COMMENTARY: SBU and FBI against Russian hackers — the digital threat facing the West

Introduction: when intelligence agencies unite against Moscow

An unprecedented alliance in the digital war

On June 25, 2026, the Ukrainian Security Service (SBU) and the Federal Bureau of Investigation (FBI) jointly published an exposé of a Russian hacking campaign targeting the encrypted messaging apps of officials in Ukraine, the European Union, and the United States. This joint action carries considerable political significance: it symbolizes the fusion of Ukrainian and American intelligence in the face of a shared digital threat, and it signals clearly to Moscow that its cyber operations will not go unanswered.

The joint SBU-FBI publication is not merely a technical communiqué about software vulnerabilities. It is a political declaration: Ukraine and the United States are operating together in the digital war with the same level of integration as in the physical war. This level of integration, built over years of intelligence cooperation that accelerated after 2022, represents a first-tier strategic asset for Ukraine — and a formidable challenge for Russian special services.

The war in messaging apps: an underestimated threat

Encrypted messaging apps — Signal, WhatsApp, secure Telegram — have become the preferred communication tools of officials during wartime. They use them for sensitive communications: military coordination, diplomatic discussions, intelligence sharing. The compromise of these apps by Russian services is therefore not a privacy question. It is a national security question — potentially a matter of life and death for soldiers whose positions are thereby revealed, for sources whose identities are exposed.

The SBU and FBI's exposé of this hacking campaign documents the depth of the Russian cyber threat against the entire Western democratic ecosystem — not only against Ukraine, but against European institutions and American ones. The breadth of this threat demands a broad response. And the joint SBU-FBI publication is precisely the first act of that collective response.

The Russian hacking campaign: what we know

Official messaging apps targeted across three jurisdictions

The operation exposed by the SBU and FBI targeted officials in Ukraine, the EU, and the United States. The geographic scope is remarkable: three zones of maximum strategic importance. Ukraine, for the military and governmental communications directly tied to the conduct of the war. The European Union, for diplomatic communications, sanctions negotiations, and discussions about support for Ukraine. The United States, for defense and intelligence communications.

The probable objectives of this campaign were multiple. Steal military data — operational plans, troop positions, weapons delivery schedules — to improve the effectiveness of Russian strikes. Steal diplomatic data — to anticipate shifts in Western policy, identify red lines and zones of potential compromise. Steal economic data — to circumvent sanctions, identify procurement opportunities for prohibited technology components. Each type of data has a distinct operational value for Russian services.

Attack techniques: exploiting human vulnerabilities

Hacking campaigns targeting officials' messaging apps generally do not rely on insurmountable technical flaws in the applications themselves — major encrypted messaging apps are, in their updated versions, technically robust. They exploit human vulnerabilities: lost or stolen devices, unpatched software, careless behavior (clicking on malicious links, using unsecured Wi-Fi networks), social engineering scams that lead targets to reveal their credentials.

The joint SBU-FBI publication aims precisely to alert targeted officials to these techniques, to encourage them to secure their digital practices and to report any suspicious activity. It also aims to publicly name the Russian services responsible — a form of public accountability that, while not as immediate as a judicial sanction, contributes to the accumulation of evidence and to diplomatic pressure on Moscow.

The digital war as an extension of the physical war

Cyber as the fifth domain of warfare

The war in Ukraine has consecrated the rise of the fifth domain of warfare — cyberspace — as a full operational theater in its own right, alongside land, sea, air, and space. Russian cyber operations against Ukraine began well before the physical invasion of 2022, with attacks on Ukrainian electricity infrastructure in 2015 and 2016, massive disinformation campaigns, and attempts to compromise electoral systems.

In 2026, these operations have reached a new dimension through their geographic breadth — no longer limited to Ukraine but targeting the entire informational infrastructure of the coalition supporting Kyiv. This expansion reflects the total war logic of the Kremlin: if the West supports Ukraine financially, militarily, and diplomatically, the Kremlin retaliates by targeting the communications that enable this support. Damaging coordination between Kyiv and its allies is a strategic objective as valid as striking a refinery.

The institutional response: from exposure to protection

The institutional response by the SBU and FBI to this hacking campaign follows a three-phase logic. First, public exposure — naming the campaign, documenting it, informing potential targets. Then active protection — deploying technical and behavioral countermeasures to reduce the vulnerability of targets. Finally, accountability — documenting evidence for potential legal proceedings, strengthening sanctions dossiers against the responsible services and individuals.

This three-phase approach is now well-established in Euro-Atlantic cooperation on cybersecurity. Public exposure is often the most effective short-term mechanism — it forces Russian services to adapt their techniques, reduces the effectiveness of ongoing campaigns, reinforces vigilance among potential targets. And it sends a deterrent message: your operations are detected, documented, and exposed. There is no digital sanctuary.

