Ukrainian conflict bulletin 1

Ukrainian Conflict Bulletin #1 28/02/2022 by Csaba Virág
1
Ukrainian Conflict Bulletin #1 – 28/02/2022
Authors’ note:
A lot has happened in the last 5 days since Russia started its invasion of Ukraine on the 24th February
2022. In my bulletin I aim to conclude and share the information what I have gathered either through
the support of the European Cyber Community or through my discussions with current and former
members of armed forces in Europe. As my main profession – raising cyber resilience for organizations
and nations to resist large scale cyber and hybrid incidents – requires me to holistically analyze the
impact of multiple events happening parallel, I will not only focus on the cyber space aspect, but overall.
For the strictly military movement timeline and events or ongoing fights there are many trustworthy
resources out there, hence I will not put focus on that. This is not a study, I will not provide links and
references. Many of the information you can simply search for, some or relying on personal discussions
with subject matter experts.
Finally, everything written here is reflecting my own personal view.

2
Strategical communication (STRATCOM)
Doing the quick retrospective, the strategical communication has been led by, successfully deceiving the
whole world. Even though there were raising voices from USA and Ukrainian representatives, Russia
managed to surprise the world by invading Ukraine. However, somehow Russia lost its STRATCOM
momentum almost immediately after the start of the attack by losing the narrative, and facing the
opposition and condemned of both the Western and Eastern world. Ever since Russia is trying to regain
its communication strength, certain pro-Russian narratives are making it to certain target groups,
especially in countries that have been under the Putin influence.
In the meantime, Ukrainian President, Zelenskyy gains momentum and solidarity of the world along with
the Ukrainian nation. Russian invasion of Ukraine gave the world the heroes everybody can relate to:
former business partner, beauty model, software developer, farmer, „average Joe-s and Jane-s” all
grabbing weapon and protecting their loved ones, their land and their freedom against the evil
occupiers.
Ukraine quickly grabbed the attention through delivering a firm and heroic leader, the videos released
about the heroic fights of the freedom fighters against the large and severely better equipped Russian
army, grabbing the rhetoric of fighting against the Ghost of Soviet Union. This rhetoric has been a call-
to-arms to everybody, the European and global collective memory remembers the Communist and
Soviet terror.
Meanwhile, as Russia claimed it is not an invasion, but a special military operation going on in Russia, it
cannot create its heroes and role models. Also, because of the lies delivered to the Russian audience,
Putin is facing a hard time explaining why the ruble plunged 40% and the National Bank of Russia had to
raise its interest rate to 20% from 9.5%.
The military successes of Ukraine are over the news, while Russia cannot brag with those. This lowers
Russian moral, raises Ukrainian strategic advantage in winning the STRATCOM battle.

