Cyberwar: how Ukraine became a "global laboratory" new digital weapons and…

CYBERGUERRE SERIES. Since the Russian invasion of 2022, Ukraine has been the scene of fighting of rare intensity. But the battlefield is not limited to the front lines: it also extends to cyberspace. A real cyberwar is being played out there, discreet but strategic, where digital attacks and military operations respond and reinforce each other.

“You can’t win a war with cyber, but you can lose it by ignoring it.†. On February 24, 2022, around 6 a.m., Russian armed forces crossed the Ukrainian border. Explosions were quickly reported in kyiv, Kharkiv, Odessa and Donbass. In the first hours of the invasion, strikes focused on military infrastructure: artillery, ammunition depots and anti-aircraft defense systems were targeted in order to disrupt the Ukrainian response capacity.

This conflict, widely documented by the press and researchers, is today also studied in armed forces around the world. But this war is not limited to the physical terrain. Very quickly, another offensive unfolds, more discreet but just as strategic: that of cyberspace. Ukrainian computer systems in turn become priority targets. Satellite communications were quickly disrupted, particularly the KA-SAT network, widely used by the army and authorities for command and operational exchanges.

At the same time, “wiper” malware, designed to erase or make data unusable, is hitting several government sites. Media outlets such as the Kyiv Post were also targeted, while, in the days that followed, critical infrastructures, border crossings, financial services, telecommunications, were in turn affected, sometimes to the point of rendering the systems completely inoperable.

“What the war in Ukraine shows, particularly 2022, is that we have entered a form of cyberwar. We observe it through Russian operations, but also Ukrainian operations,” explains Marie-Gabrielle Bertran, researcher at the interdisciplinary center on strategic issues (CIENS) of the ENS-PSL and doctor in geopolitics. “The difference today is that digital tools produce concrete, so-called ‘kinetic’ effects: we are no longer limited to disrupting, we can destroy equipment, with potentially lethal consequences. From the moment these effects exist, we can speak of a separate war whole”.

“This involves methodical coordination between cyberattacks and conventional military strikes,†explains Arnault Barichella, associate researcher at the Jacques Delors Institute specializing in cybersecurity and digital technologies, also teaching at Sciences Po. “for example, before attacking a city, the Russian army has often launched vast campaigns of cyberattacks in order to destabilize critical infrastructure or a specific strategic position. This makes it possible to weaken the opponent before launching conventional strikes, adds the expert.

The Russian invasion is thus based, at least in part, on a cyber strategy that revolves around three distinct, sometimes coordinated axes: destructive cyberattacks in Ukraine, penetration and spying operations on networks outside Ukrainian territory, and cyber-influence operations targeting audiences on a global scale. However, regarding the more offensive aspects, “despite large-scale attacks, Russia has not managed to completely destabilize Ukraine on the cyber level as it had hoped”, notes Arnault Barichella.

Ukrainian response

But, as in the somewhat more traditional military domain, the Ukrainian reaction was not long in coming. For Arnault Barichella, “Russia was very surprised by Ukraine’s level of preparation in the cyber field. And since the start of the war, the country has only strengthened its capabilities.” From the first phases of the conflict, kyiv structured a rapid and organized response, integrating both state actors and volunteers. Among them, the IT Army of Ukraine, created in 2022 at the initiative of Mykhailo Fedorov’s Ministry of Digital Transformation, plays a central role.

This group carries out various cyberattacks, including DDoS operations aimed at saturating and blocking essential services in Russia (banks, administrations, public services), but also intrusions and data leaks targeting ministries or military logistics structures. In other cases, critical infrastructure has been targeted, such as airlines, with massive disruptions and flight cancellations in 2025. This war therefore also affects the rear, far from armed combat.

An infantryman or a tank is stopped on the front line, a missile or a drone can strike further, but a computer virus can spread almost anywhere, without physical borders. “Another striking element is that this cyberwar is not limited to the traditional battlefield. It blurs the border between the front and the rear. Civilian systems become targets, and civilians themselves can become actors in the conflict,” explains Marie-Gabrielle Bertran.

An ancient story

Since the first days of the conflict, the cyber dimension has been at the heart of the issues, or at least occupies an essential place. But this digital confrontation between Moscow and kyiv does not date from 2022. It is in reality part of a longer time frame, well before the Russian invasion of 2022. Since 2014, well before the invasion of 2022, Ukraine is already engaged in an invisible war with Russia following the annexation of Crimea, the first cyberattacks target institutions, media and electoral processes, with a clear objective: to politically destabilize the country and weaken its institutions.

This phase marks the emergence of a hybrid strategy mixing disinformation, digital intrusions and military pressure. Very quickly, the conflict takes on a more offensive dimension. In December 2015, a cyberattack caused a power outage for nearly 230,000 Ukrainians, a world first attributed to hackers linked to the Russian state. The following year, new attacks again targeted the energy network. This rise in power culminated in 2017 with NotPetya, a destructive malware originating from Ukraine which paralyzed administrations, banks and businesses before spreading globally, causing billions of dollars in damage.

It is therefore not a question of a new digital confrontation born in 2022 between the two states, but rather of the extension, more intense and more destructive, of a series of attacks and tensions which have accumulated over the last decade. But cyberspace has no borders… and attacks there frequently overflow from their initial target, like a shell crossing a border during a classic conflict. This spread can be explained by the very nature of digital technology: globally interconnected networks, viruses capable of spreading automatically and companies using the same software everywhere.

A “cyber war”, without borders

As a result, an attack designed for one country can quickly produce effects on an international scale. The most notable case remains that of NotPetya, mentioned above. Initially directed against Ukraine, this cyberattack spread via software before affecting more than 60 countries and numerous companies around the world.

As Marie-Gabrielle Bertran points out, “this war also goes beyond geographic borders. Cyber ​​attacks are difficult to contain and cause collateral effects.”

She cites in particular an attack against a satellite system used by Ukraine, belonging to an American company, which had repercussions as far as Germany, where wind turbines were taken out of service, illustrating a global, diffuse and still partly experimental cyber war. “A certain number of the cyberattacks that were launched on Ukraine have also spread to EU member states, particularly those that border us like Romania or Poland,” confirms Arnault Barichella.

“Once the virus has been able to penetrate the European network, it can spread to other member states,” the researcher finally adds. What we must remember about this war, particularly in its digital dimension, is first of all its scale. Every year, the figures explode: in 2024, 4,315 cyberattacks have been recorded, an increase of 70% compared to 2023. This intensity also translates into a form of excess: hundreds, even thousands of hackers operate in each camp, mobilized in cyberspace with objectives clear, such as espionage, sabotage and rear-end disorganization.

This quite possibly makes it the most intense cyber conflict in modern history. But this war is also a real laboratory. Strategies, tools and capabilities are tested in real conditions. As Vice-Admiral Arnaud Coustillière, former commander of the French armies’ cyber defense, recalls, interviewed by BFM Tech: “We don’t win a war with cyber, but we can lose it by ignoring it.” A way of emphasizing that, if cyber does not replace traditional conflicts, it is now an essential and essential component.