The 8 Ukrainian arrests: when spies operate from within

A documented fifth column

The joint SBU-FBI publication coincided with a series of domestic arrests conducted by the SBU. Euromaidan Press reported on June 23 that 8 people were arrested in Ukraine, accused of supporting Russian strikes from inside the country and of espionage. These arrests reveal a reality that modern wars regularly expose: the internal fifth column that enemy services seek to activate within the civilian populations of adversary countries.

The charges are varied and grave. Individuals transmitting information about Ukrainian military positions to guide Russian strikes. People gathering and transmitting data on troop movements. A former municipal councillor from Chostka, in Sumy oblast, sentenced to 15 years in prison for guiding Russian strikes on his own region. Fifteen years. For contributing to strikes on the communities that this official was supposed to serve.

The foiled terrorist attack in central Kyiv

Among the week's arrests, Euromaidan Press reports that the SBU and National Police jointly foiled a plot by two Russian FSB agents who were preparing the explosion of an administrative building in central Kyiv. This information, verified through available sources, illustrates another dimension of Russian hybrid warfare: terrorist operations on enemy soil, targeting civilian and administrative targets to sow terror, destabilize the government, and demonstrate that nowhere in Ukraine is safe.

The fact that this plot was foiled before execution testifies to the effectiveness of Ukrainian counter-intelligence services. In the context of total war, maintaining an effective counter-intelligence capacity is as crucial as air defense or drone warfare. FSB agents infiltrated from within, intelligence collection networks, compromised local recruits — all these threats require considerable human and technical resources to detect and neutralize.

Europe in the crosshairs: when the cyber threat reaches EU institutions

EU officials' messaging apps as priority targets

The inclusion of European Union officials on the target list of the Russian hacking campaign is of considerable strategic significance. The EU is one of the most important actors in support for Ukraine — financially (the 3.2 billion EUR tranche announced in June), in terms of sanctions, and in decisions on the supply of weapons and military equipment. Compromising the communications of European officials who coordinate this aid is a direct attack on the effectiveness of Western support for Ukraine.

European institutions have progressively improved their cybersecurity since the vulnerabilities exposed by previous Russian cyberattacks — notably the 2022 attack on the European Parliament. But the messaging apps of individual officials — in foreign affairs ministries, defense agencies, and Ukraine coordination units — remain points of vulnerability. The SBU-FBI publication aims to alert the entire network of officials who communicate on Ukraine-related matters.

The renewed sanctions against Russia: a link to cyber

On June 19, Euromaidan Press reported that EU leaders agreed to renew sanctions against Russia for 12 months — for the first time for such a long duration, overcoming veto attempts by a pro-Russian Bulgarian leader. This sanctions renewal is directly linked to the cyber war: Russia is trying to compromise European communications partly to identify fractures in the political consensus on sanctions, to find internal EU allies to exploit, to anticipate foreign policy decisions that might allow it to adapt its strategy.

The renewal of sanctions for 12 months is also a signal to Russian services: the attempts to destabilize the European consensus — including through cyber operations — did not work. The EU remains united on Ukraine. And this unity, maintained despite Russian pressure of all kinds, is one of the most precious strategic assets of the coalition supporting Kyiv.

The FSB as a terrorist organization: a call for designation

FSB agents in Kyiv — from intelligence to terrorism

The plot by two FSB agents to blow up an administrative building in Kyiv raises a question that Western democracies too often refuse to ask clearly: when a foreign intelligence service orchestrates terrorist attacks on the territory of democratic countries, how should it be treated? The logical answer is designation as a terrorist organization. This designation has important practical consequences — it allows for asset freezes, for prosecuting members for participation in a terrorist organization, for strengthening restrictions on the service's activities in countries that designate it.

The FSB has conducted assassination operations on the soil of democratic countries — from Salisbury in England to Berlin, passing through several European capitals. It orchestrates attacks in Ukraine. It finances and coordinates destabilization networks across the European space. The line between intelligence and terrorism has long been crossed. The international community is slow to draw the institutional conclusions.

The international legal response

The legal dossier against the operations of the FSB and other Russian services grows every week. The 8 Ukrainian arrests, the two agents neutralized before they could bomb a building in Kyiv, the exposure of the hacking campaign by the SBU and FBI — all of this feeds dossiers which, compiled, allow the documentation of systematic patterns of Russian operations against democracies. These systematic patterns are exactly what international tribunals and national jurisdictions exercising universal jurisdiction need to establish the responsibility of those who ordered them.

International justice is slow. It is imperfect. It will never be as fast as the threat it seeks to sanction. But it advances. The ICC arrest warrants, the proceedings initiated in several European countries, the documented evidence dossiers — all of this creates a long-term legal pressure on the individuals who order these operations. And some of them, one day, will travel to a country where that arrest warrant is enforceable.