3
Russian Forces’ moral seems to be low
Following the quick and sudden advances of the Russian Army on the first day, everybody got surprised
on the turn of events. Ukrainian forces managed to stop one of the world largest and best equipped
army, not only that: the Russian army seems not to be really capable. It is especially interesting if one
considers that for weeks everybody has read the analysis of how Russian army is bigger, better equipped
and better funded compared to Ukrainian forces.
According to my military sources, data exfiltrated from captured Russian soldiers’ handsets reveal, many
of these soldiers have been misled. Based on the messages exchanged with family members these
soldiers (many of them youngsters, with no combat experience), the soldiers were texting they are sent
to Belorussia on military exercise, then they were ordered to the Ukrainian border to perform border
patrol duties and suddenly they were told to go to Ukraine on a peacekeeping mission. There are
multiple different evidence on this, which partially explains why the Russian military moral has not been
into war fighting mode. The messages reveal surprise reactions from the solders not understanding why
people are hostile with them, why people are shooting at them, etc. There are multiple cases recorded
where Russian supply convoys have been captured by Ukrainian forces, as they were just driving without
armed escort, suggesting they indeed thought there is no danger awaiting them.
Certain military units were better prepared, especially in the Southern and Eastern area of Ukraine,
where the military advances had a different dynamics and strength. Yet, there are mixed reports on the
Russian Forces capabilities, it seems there is a very mixed capability deployed, from unexperienced
rookies to experienced and highly skilled tactical units.
For the first 24-36 hours Russian forces seemed to follow their typical doctrine, however the resistance
surprised them, and it seems there was no plan B to pivot to. Unexperienced an deceived soldiers
without supplies mixed with tactical units and lack of established supply chain. Logistics might be a
challenge as many Russian vehicles and troops require to be supplied with new resources in every 72
hours. There were multiple cases where Russian vehicles just simply run out of fuel due to the lack of
access to supplies and/or selling the fuel in Belarus. Anyone who remembers the ‘good old Soviet times’
this tells some things did not change in the last 50 years…
Looking at the timing of the negotiations that happened today between the Ukrainian and Russian
parties, might be an explanation why Russia has been pushing for it. It seems like Russia miscalculated
the capabilities of its own troops, the resistance of the Ukrainian Army and both the moral and financial
support Ukraine receives and continues to receive. The negotiations by the way did not lead to anything.
Along with the financial and material support, there is a growing “International Legion of the Territorial
Defense of Ukraine” unit summoning those with battlefield experience and wishing to help. Veterans
from Estonia, UK, Croatia, American, Germany and other nations join the battle on Ukrainian side.
Parallel with this there are news on Belarusian tactical units performing actions in Ukraine and missiles
have been shot from Belarus, targeting Ukrainian objects.
While the official Russian narrative remains “peacekeeping” mission, Russia cannot bomb or shell the
cities, mentioning nuclear capability is already an overkill and turning too much attention on the lack of
successes.

4
Russian Army seemed to go for a quick win, where the story of the highly capable and deterrent force
visiting a country should have brought enough detention not to resist. Even Russian soldiers remember
the Soviet tactics of using sheer number of humans as the cheapest resource to the Red Army, as
weapons cost time and money.
Electronic Warfare (EW)
Russian Army is infamously advanced at electronic warfare, jamming and spoofing electronic signals,
GNSS (Global Navigation Satellite System), etc. According to signaling and EW experts this capability has
not been really utilized according to the expectations so far. There are EW capabilities on ground,
however there are only a few available news on their usage. Ukrainian forces have the capability to
triangle active EW devices, hence the vehicles have to be constantly repositioned. With the front line
moving slowly this hinders the maximization of their tactical potential.
Radio amateurs are asked to collect info on planes (e.g. bomber planes) through intercepting -
unencrypted - radio communication.
Ukrainian forces need to be able to secure meshed networks, GNSS against jamming and spoofing, while
they need more access to SATCOM. Even though Elon Musk announced the access to Space links’
satellites, there were no news ever since if they are indeed accessible to Ukrainian forces. They also
need more GNSS jamming and spoofing capability as well, along with SIGINT and COMINT capability as it
seems Russian Forces are using unencrypted communication channels.
Cyber Electro-Magnetic Activities (CEMA)
The Russian Forces’ tactical cyber and EW units should have targeted these Ukrainian units under CEMA
operations in this priority:
• C2 / command + HQ (Command & Control)
• C5 ISR objects (Command, Control, Computers, Communications, Cyber, Intelligence,
Surveillance, and Reconnaissance)
• Air defense capacity
• Surface to air missiles complexes
• Storages, mobilization and formation centers
The activity should be constant and continuous however Russia has chosen to target these objects with
precision firing, in the first hours of the war with the 3M-54 (1300-2000+ kg), Kh-31/ AS-17 Krypton
guided missiles from the air, navy platforms and other missiles and rockets from the ground platforms.
Cyber space activities
Russian cyber operations against critical infrastructure and military targets have been constant and
started before the actual physical invasion. Blackouts and business disruptions happened while Russian
cyber operations carried out DDoS attacks and released disruptive malware on Ukrainian targets.
Ukraine received assistance from EU in the form of its Rapid Response Team unit (RRT) along with the
support of the cyber community.
Multiple private individuals, companies and organizations joined forced and formulate alliance to
distribute information, intelligence supporting Ukrainian cyber unit with cyber threat information and
open source intelligence (OSINT). This information includes IP addresses of attackers, malware and

