COMMENTARY: Russian Hackers Target Ukraine, EU and US Officials — Cyberwar Intensifies

A joint operation exposing Russian cyberwar on a grand scale

On June 25, 2026, two of the world's most important intelligence and security agencies — the Security Service of Ukraine (SBU) and the American Federal Bureau of Investigation (FBI) — jointly announced the exposure of a Russian hacking operation targeting the messaging apps of senior Ukrainian, European, and American officials. This joint disclosure is itself a diplomatic event: it confirms that cooperation between Kyiv and Washington on intelligence matters has reached an unprecedented operational level.

The objective of this Russian operation was simple in its ambition and terrifying in its implications: gaining access to sensitive military, political, and economic exchanges from officials of the three entities most engaged against Russian aggression. To steal plans, negotiating positions, information on weapons deliveries, compromising personal communications. A vast digital espionage program striking at the very heart of Western decision-making apparatus.

The targets: the people at the center of decisions on Ukraine

The targets of this operation were not chosen at random. They are the officials directly involved in the military, diplomatic, and economic decisions concerning the war in Ukraine. Officers from defense ministries, diplomats working on sanctions packages, coordinating intelligence officers, foreign policy officials. By penetrating their messaging apps, Russian services were seeking to obtain a decisive informational advantage that could have compromised military operations, diplomatic negotiations, or intelligence processes.

The public disclosure of the operation by the SBU and FBI is a form of informational counter-offensive: by exposing the method, targets, and actors, both agencies reduce the future effectiveness of the method, warn potential targets, and send a clear political message to Moscow — we are watching you and we are striking back publicly.

A joint SBU-FBI operation against Russian cyberwar — this is precisely the type of cooperation Putin fears most. Not an individual response, but a coordinated, public response that exposes the mechanics of Russian espionage in broad daylight. Transparency as a defensive weapon — that is brilliant.

Instant messaging attacks as a preferred vector

Instant messaging apps — Signal, WhatsApp, Telegram, secure government messaging systems — have become prime targets for Russian espionage. Unlike institutional emails, often better protected by layers of organizational security, mobile messaging is used more informally, sometimes for communications outside official channels. This asymmetry of protection makes it a particularly effective attack vector.

Russian special services target these messaging apps through several methods: targeted phishing (spear phishing), exploitation of vulnerabilities in mobile operating systems, compromising telecom infrastructure layers in third countries, and in some cases, recruiting insiders with access to targets' devices. The sophistication of these methods reflects years of investment in Russian offensive cyber capabilities.

A pattern that fits a systematic intelligence strategy

This operation is not an isolated incident. It fits within a systematic pattern of Russian cyber-espionage documented for years by Western intelligence agencies. The groups APT29 (Cozy Bear) and APT28 (Fancy Bear), attributed to the Russian FSB and GRU intelligence services respectively, have long records of attempted intrusions into Western, Ukrainian, and NATO government systems.

The difference from previous operations is the escalation in terms of targets: simultaneously targeting officials from Ukraine, the EU, and the USA in a coordinated operation represents a new scope and ambition. It suggests a Kremlin desire to gain large-scale informational advantage at the precise moment when the most important decisions on support for Ukraine are being made.

What this operation reveals is that Russia is simultaneously waging a kinetic war in Ukraine and an information war against Western support for Ukraine. Both fronts are linked — and Russian services have long understood that compromising the enemy's information is as important as destroying their tanks.

Eight people arrested for espionage and complicity in Russian strikes

Alongside the disclosure of the hacking operation, the SBU announced on June 23, 2026 the arrest of eight people accused of espionage and complicity in Russian strikes from within Ukraine. These individuals were accused of having applauded and facilitated Russian strikes on Ukrainian territory, by providing targeting information or coordinating their activities with Russian services.

These arrests illustrate the multidimensional nature of Russian hybrid warfare: beyond pure cyber operations, Moscow maintains human networks inside Ukraine that serve as relays for intelligence operations, sabotage, and disinformation. Dismantling these networks is a constant priority for the SBU, which dedicates considerable resources to it alongside its electronic counter-espionage missions.

The SBU also foils an FSB plot targeting a Kyiv building

Also on June 23, the SBU announced it had foiled an FSB plot aimed at blowing up a central administrative building in Kyiv. This type of operation — recruiting local accomplices for physical attacks on Ukrainian administrative infrastructure — represents a threat distinct from cyberwar but complementary to it: while hackers steal information remotely, human networks seek to cause physical destruction and disrupt the functioning of the Ukrainian state.

