Cyberwarfare by Russia

Cyberwarfare by Russia comprises denial-of-service campaigns, hacking operations, disinformation programs, and state-directed online repression, including participation of state-sponsored teams in political blogs, internet surveillance using SORM technology, and other active measures, executed by Russian security and intelligence agencies since the 1990s to advance Kremlin geopolitical objectives.

Russian doctrine frames these operations within an informatsionnoye protivoborstvo (IPb), or information confrontation, approach that fuses technical network actions with psychological measures. Units of the GRU, FSB, and SVR oversee hacker collectives such as APT28, APT29, Sandworm, Turla, and Star Blizzard that target governments, infrastructure, and civil society across Europe, North America, and Asia.

Prominent operations include the 2007 distributed denial-of-service attacks on Estonia, cyber strikes that accompanied the 2008 war with Georgia, sustained intrusions into Ukrainian elections and power grids, and the 2017 NotPetya malware campaign that caused global financial losses, while the campaigns also targeted democratic contests in the United States, Germany, and across the European Union and sustained covert influence networks such as Voice of Europe.

International responses range from sanctions and coordinated attribution statements to the creation of NATO's Cooperative Cyber Defence Centre of Excellence in Tallinn and joint action following the Viasat attack during the 2022 invasion of Ukraine.