5
related information, system vulnerabilities attacked along with the tools and tactics used for attacks
(TTX), leaked databases, relevant deep and dark web communication and potential cyber tactical
information. Actionable intelligence enables Ukrainian forces to deal with hardening defense capabilities
against attacks and to maintain their operations.
Short list of activities from the last days:
- Anonymous, cyber criminal groups and hacktivist groups join forces to attack Russian targets
- Multiple banks, energy and critical infrastructure providers are suffering outages, altogether
more than 300 organizations have been hacked, along with some industrial gas control systems.
- Sberbank has been hacked, due to significant withdrawals the stock price loses 68% of its value.
Russian citizens are trying to cash-out ATMs, but ATM systems are malfunctioning, and overall
bank card terminals are working unreliably.
- Anonymous announces it will publish the names of Russian agents, data stolen from Russian
government
- Russian national TV has been hacked broadcasting Ukrainian national anthem
- Military radio communication has been captured and broadcasted
- Actors successfully disrupted the Belarus train systems, disabling Russian (and Belarus) group
transports
- Hackers disrupted the public transportation payment system, tickets could not be purchased
- Attacks are constant and spreading. Anything that is connected to network will be potentially
hacked
- Several Ministry databases have been stolen and some of them already leaked containing
important personal and tactical information
To deliver such devastating attacks, actors mainly use existing vulnerabilities based on databases already
gathered over the last years, along with utilizing their very capable technical infrastructure to carry out
the attacks. Typical vulnerabilities are outdated and unpatched systems, default credentials,
unprotected systems, etc. Having access to internal documents and infrastructure knowledge from
previous campaigns is a huge benefit also, along with tested tools and procedures. There is no real
protection against such a united offensive capability as the global IT infrastructure is vulnerable by
default. Also, Russia never experienced such sever attacks before, usually Russia just delivered them. At
the same time Russia is active too in the cyber domain, US issued warning that US defense contractors
are facing high risk of being targeted by Russian state sponsored groups, so are the Western allies facing
increased attacks.
It is worth mentioning that criminally motivated cyber attacks continue to be executed while the world
is focusing on Ukraine. Under the shadow of the events Western companies are being hit by cyber-
attacks, like ransomware or DDoS attacks.
The rise of cyber partisans
It seems there is a so far unprecedented moment of global cyber partisans, where the world’s hacktivist,
hacker and offensive cyber capability turned against Russia and Belorussia. States and governments will
not officially intervene with their offensive capability publicly, but it seems civilian offensive capability
against Russian and Belorussian targets have been greenlighted (or at least not hindered) as part of the