The combination of these three disclosures within a few days — messaging hacks, internal spy network, sabotage plot — paints a picture of a massive and multifaceted Russian hybrid war being waged simultaneously on Ukrainian territory and in the information systems of its allies. Ukraine is facing it with a defensive agility that deserves recognition.

The SBU simultaneously foiling a transnational cyber operation, an internal spy network, and a physical sabotage plot — that is the definition of 21st-century total war. And Ukraine is facing it alone, on its own territory, with limited resources. If that does not merit our admiration and support, I do not know what does.

40% of the American cybersecurity agency's staff eliminated

While the Russian cyber threat reaches new heights, the United States has weakened its own digital defenses. According to data published on June 25, 2026, the DOGE program — the federal cost-reduction initiative driven by the executive — has cut 40% of CISA's staff, the Cybersecurity and Infrastructure Security Agency. CISA is the primary cyber defense institution of the American federal government. Reducing its workforce by 40% at the precise moment when Russian hackers are intensifying their operations is, to say the least, a strategically problematic choice.

Analysts following this issue point to a fundamental contradiction in American policy: on one hand, Washington publicly exposes Russian cyber operations with the FBI and SBU; on the other, it dismantles the institutional capacities that allow detecting, preventing, and responding to those very same operations. This disconnect between rhetoric and real capabilities is exactly what Russian services need to operate with fewer constraints.

A window of opportunity Moscow will not hesitate to exploit

From the Russian services' standpoint, the 40% reduction in CISA staffing is a windfall. It reduces early detection capacity for cyber operations, it weakens inter-agency coordination on cyber threats, and it decreases incident response speed. These weaknesses never go unexploited for long in the world of electronic intelligence.

The question now is one of American national security governance in the context of intense hybrid warfare. Can short-term budgetary imperatives justify weakening the main cyber defense agency of the country most targeted by Russian state hackers? That is a question American lawmakers will need to ask — and quickly, before the cost of this decision is felt in a catastrophic way.

Cutting 40% of CISA while Russian hackers are targeting American officials is like opening the windows during a storm because you find the heating bill too high. Short-term savings in national security always get paid back in long-term catastrophes. Trump is a necessary evil — but here, he risks creating a gaping hole in American defenses at the worst possible moment.

32 years of special operations in service of Ukraine

On June 23, 2026, the Special Operations Center Alpha of the SBU celebrated the 32nd anniversary of its creation. On this occasion, the unit's operational record was partially declassified: since the start of the full-scale war, Alpha contributed to the destruction of 540 Russian electronic warfare systems and 23,517 Russian drones as of June 23, 2026.

These figures give a measure of the operational intensity of Ukrainian electronic and anti-drone warfare. The destruction of 540 Russian electronic warfare systems is not trivial — these systems are central to Russia's GPS jamming capabilities, neutralizing Ukrainian communications, and defending against drones. Destroying them partially restores the communication and navigation capabilities of Ukrainian forces.

Electronic warfare: an invisible front with decisive stakes

The destruction of 23,517 Russian drones illustrates another dimension of this war: the drone battle is being fought at an industrial scale that few previous conflicts had seen. Each destroyed drone represents not only a neutralized weapons system, but also resources consumed in the Russian production chain — materials, electronic components, skilled labor. At this scale, drone destruction itself becomes a tool of economic attrition.

Electronic warfare and cyberwar are the two least visible but potentially most decisive fronts over the long term. Ukraine's intelligence and electronic countermeasure capabilities, forged in urgency since 2022, are now among the most advanced in Europe — a remarkable transformation for a country that was fighting with Soviet-era equipment just four years ago.

540 Russian electronic warfare systems destroyed, 23,517 drones shot down — these are the figures of a country that learned to fight as a first-rank military power in three years of intense war. Ukraine is no longer the David of 2022. It is a mature, agile, and dangerous fighting force for anyone who underestimates it.

Coordination between Russian, Chinese, and Iranian cyber capabilities

Russian cyberwar does not operate in isolation. Western intelligence agencies have documented for several years exchanges of techniques and tools between Russian, Chinese, and Iranian cyber services. These three powers share a common interest in weakening Western democracies and undermining confidence in institutions, elections, and government communications.

Coordination is not necessarily centralized — it may take the form of mutual learning, malware exchanges, sharing of target databases or exploitable vulnerabilities. The result is a cyber threat environment that is more than the sum of its parts: the offensive capabilities of the global authoritarian axis are amplified by this informal but real coordination.

What this means for Western cyber defense

Faced with this coordinated threat, the response must also be coordinated. The joint SBU-FBI disclosure of June 25 is a model — not merely a political statement, but an operational demonstration that intelligence cooperation works. Extending this model to European partners, strengthening information sharing between EU and NATO member states' cyber agencies, and investing in common response capabilities — that is the necessary roadmap.

