National Cyber Security Centre
Printable version

New analysis highlights strength of Ukraine's defence against “unprecedented” Russian offensive

Report from the European Cyber Conflict Research Initiative (ECCRI) gives new insights into the role of cyber criminals and political hacktivists in a conflict, and critical questions around industry support to Ukraine's cyber resilience.

  • NCSC-commissioned report from European Cyber Conflict Research Initiative (ECCRI) shines light on the dynamics of the digital battlefield in Russia-Ukraine conflict
  • Independent insights into cyber operations reveal “unprecedented” evolution in scale and pace of Russia’s activity
  • Ukraine nonetheless proved masterful in withstanding hostility through bolstered cyber defences, demonstrating the importance of resilient systems

EXPERTS have highlighted the “unprecedented” dynamics of Russian wartime cyber operations and the strength of Ukraine’s resilience in a new report into the conflict published today (Thursday).

In a detailed analysis of the cyber security dimensions of the Russia-Ukraine conflict, researchers noted the high operational tempo Russia has maintained – with the GRU taking a leading role – but also the “incredible resilience and determination” of the Ukrainian response.

The wide-ranging report offers new insights into the role of cyber criminals and political hacktivists in a conflict, and critical questions around industry support to Ukraine's cyber resilience.

The findings are contained in The Cyber Dimensions of the Russia-Ukraine War, a report from the European Cyber Conflict Research Initiative (ECCRI) which was commissioned by the National Cyber Security Centre (NCSC).

It was published on the second day of CYBERUK, the UK’s flagship cyber security conference, which this year focuses on the theme of ‘securing an open and resilient digital future.’

Discussion of the Ukraine conflict will feature prominently on day two of the conference, beginning with a panel entitled ‘Three Rs of cyber security: Russia, ransomware and resilience.’

ECCRI’s report is based on a workshop held by members earlier this year. It found that “while Russian forces may not have been well-prepared before the invasion began, they have acted with remarkable speed and flexibility since, sustaining an unprecedented operational tempo in Ukraine.”

It also reflected on the “incredible resilience and determination” of the Ukrainian response, and the “remarkable network of support from the West” it has managed to sustain. The power of Ukraine’s resilient systems, the report said, has enabled it to withstand the barrage of cyber attacks from Russia, from distributed denial-of-service attacks (DDoS) and cyber effects operations to disinformation and data weaponization.

Looking to the future, however, the experts stressed that “lessons learned from Ukraine may not be easily applied to other conflict situations”, given Ukraine’s very particular geography among other reasons.

Paul Chichester, NCSC Director of Operations, said:

“We are very grateful to ECCRI for this important and valuable analysis of the cyber dimensions of the Russia-Ukraine conflict to date.

“The report offers a range of helpful insights, not least around what Ukraine has taught us about the power of resilient systems in the face of sustained cyber attacks.

“As we look to the future during our CYBERUK conference, this is a timely contribution to the debate on what we can learn from the conflict, as well as the limits to our current understanding.”

Security Minister Tom Tugendhat said:

"Putin’s illegal war isn’t just being fought on the ground. Ukraine’s protectors are also defending their country against unprecedented cyber-attacks on a digital battlefield.

"This report has shone an important spotlight on a different kind of hostility which the Ukrainians have responded to with exceptional resilience and determination.

"We must carefully assess its findings and learn the lessons it has to offer."

Further reflections from the report include:

  • Distinguishing between political activity and cyber criminal groups is becoming increasingly difficult;
  • Strong cyber resilience and cyber defences count for much more in cyberspace;
  • The technology industry’s role is changing to become increasingly strategic players in geopolitics.

On the subject of industry support in Ukraine’s cyber resilience, the report asks important questions of sustainability, coordination, and expectations of the private sector in conflicts more broadly.

Experts noted that the cyber-criminal landscape is becoming increasingly fractured and politicised, whilst non-state actors including hacktivists set concerning precedents that risk escalation or collateral damage.

The ECCRI event on which the report is based included contributions from cyber threat intelligence practitioners, academics, and officials from key governments and international institutions.

This report builds upon a previous report by ECCRI on wartime cyber operations in Ukraine, based on a closed-door workshop held in Tallinn in May 2022, just three months after the full-scale invasion of Ukraine.

The ECCRI report can be accessed in full from the ECCRI website.

Channel website:

Original article link:

Share this article

Latest News from
National Cyber Security Centre