6
global support to Ukraine and counterfeit Russian invasion. Military doctrines might change on how to
implement this capability into defensive campaigns.
There are multiple reports on collapsed Russian networks, inaccessible systems, shut down gas pipelines
and power plants, huge data leakages from large institutions and governmental organizations. So far
these attacks are focusing on mainly the critical infrastructure providers and some governmental
services, and not on actual operational military networks and services. Sources could not confirm if this
is because of those services being well protected compared to the capabilities of the cyber partisans or
the lack of situational awareness and coordination.
Hybrid warfare
While the STRATCOM, military and cyber activities are ongoing, Russia seems to lose its advantage in the
hybrid warfare operations. The usually supportive countries and partners are refraining to provide
public support to Putin’s war, or even worse they are condemning it and supporting sanctions.
Globally there have been several large petitions against the Russian invasion of Ukraine, while pro-
Russian supports became silent. In certain countries where the state media is controlled by pro-Putin
regime (like Belorussia and Hungary), pro-Russian narratives are leading the discussions and Russia
started to ban access to Western online resources to maintain the control over the information flow.
There are posts in several discussion groups of talking to Russian citizens not believing anything people
outside Russia telling them: there is no war, there are no bans and sanctions, Russians can fly to
wherever they want, and overall, they don’t understand and believe what is happening outside Russia.
Videos surfaced on the internet when during boarding, passengers are being told the flight is not going
to Egypt, but if they want to go on holidays they can go to some other destination, like Kazakhstan.
Russia’s state-run news channel on Saturday showed footage of a peaceful day in Kyiv to try to counter
the videos of violence spreading on the social network and Telegram.
Eventually creating and maintaining such an alternate reality will require significantly more resources
from Putin and Russia than I believe Russia is ready to pay for. Disconnecting North-Korea from the
external internet is an easier task, than to filter and control everything in a country of 144M people.
EU and allies joined forces immediately. While there might be disputes over which sanctions to apply
how, there is a consensus on aiding Ukrainian government in its quest of protecting its country’s
freedom. Even the infamously pro-Putin Orban regime in Hungary had to stand in the line.
I consider Russia’s biggest hack on the Western World the election of Trump and the Brexit, with
devastating effect on world dynamics and Western cooperation. The Ukrainian crisis however united the
allies in defending a European country against Russian oppression.
This unity might even lead to NATO developing and handing over the action plan of joining NATO to
Ukraine, a discussion not progressing for the last 15 years. Even Ukraine’s EU membership negotiations
got accelerated, the topic is back actively on the table, Ukrainian President signed the EU membership
application today. These processes will not happen overnight, however right now it seems at least they
will be dealt with in the near future.

7
Economic impact
Ukrainian economy suffers a devastating hit. Many industrial centers are on the East side of Ukraine and
not only do Russian Forces take hold some of these, there is no real production in the country at the
moment. The financial and other material support Ukraine receives from its allies is crucial for its
survival.
The first wave of economical sanctions did not affect Russian economy, however the following one did.
EU, USA and additional allied countries decided to freeze certain Russian assets, disconnect Russia banks
from the SWIFT banking system, making international money transfers complicated and costy. Ruble’s
value is quickly falling, the trading of Russian company’s shares have been suspended and the Russian
stock exchange did not even open. The Central Bank scrambled to deliver ruble bills as the demand for
cash spiked 58-fold. More inflation is foreseen, and the S&P credit rating agency downgraded Russia to
“junk” status.
War costs great deal of money itself. The daily cost of war is measured in several hundreds of millions of
USD for the Russian economy. There are numbers with billion tags around, however it is hard to decide
which includes purely the military operation related expenditure and the overall impact. Russian
economy is getting cut off from international (or at least the Western) markets and large-scale Russian
investments are endangered or cancelled (ongoing nuclear plant construction, North-Stream 2 pipeline,
just to mention a few).
Challenges for Ukraine
Situational awareness
Ukraine forces currently are challenged to maintain situational awareness. Their forces rely on
communication equipment and infrastructure that has been highly impacted by the physical disruption
of the Russian Forces.
C2 communication security/stability
The Command and Control communication security and stability has to be maintained. Again this ability
is largely impacted by the physical disruption and with the EW activities.
ISR capability
While being focused on defending against ongoing attacks and suffering losses to ISR equipment and
capabilities this is again another challenge to be resolved. Partially this can be provided by allied forced
IF the C2 communication is secured and stabilized. Today EU decided it will provide access to its satellite
visual feed, which is a huge strategic advantage for Ukraine.
Reconnaissance, surveillance, and target acquisition (RSTA)
NATO is providing assistance through JSTAR targeting data, previously only dispositions, at the same
time Ukrainian forces need secure coms on the ground for targeting. This combined with the satellite
images shall be sufficient to track and target Russian troop movements.
Air defense capability
Ukrainian air defense capability has suffered severe losses due to the physical disruption. Passive
(devices that don’t emit electromagnetic radiation while functioning) and mobile radars are very much
needed.