The reduction in CISA staffing moves in exactly the opposite direction. And in a context where Russian hackers are simultaneously targeting Kyiv, Brussels, and Washington, a cyber defense chain only as strong as its weakest link is insufficient. Every weakening of a partner is an opportunity for the adversary.

Western cyber defense is a collective project or it is nothing. We cannot have a CISA stripped of 40% of its staff, an underfunded SBU, and an EU struggling to coordinate its national agencies — and expect to hold against the Russian cyber machine, backed by knowledge exchanges with Beijing and Tehran. Strategic coherence is the first condition of defense.

Europe must draw lessons from the SBU-FBI disclosure

The European Union has made significant progress on cybersecurity in recent years — the NIS2 directive, the Cyber Resilience Act, the ENISA mandates. But the June 25 disclosure illustrates that these instruments, while necessary, are insufficient against state actors with unlimited resources and an aggressive offensive doctrine.

What Europe still lacks is a coordinated offensive response capability — not only defense, but deterrence through counter-attack. If a state knows that its cyber operations will not only be detected but publicly exposed and followed by real consequences, the cost-benefit calculation of aggression changes. The SBU-FBI model must become the EU-NATO-allies model.

Sanctions as an indispensable complement to technical defense

The European Union included in its 20th sanctions package designations linked to FIMI (Foreign Information Manipulation and Interference). This is an important evolution that recognizes that the information war — cyber, disinformation, manipulation — is a tool of Russian aggression that deserves a response within the sanctions framework. This logic must be continued and deepened.

The logical next step would be to specifically sanction the individuals and entities involved in the messaging hacking operations disclosed on June 25. Naming, designating, and sanctioning Russian cyber operators — not just oligarchs and generals — would send a deterrence message directly to the threat actors.

Sanctioning Russian hackers by name, publicly, with real consequences on their assets and travel — that is the next frontier in the fight against cyberwar. Impunity is the best fertilizer for escalation. The European Union has the tools. What it needs now is the will to use them against the right actors.

A predictable escalation as military pressure intensifies

The more military and economic pressure on Russia intensifies, the more Russian services will be incentivized to compensate their battlefield losses with informational gains. This is a near-mechanical law of intelligence: when you lose tanks, you try to steal plans. When you lose refineries, you try to discover future Ukrainian targets. Cyberwar will therefore intensify in proportion to the degradation of Russia's position on the ground.

The priority targets of this escalation will be the same as those of the operation exposed on June 25: the officials making the most important decisions on support for Ukraine. Defense ministers, intelligence directors, diplomatic negotiators — all are high-value targets in the doctrine of Russian cyber-espionage. Vigilance must be commensurate with the risk, and the risk is at its maximum.

Cyber resilience as a condition of strategic victory

A democracy that cannot protect its government communications is a democracy vulnerable in its most fundamental decisions. Cyber resilience — the capacity to maintain secure communications despite intrusion attempts — is a basic condition of national sovereignty in the 21st century. Without it, all military and diplomatic efforts can be compromised by an information leak at the wrong moment.

This is why investments in cyber defense must be treated as national security investments in their own right — not as discretionary budget items to be cut under fiscal pressure. The decision to cut 40% of CISA's staff must be reversed. Not because bureaucracy is always right, but because the threats themselves are not reducing.

Cyber resilience is not a technological luxury reserved for great powers. It is a survival condition for any democracy threatened by actors who have made digital espionage their weapon of first resort. Investing in CISA, in the SBU, in European cyber agencies is investing in the defense of democracy itself.In a war where compromised messaging apps can cost lives and military operations, digital security is not a technical option — it is a condition of strategic survival. The SBU and FBI understood this. It is time all partners in the pro-Ukraine coalition did the same.

A threat that will intensify as the conflict evolves

The joint SBU-FBI disclosure of June 25, 2026 is not the end of a story — it is an episode in a cyber war that will last as long as the Russian aggression against Ukraine. The more military and economic pressure on Russia intensifies, the more Russian services will be incentivized to compensate their battlefield losses with informational gains — by stealing plans, compromising communications, sowing mistrust among allies.

Ukraine and its allies must invest in cyber defense as in conventional defense

The conclusion is inescapable: cyber defense must be funded, coordinated, and developed with the same urgency as conventional military aid. Cutting CISA's budget by 40% during intense hybrid warfare is a major strategic error. Strengthening the SBU, funding ENISA, deepening cooperation between NATO cyber agencies — these are national security investments, not discretionary budget items.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.