Lessons for Building Resilience Against State-Sponsored Cyber Aggression

In modern warfare, cyberattacks have grown from isolated disruptions to pivotal operations capable of paralyzing nations.

The rapid adoption of new technologies has introduced new vulnerabilities and threats, targeting military systems, critical infrastructure, and civilian networks.

As cyber aggression grows more sophisticated, so must the defense strategies employed to counter it.

Nearly 60% of organizations report that geopolitical tensions have influenced their cybersecurity strategies, according to the WEF Global Cybersecurity Outlook 2025.

These challenges become even more complex during active warfare, as seen in Ukraine during Russia’s full-scale invasion.

On the first day of the invasion, just hours before Russian tanks began rolling into Ukraine, Russian hackers attacked the Viasat satellite communications system, which was used by the Ukrainian Armed Forces.

Later, the head of the UK’s National Cyber Security Centre described this as “likely the longest and most intense cyber campaign in history.” However, Jeremy Fleming, the head of the UK Government Communications Headquarters, praised Ukraine’s response as “possibly the most effective in the history of cyber defense.”

To this day, cyberattacks on Ukraine remain closely linked to kinetic operations on the battlefield.

Russian forces consistently employ a strategy of launching cyberattacks as precursors to missile strikes – a pattern recognized by Ukraine’s Ministry of Energy as a recurring tactic.

These cyber offensives target both military units and critical infrastructure, such as power plants, communication networks, and other essential systems, aiming to disrupt communications, spread panic and weaken resistance of the society.

These threats have already crossed borders.

In the final week of 2024, both France and Italy fell victim to Russian cyberattacks.

The websites of several French cities were taken offline after being targeted by NoName, a Russian hacking group that claimed responsibility, describing the attacks as retaliation for France’s support of Ukraine.

The same group targeted approximately ten official websites in Italy, including those of the Foreign Ministry and Milan’s two airports, temporarily disrupting their operations.

Cyberattacks on military objects usually do not go public, but also happen worldwide. In September 2024, FBI and other US security agencies warned that military hackers affiliated with the Russian General Staff Main Intelligence Directorate 161st Specialist

Training Center, also known as Unit 29155, have been targeting critical infrastructure in the United States and at least 25 more NATO member states since 2020.

The main focus of these attacks over the last two years has been aimed at the Ukraine war with efforts to disrupt aid provisions as a primary objective.

In commerce, the primary goal of cyberattacks is financial gain, with data breaches costing victim organizations an average of $4.88 million, according to the IBM Report 2024.

However, the stakes are vastly different when it comes to critical infrastructure and the military.

These attacks cost human lives.

When the stakes are this high, incident response speed is crucial.

In critical situations, people rely on their instincts rather than memory and instructions, similar to soldiers on a battlefield.

This insight has been a key learning for Ukrainian cyber forces during the war: in modern warfare, drills for cyber incident response teams should closely mirror real-world scenarios to develop the necessary muscle memory.

To prepare for high-stakes situations, specific war-tested approaches have been designed by Ukrainian state cyber forces.

Trainings like TRYZUB replicate tactics used by Russian state-affiliated threat actors, enhancing the ability of teams to cope with the stress under the pressure and improve response capabilities.

The recent few years show that no country is immune to state-sponsored cyber aggression.

Russian state-affiliated hacker groups like Sandworm, which have been targeting Ukrainian military and critical infrastructure for decades, were recently mentioned as a severe threat for the UK.

These threats have escalated amid geopolitical tensions, targeting critical infrastructure, governmental and defense organizations, and supply chains.

Close relationships with Allies and experience sharing can significantly increase global cyber resilience.

Currently, Ukraine is engaged in the first-ever cyberwar, offering lessons learned through hard experiences.

Adversary emulation exercises cultivate this essential readiness, ensuring that cybersecurity teams can operate under pressure and adapt to evolving threats.

Fostering cross-border collaboration and continuous sharing of knowledge along with hands-on simulation-based experience results in joint resilience, guaranteeing resistance against the most advanced threats.

This, in turn, leads to a more stable and resilient society, ensuring that armed forces and critical infrastructure are safeguarded.

Author:

Dr. Almerindo Graziano, CEO of CYBER RANGES, co-chair of the European Cyber Security Organisation, and a certified cybersecurity expert with over 20 years of experience.