Cybersecurity as a matter of national sovereignty

Messaging apps as critical infrastructure

The Russian campaign against officials' messaging apps reveals something that governments are too slow to acknowledge: encrypted messaging apps have become a critical infrastructure of government communication, in the same category as electricity grids or transport systems. Compromising them means compromising the capacity to govern effectively — and in wartime, to orchestrate the defense.

Governments that have treated the cybersecurity of their official communications as a secondary technical problem — the responsibility of IT teams, not political decision-makers — are paying the price of this negligence. Cybersecurity is a question of national sovereignty, not of IT management. It deserves the attention of the highest political level, appropriate budgetary resources, and a culture of digital security across the entire public service.

The Ukrainian example: building cyber resilience under bombardment

Ukraine, perhaps more than any other country in the world, has understood this reality through force of circumstance. Since 2014, its services have had to build cyber resilience against persistent Russian attacks. This construction happened under conditions of maximum urgency, with limited resources, on systems whose modernization was incomplete. It was also built with the support of Western partners — the United States, the United Kingdom, the European Union — who provided expertise, equipment, and training.

The Ukraine of 2026 has a remarkable cybersecurity capacity given the challenges it has had to overcome. It has also developed an offensive cyber operations capability whose effects are beginning to be documented. The SBU-FBI cooperation in exposing the Russian hacking campaign is the visible expression of this growing capability. And it is also a demonstration that democracies can and must unite in the cyber dimension of Russian hybrid warfare.

The information war: beyond hacking

Disinformation, propaganda, and electoral interference

The hacking campaign exposed by the SBU and FBI is only one component of the Russian information war against democracies. Alongside technical hacking operations, Russia runs large-scale disinformation campaigns on social media, funds pro-Russian media in Europe, supports extremist political parties that weaken pro-Ukraine cohesion in several democracies, and attempts to influence electoral processes in multiple countries.

These operations are not new. But their intensification in 2026, in the context of the war, gives them new urgency. Weakening pro-Ukraine cohesion in Western democracies — by feeding "war fatigue," by amplifying pro-peace voices that would in practice mean a Ukrainian capitulation — is a central strategic objective of Russian services. And these services have considerable budgets, human resources, and experience in this form of warfare.

Informational resilience as collective defense

The democratic response to this information war must be multidimensional. Digital platforms that take their responsibilities seriously in moderating disinformation content. Media that maintain rigorous verification standards. Educational systems that cultivate critical thinking and source verification. Public institutions that communicate with transparency so as not to leave the field open to alternative narratives.

These responses are not spectacular like a satellite launch or the delivery of Patriot missiles. But they are fundamental to the resilience of democracies facing Russian hybrid warfare. A democracy whose citizens can identify disinformation is a democracy less vulnerable to manipulation. And a democracy that is less manipulable is one that more durably supports Ukraine — which is precisely what Putin is trying to prevent.

The renewal of European sanctions: the quiet victory

A full year of additional sanctions despite the attempted Bulgarian veto

On June 19, EU leaders agreed to renew sanctions against Russia for 12 months, overcoming the veto attempt by the pro-Russian Bulgarian prime minister. This renewal for a one-year term — rather than the usual six months — is an important symbolic and practical victory. It demonstrates that the European consensus on sanctions is holding despite the growing pressures — economic, political, and cyber — that Russia is exerting to break it.

Sanctions have a documented effect on the Russian economy. They have not collapsed it — Russia has partially circumvented their impact through alternative procurement channels in China, India, and Turkey. But they weigh down every transaction, complicate every technology import, reduce export revenues across several sectors. Combined with Ukrainian strikes on oil infrastructure, they exert a cumulative pressure that, over time, erodes Russian capabilities.

Russia's blocking effort against sanctions

The Bulgarian veto attempt illustrates a well-documented Russian strategy: infiltrate European institutions by politically supporting pro-Russian leaders in member democracies, then use their position to block or weaken anti-Russian measures. This strategy has partially worked in some countries — Hungary remains the most obvious case. It failed in Bulgaria during the June 2026 vote.

This strategy of political infiltration is directly linked to the cyber operations exposed by the SBU and FBI. Both share the same objective: reducing the cohesion and response capacity of the pro-Ukraine coalition. Through messaging app hacking, Russia seeks information that allows it to influence political decisions. Through support for pro-Russian leaders, it seeks to directly shape those decisions. These are two branches of the same tree — hybrid warfare at the European level.

The SBU-FBI cooperation as a model for digital alliance

Beyond intelligence sharing: operational integration

The joint SBU-FBI publication is not a simple intelligence exchange — two services sharing a few data points and then acting separately. It is an integrated operation, with a common communication, a shared analytical framework, joint public attribution. This level of operational integration in the cyber domain is remarkable and deserves to be amplified.

