Russian Offensive Cyber Operations: Analyzing Putin's Foreign Policy Actions

"According to the report, Putin considers offensive cyber operations (including but not limited to deploying malware) to be "effective way to augment Russia's military operations in Ukraine, degrade supply lines from NATO states to Ukraine, and gain insight into NATO and Ukrainian plans and intentions." The report goes on to cite examples, such as: WhisperGate: In January 2022, a wiper malware known as WhisperGate was launched by GRU Unit 29155. This overwrote data on Ukrainian government systems. Kyivstar Telecom attack: In December 2023, a Russian APT group (Sandworm) disrupted internet and mobile services in Ukraine. Furthermore, Putin's offensive cyber strategy has included targeting NATO states, presumably to disturb supply chains to Ukraine."

"The report also discussed Russian hacktivism initiatives, which it described as "low-sophistication hacktivist attacks." While Putin does not outright direct pro-Russia hacktivism, it is suggested he enables it because it voices Russia's discontent with adversaries in a deniable, low-risk manner. These actions have increased since Russia's invasion of Ukraine in February 2022 and often target adversaries after actions that appear to undermine Russian interests. An example cited in the report is the joint attack launched by hacktivist entities NoName057(16) and the Russian Cyber Army against the Japanese gover"

Putin's foreign policy toolkit includes undermining international institutions, permitting hacktivist activity, ordering cyberattacks or influence operations, directing sabotage or kinetic military operations, and determining the use of nuclear weapons. Offensive cyber operations are used to augment military operations in Ukraine, degrade NATO-to-Ukraine supply lines, and gain intelligence on NATO and Ukrainian plans. Notable incidents include WhisperGate, a January 2022 wiper attributed to GRU Unit 29155, and the December 2023 Kyivstar Telecom disruption attributed to Sandworm. Russia enables low-sophistication hacktivist attacks for deniable, low-risk pressure, often targeting adversaries after perceived anti-Russian actions. These approaches increase risks to supply chains and critical infrastructure defenders.

Read at Securitymagazine