Loading story…
Ukraine’s parliament approved a major government reshuffle that includes appointing Mykhailo Fedorov—formerly minister of digital transformation—as the new defense minister, with a mandate to modernize the armed forces through technology. Fedorov has been closely associated with Ukraine’s wartime digitization efforts and initiatives such as the “Army of Drones,” and he publicly emphasized expanding cyber operations against Russia and countering Russian information operations, alongside plans to apply AI to anticipate and disrupt attacks and to accelerate domestic production of advanced munitions.
In parallel, parliament voted to dismiss Vasyl Maliuk as head of the Security Service of Ukraine (SBU) as part of broader leadership rotation across law-enforcement and defense institutions ordered by President Volodymyr Zelensky. Maliuk said he would remain within the agency to continue operations against Russia; his tenure included high-profile drone and maritime-drone operations (including the “Spider Web” strikes and use of Sea Baby naval drones). Reporting indicated Yevhenii Khmara (SBU Alpha unit) would serve as acting chief, and the shake-up was framed by Zelensky as a precautionary move to sustain Ukraine’s defense if the war continues.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Following Fedorov’s move to the defense ministry, Oleksandr Borniakov was designated to temporarily assume his responsibilities at the Ministry of Digital Transformation. The handover was part of the broader leadership reorganization.
Ukraine’s parliament appointed former digital transformation minister Mykhailo Fedorov as the new defense chief. He presented a reform agenda focused on military modernization, anti-corruption, frontline infrastructure, and expanded cyber and technology capabilities against Russia.
Ukraine’s parliament voted to dismiss the SBU chief and approved several other senior resignations as part of the reshuffle. The changes also included major cabinet and intelligence moves, with additional appointments expected the following day.
Vasyl Maliuk said he would resign as head of the Security Service of Ukraine while remaining within the agency. His departure followed his tenure overseeing notable wartime operations, including the “Spider Web” drone strikes and Sea Baby naval drone deployments.
President Volodymyr Zelensky launched a major reshuffle of Ukraine’s law-enforcement, intelligence, and defense leadership, framing it as a precautionary rotation and overhaul to bring in “fresh forces” if the war continues. Ukrainian media reported the move included pressure for senior resignations and plans for further appointments.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ukraine's parliament has taken a significant step toward consolidating the nation's cyber capabilities by approving, in a first reading, legislation to create a dedicated Cyber Force within the Armed Forces. The proposed Cyber Force would unify both offensive and defensive cyber operations under a single command, reporting directly to Commander-in-Chief Oleksandr Syrskyi. This new branch would be responsible for conducting military cyber operations, digital defense, intelligence gathering, threat hunting, and building secure military infrastructure. The initiative is designed to align Ukraine's cyber defense posture with NATO standards, a move seen as critical as the country continues to seek closer ties with the alliance. The bill also introduces the concept of a cyber reserve, allowing civilian technology experts to be temporarily mobilized to support military cyber operations without requiring them to become full-time service members. This approach is expected to strengthen collaboration between Ukraine's robust tech sector and its military, a relationship that has already seen some cybersecurity professionals volunteering their expertise. The government plans to allocate 14 million hryvnias (approximately $336,000) in 2025 to establish the new branch. While the initiative has been welcomed by many in the cybersecurity community, some lawmakers, such as Oleksandr Fediyenko, chair of the parliament's cybersecurity subcommittee, have expressed concerns that merging offensive and defensive roles could create operational confusion. The idea for a dedicated Cyber Force was first discussed in 2021, but only now has it gained significant legislative traction. If the bill passes a second parliamentary vote and receives presidential approval, Ukraine will, for the first time, have a formal military structure for cyber operations. This development comes against the backdrop of ongoing cyber conflict with Russia, where Ukraine has relied on both volunteer hacktivists and official military intelligence units for cyber operations. The formalization of a Cyber Force is expected to enhance Ukraine's ability to defend its military systems and conduct coordinated cyber campaigns. The move is also seen as a way to institutionalize lessons learned from the war and to ensure that Ukraine's cyber capabilities are both resilient and adaptable. The establishment of a cyber reserve is particularly notable, as it provides a mechanism for rapid mobilization of technical expertise in times of crisis. The bill's progress reflects Ukraine's recognition of cyberspace as a critical domain of modern warfare. The proposed Cyber Force would also be tasked with building and maintaining secure digital infrastructure for the Armed Forces, further strengthening national security. The legislation awaits a second reading in parliament and subsequent presidential approval before it can be enacted. If successful, Ukraine's Cyber Force could serve as a model for other nations seeking to integrate civilian cyber talent into military operations. The initiative underscores the increasing importance of cyber capabilities in national defense strategies worldwide.
