cyberspace underscore the complexity and high stakes of modern cyber conflict.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
A Lawfare analysis published in November 2025 argued that the Russia-Ukraine war demonstrated the strategic effectiveness of sustained offensive cyber tempo and the militarization of non-state actors, challenging Western preferences for legally constrained 'responsible' cyber behavior.
After initially not integrating hacktivists and often relying on purported 'fake hacktivist' personas, Russia later reportedly adopted a model closer to Ukraine's, including battlefield-relevant intrusions attributed to KillNet.
Ukrainian government statistics cited in the reference indicate that since 2022, high-severity Russian cyber incidents against Ukraine have dropped sharply even as the total number of incidents increased.
Russia's full-scale invasion of Ukraine began, creating the wartime context in which both countries' cyber operations and related targeting patterns evolved.
As the conflict progressed, Russia's cyber activity reportedly moved away from the most severe disruptive incidents and toward intelligence gathering and targeting more directly relevant to the war theater.
During the war, Ukraine appears to have targeted a wide range of Russian civilian and government digital assets while partnering with domestic hacktivists and international volunteers, with public acknowledgments and awards from Ukrainian military and intelligence bodies.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple nation-state actors, including China, Russia, Iran, and North Korea, are intensifying cyber operations targeting critical infrastructure, government entities, and private sector organizations worldwide. China-linked groups such as Ink Dragon have expanded espionage campaigns against European governments, while Russia-linked actors like Callisto have targeted NGOs and are implicated in disruptive attacks in Europe. Iran's MuddyWater has focused on critical infrastructure in Israel and Egypt, and North Korea is increasing disruptive attacks on various sectors. These activities are accompanied by sophisticated cybercrime campaigns, exploitation of zero-day vulnerabilities, and significant data breaches affecting sectors such as health, telecommunications, and justice. In response, Western governments and institutions are taking legal and policy actions, including EU sanctions and fines, UK and Polish legal proceedings against Russian actors, and increased attribution of attacks to state-sponsored groups. However, there is growing concern that U.S. cyber defenses are lagging behind adversaries, with strained mission capacity, weakened public-private collaboration, and unstable federal leadership. Experts call for renewed strategic focus, improved coordination with allies, and robust policy reforms to counter the persistent and evolving threat landscape posed by hostile nation-states.
Jun 29, 2026
Geopolitical tensions among major powers such as Russia, China, Iran, and North Korea are increasingly shaping the global cyber threat landscape, with organizations facing heightened risks due to shifting international relations, sanctions, and state-sponsored cyber activity. Businesses are now part of interconnected global ecosystems, where political developments can rapidly alter their exposure to cyber threats, necessitating the integration of geopolitical intelligence into cybersecurity risk assessments and operational decision-making. In response to these evolving threats, NATO conducts annual large-scale cyber defense exercises, such as Cyber Coalition, to train and test the coordination of military cybersecurity personnel from member and partner nations. These exercises simulate hybrid cyberattacks on critical infrastructure in fictional scenarios that mirror real-world geopolitical conflicts, emphasizing the importance of international collaboration and information sharing to defend against sophisticated, state-aligned cyber adversaries.
Jun 29, 2026
A new paper from the German think tank Interface proposes a framework to define when peacetime state cyber operations become irresponsible, aiming to clarify the threshold at which such activities cross into unacceptable territory. The paper introduces seven principles-based "red flags" to help states identify and respond to reckless cyber behavior, with particular emphasis on the risks of losing operational control—either technically, as seen in incidents like NotPetya and WannaCry, or organizationally, where command over the operation is lost. The analysis suggests that while states may not be swayed by international norms alone, the potential for political fallout and retaliation remains a significant deterrent. The framework is intended to empower victim states to more effectively call out and respond to irresponsible cyber actions. The paper highlights the growing complexity of cyber operations, especially with the advent of AI-driven tools, which could increase the risk of unintended consequences. By providing concrete examples and criteria, the think tank seeks to foster more responsible state behavior in cyberspace, even as the effectiveness of such guidelines depends on the willingness of states to internalize and act upon them.
Jun 29, 2026