How Cyber Operations Are Reshaping Geopolitical Conflict
Summary
An analysis of cyber operations as support for geopolitical and kinetic conflict, using Venezuela, Iran, Ukraine and Taiwan to argue that espionage, disruption and pre-positioning can shape military action but have not independently secured kinetic victories.
Key points
- The article argues that nation-state cyber operations can prepare for, support or hasten kinetic military action, but have not independently secured a kinetic victory.
- Dmitri Alperovitch describes state espionage as typically stealthy and long-running, and says unusual cyber intrusions helped signal Russia’s preparations for its 2022 invasion of Ukraine.
- The article says cyber activity around the 2026 Venezuela operation may have included pre-operation intelligence gathering; possible support for a power blackout is described as unproven.
- It describes cyber operations as part of the US-Israeli campaign against Iran, including reported radar-grid degradation and psychological operations, while noting that the conflict continued.
- For Ukraine, the article cites WhisperGate, HermeticWiper, IsaacWiper and the Viasat KA-SAT disruption as cyber activity accompanying Russia’s invasion.
- The article presents Volt Typhoon’s reported access to US critical infrastructure as possible pre-positioning for disruption during a future crisis involving Taiwan; it describes the purpose as uncertain.
Article Details
- Topic
- How cyber operations support geopolitical and kinetic military objectives, with examples involving Venezuela, Iran, Ukraine, and Taiwan.
MITRE ATT&CK
T1485 · Data DestructionHermeticWiper and IsaacWiper were used in attacks that struck systems and targeted government networks in Ukraine.T1491.002 · External DefacementUkrainian government websites were defaced using WhisperGate before the 2022 invasion.T1498 · Network Denial of ServiceRussian cyber activity included DDoS attacks against Ukrainian government websites, news outlets, and social media.
People
Dan CaineChairman of the Joint Chiefs of Staff who mentioned Cyber Command among the effects leading up to the US operation in Venezuela.Dmitri AlperovitchGeopolitics and cyberspace expert interviewed for the article; he described cyber intrusions into Ukrainian systems as a warning sign before the 2022 invasion.
Threat Actors
APT28The article describes long-running Russian cyber campaigns by APT28, identified as GRU Unit 26165; it also uses Fancy Bear as an alternate name for APT28.Fancy BearThe article uses Fancy Bear as an alternate name for APT28 and describes its long-running Russian cyber campaigns related to Ukraine.FSBUkraine attributed the Operation Armageddon cyber espionage campaign targeting Ukrainian government, law enforcement, and defense agencies to the FSB; the article also describes Gamaredon as FSB-linked.GamaredonThe article describes long-running cyber campaigns by Gamaredon and characterizes the group as FSB-linked.SandwormThe article describes long-running cyber campaigns by Sandworm, identified as GRU Unit 74455, in the context of Russian activity related to Ukraine.TurlaThe article identifies Turla as the APT group that developed and distributed Snake and Uroburos against Ukrainian government systems.Volt TyphoonThe article describes Volt Typhoon as conducting long-term cyber pre-positioning in critical infrastructure sectors, including communications, energy, transportation, and water.
Malware
HermeticWiperHermeticWiper struck hundreds of systems across Ukrainian financial, defense, aviation, and IT sectors.IsaacWiperA second wiper (IsaacWiper) targeted government networks.SnakeRussian malware, including Snake and Uroburos (closely related malware) that was developed and distributed by the Turla APT group, was used against Ukrainian government systems.UroburosRussian malware, including Snake and Uroburos (closely related malware) that was developed and distributed by the Turla APT group, was used against Ukrainian government systems.WhisperGateUkrainian government websites were defaced using WhisperGate.
Vendors
Products
Countries
ChinaThe East is primarily China, Russia, Iran and North Korea (CRINK for short).IranThe East is primarily China, Russia, Iran and North Korea (CRINK for short).North KoreaThe East is primarily China, Russia, Iran and North Korea (CRINK for short).RussiaThe East is primarily China, Russia, Iran and North Korea (CRINK for short).TaiwanThere are two recent examples of attempted regime change (Venezuela and Iran), and two examples of territorial disputes: Russia with Ukraine, and China with Taiwan.UkraineThere are two recent examples of attempted regime change (Venezuela and Iran), and two examples of territorial disputes: Russia with Ukraine, and China with Taiwan.VenezuelaThere are two recent examples of attempted regime change (Venezuela and Iran), and two examples of territorial disputes: Russia with Ukraine, and China with Taiwan.
Industries
AviationHermeticWiper struck hundreds of systems across Ukrainian financial, defense, aviation, and IT sectors.DefenseIn the US, Cyber Command was ordered by Secretary of Defense Robert Gates in 2009 and became operational within Strategic Command in 2010 before becoming an independent unified combatant command in 2018.EnergyIt has been operating for years, quietly embedding itself inside utility sectors, including communications, energy, transportation, and water systems.GovernmentPsychological cyber operations were used to deliver anti-regime messaging and normal state media, government communication lines, and public apps were all targeted, hoping that the Iranian people would rise up againstTelecommunicationsAs the kinetic invasion began, Russian special forces and cyber units raided Crimean telecommunications centers and cut communication between Crimea and mainland Ukraine, disrupted government phones, and DDoSedTransportationIt has been operating for years, quietly embedding itself inside utility sectors, including communications, energy, transportation, and water systems.