Jun 29, 2026
Russian cyber operations targeting Ukraine have escalated in sophistication, with Ukrainian authorities reporting a significant increase in the use of artificial intelligence (AI) by Russian threat actors in the first half of 2025. According to Ukraine’s State Service for Special Communications and Information Protection (SSSCIP) and the Computer Emergency Response Team of Ukraine (CERT-UA), over 3,000 cyber incidents were recorded during this period, marking a 20% rise compared to the same timeframe in the previous year. The adoption of AI has enabled Russian hackers to automate the creation of phishing messages and, more notably, to generate malicious code, including PowerShell-based malware. One prominent example is the WRECKSTEEL malware, attributed to the cyberespionage group UAC-0219, which was reportedly developed using AI tools and deployed against state administration bodies and critical infrastructure. Other Russian groups, such as UAC-0218, UAC-0226, and UAC-0227, have orchestrated phishing campaigns targeting Ukraine’s defense forces, local authorities, and organizations involved in defense innovation, using AI to craft convincing lures and deliver various stealer malware families like HOMESTEEL, GIFTEDCROOK, Amatera Stealer, and Strela Stealer. CERT-UA’s analysis indicates that as traditional phishing becomes less effective due to improved user awareness and defensive measures, Russian actors are shifting toward more transient, high-velocity attacks, described as the “Steal & Go” model, where data is exfiltrated quickly before infrastructure is taken down. The increased use of AI is also a response to Ukraine’s enhanced detection capabilities and international cooperation with cloud providers, which have forced attackers to reduce dwell time and adapt their tactics. Despite the rise in overall incidents, the number of high-impact attacks has declined, suggesting that Ukraine’s cyber defenses are becoming more effective at mitigating the most damaging threats. The Ukrainian government warns that the integration of AI into Russian cyber operations represents a new level of threat, with attackers likely to continue innovating in both malware development and social engineering. The ongoing cyber conflict underscores the importance of continuous improvement in defensive technologies and international collaboration to counter rapidly evolving adversarial tactics. Ukrainian authorities emphasize vigilance, as the use of AI in cyberattacks is expected to expand further, potentially enabling more sophisticated and harder-to-detect campaigns. The focus on targeting military, governmental, and critical infrastructure entities highlights the strategic intent behind these operations, aiming to disrupt Ukraine’s defense and administrative capabilities. The shift in Russian tactics also reflects broader trends in cyber warfare, where automation and AI are increasingly leveraged to overcome improved security postures. Ukrainian agencies continue to monitor and analyze these developments, sharing intelligence with partners to bolster collective resilience. The reports from SSSCIP and CERT-UA serve as a warning to other nations about the accelerating integration of AI into state-sponsored cyber operations. The Ukrainian experience demonstrates both the challenges and the necessity of adapting to adversaries who rapidly incorporate emerging technologies into their attack methodologies. As the conflict persists, the cyber domain remains a critical front, with AI-driven threats poised to play an ever-larger role in shaping the security landscape.
Jun 29, 2026
U.S. Cyber Command’s Cyber National Mission Force (CNMF) removed Air Force Lt. Col. **Jason Gargan**, a joint task force commander focused on operations against **Russia**, after he was “relieved for cause” following disagreements over operations with CNMF leadership, according to people familiar with the matter. Gargan was reassigned elsewhere within CNMF and is expected to retire by the end of 2026; the move was described as unusual for CNMF, where underperforming leaders are typically rotated rather than dismissed. The personnel action occurred amid broader senior-level churn at Cyber Command, which has reportedly been without a Senate-confirmed leader for an extended period, and as CNMF chief Maj. Gen. **Lorna Mahlock** was nominated to become Cyber Command’s next deputy chief. Separately, the **National Security Agency (NSA)** appointed intelligence community veteran **Timothy Kosiba** as deputy director with presidential approval. Reporting highlighted Kosiba’s background in network warfare and offensive cyber roles (including **Tailored Access Operations**-linked positions) and senior leadership posts supporting foreign signals intelligence and cybersecurity missions; Acting NSA and Cyber Command head **William Hartman** publicly endorsed the appointment as supporting NSA’s mission execution.
Jun 29, 2026