8
Battle Management System / Blue Force detection
Coordination and battle management is key component maximizing potential, especially if one faces a
better equipped and larger army. There are already videos of confused Ukrainian units accidentally
shooting at each other as it is easy to confuse Russian vehicles with Ukrainians.
Managing volunteers
Best utilization of all the help offered is a serious challenge. It requires coordination, unit formation,
logistics, supplies or resources will not be managed properly, and potential benefit will be wasted. This is
not something any army is prepared to do suddenly.
Intelligence gathering
Gathering and analyzing data, information and creating applicable intelligence requires proper and
timely communication among stakeholders. There is often no time for this during active operations, and
the received information must be filtered and cross-checked actively as misinformation is regular. This
requires data processing and analytics capacity and capability.
Firepower & bigger caliber
Russian Forces have bigger and more firepower, also they have more personnel. At the same time they
are limited in their usage as there is a very thin line between destroying a city completely with heavy
bombing or artillery fire and to “performing peacekeeping actions”.
Ukrainian Forces needs to have better firepower, precision strike missiles and longer reach to neutralise
critical targets without extra collateral damage on their own ground. Ukrainian forces are severely
outnumbered and Russian forces are aiming to prevent the regrouping of units by enclosing on Kiev.

9
Outlook
It is hard to estimate what will happen. Russia is already regrouping and organizing its troops and there
is a massive military convoy with supplies, tanks and heavy artillery heading towards Kiev. The good old
Soviet saying goes “if brute force doesn’t work, you are not using enough”.
Kiev seems to remain the symbolic and outmost strategic importance to be captured by all means and
cost. There is a chance for escalation of the situation and turning Kiev and other Ukrainian cities into
ruins.
So far it seems that even if Russia wins the military operations through destruction, Russia winning the
overall war will remain a challenge.
Time is on the side of Ukraine. The war costs overall billions each day to the Russian economy, and it is
hard to hide for long how a peacekeeping activity is a full-scale invasion. Russian oligarchs are losing
money daily (plus they are facing Switzerland potentially freezing Russian assets), Russian people are
starting to feel the effects of the cyber attacks and sanctions applied against Russia. The scapegoating
tactics and “Russia is the real victim” narrative will become harder and harder to maintain. Each day
Ukraine stands, the moral of the Russian army lowers, supply issues will arise and even though it is only
the partial capacity of the Russian Forces deployed, Russia doesn’t have infinite resources. It is a lot
cheaper for Russia to end to war than to continue, at the same time no one is sure about Putin’s
imperial aims. Putin and government face the dilemma: turn on the firepower and escalate into a sever
war or retreat while trying not to loose Crimea, Luhansk and Donetsk. So far it seems Russia has chosen
the first option.
The continuation of cyber attacks against Russian infrastructure is foreseeable, but they will become
more targeted and personalized. As more and more databases are being leaked, governmental secrets
and confidential information will become public and serve as foundations to future attacks. Although
the world is loud of the hacktivist activities, the intelligence agencies around the world are actively
collecting information and using it their benefit.
It is quite clear that current military doctrines need to be refreshed, especially the integration of cyber
capability has to receive more attention. Cyber has its place in the operational planning, C4ISR and
situational awareness besides the cyber defensive capabilities, especially in the world of multi-domain
warfare. EU has to also strengthen its cyber capabilities in this field as well, both in the civilian and
military domains.
About the author
Csaba Virág has more than a decade of experience in strategic, technical and administrative layers of the IT and
cybersecurity sector. He is well known for his capacity building activities along with his contribution to raising cyber
resilience in the EU and globally.

10
Csaba is born in Hungary, currently residing in Estonia and is the Director of Capacity Building at Talgen
Cybersecurity , focusing on developing and delivering high impact cyber resilience at large via enabling
organizations and governments to leverage on digital transformation at their maximum potential.
For more information, please visit Csaba Virág’s LinkedIn profile at https://www.linkedin.com/in/csabavirag/

Ukrainian conflict bulletin 1

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Ähnlich wie Ukrainian conflict bulletin 1

Ähnlich wie Ukrainian conflict bulletin 1 (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Ukrainian conflict bulletin 1