The SBU-FBI cooperation model could and should be extended to other partnerships — with British services (GCHQ), with European partners (French ANSSI, German BSI, Dutch NCSC), with the Five Eyes and their expanded network. Russian cyber warfare against democracies has no national borders. The democratic response should have none either. A collective response to a collective threat — that is the model that Ramstein established for military aid. It must be replicated in the cyber domain.

Ukraine as a cyber expertise hub for the West

There is something important in this SBU-FBI partnership that Western analysts do not always articulate clearly: Ukraine has become one of the most experienced countries in the world in cybersecurity, precisely because it has had to defend its systems against the most sophisticated and persistent Russian operations. This experience has considerable value for Western partners.

Ukrainian services know how Russian hackers operate — their techniques, their patterns, their signatures, their priority targets. They have accumulated, over a few years of war, first-hand expertise that cybersecurity academies cannot reproduce in a laboratory. Sharing this expertise with American and European partners, as the SBU-FBI publication suggests, is a knowledge transfer of immense strategic value. Ukraine is teaching its allies how to defend against Russia. Not out of abstract generosity. Out of shared interest.

The former Chostka councillor: documented internal collaboration

15 years for guiding strikes on his own region

One of the most revealing cases among the week's arrests is that of the former municipal councillor from Chostka, in Sumy oblast, sentenced to 15 years in prison for guiding Russian strikes on his own region. This case illustrates the nature of the internal threat that Ukraine must confront: individuals who, for ideological, financial, or coercive reasons, cooperate with the enemy to facilitate attacks against their own communities.

This form of betrayal is particularly difficult to detect and prevent. It hides in ordinary social networks, in appearances of normalcy, in individuals who could pass for patriotic citizens. Detecting it requires high-intensity counter-intelligence, considerable human resources, and sufficient public trust that the population will report suspicious behavior without hesitation. Ukraine has worked to build this trust and vigilance throughout the war.

The conviction as a deterrent signal

Sentencing the former Chostka councillor to 15 years in prison sends a clear signal: collaboration with the enemy is documented, prosecuted, and severely punished. This deterrent signal is crucial for maintaining the integrity of Ukrainian resistance. Every conviction demonstrates that the counter-intelligence network is functioning, that Ukrainian security services detect traitors, that collaborators cannot act with impunity.

This deterrent credibility is all the more important because Russian services continue to seek to recruit collaborators in Ukraine — by offering money, by pressuring relatives held in Russia, by targeting individuals ideologically predisposed to cooperating with Moscow. Vigilance is never over. But the legal tools and Ukrainian counter-intelligence institutions are demonstrating that they are equal to the challenge.

The actors of Russian cyber-warfare: the GRU, SVR, and FSB in network

A three-headed cyber-espionage architecture

The messaging app hacking campaign described in the joint SBU-FBI report is not the work of lone hackers or opportunistic criminal groups. It fits within a structured Russian cyberwarfare architecture involving Russia's three main intelligence services: the FSB (counter-intelligence and internal security), the GRU (military intelligence), and the SVR (foreign intelligence). Each operates its own advanced hacker groups — APT28, Sandworm, Cozy Bear — with distinct missions, targets, and methods.

This distributed architecture makes attribution difficult and complete neutralization virtually impossible in the short term. When the SBU and FBI expose a specific campaign, they have neutralized only one vector among several. The others continue to operate. But public exposure has its own strategic value: it forces targets to strengthen their defenses, compels Russian services to change their methods, and creates a documentary record useful for future legal proceedings. This is a long-game war that Ukraine and its allies have chosen to fight publicly.

The targeting of encrypted messaging: a documented tactical evolution

The choice to specifically target encrypted messaging apps of officials — Signal, Telegram, WhatsApp — reveals an important tactical adaptation. Russian hackers have understood that communication encryption has become the norm for sensitive officials, and that it is more effective to target the endpoint devices — the phones and computers of users — rather than trying to break the encryption of the communications themselves. This is a doctrinal evolution that makes individual cybersecurity as important as institutional network security.

The cyber hygiene advice issued alongside the exposé — regular updates, two-factor authentication, vigilance against phishing — are practical responses to this threat. But they also highlight an uncomfortable reality: in modern digital warfare, the most sensitive information chains are only as secure as their weakest link — often an individual with a poorly secured phone. The security of government communications has become a front-line issue, not merely a problem for technicians.

The war for minds: Russian disinformation as a weapon of cognitive destruction

Beyond hacking: influencing decisions by stealing information

The ultimate objective of messaging app hacking operations is not simply to steal information. It is to use that information to influence political decisions, sow distrust between allies, compromise negotiations, and prepare disinformation operations. When a Russian hacker accesses the private communications of a European minister, they obtain far more than confidential data — they obtain a map of tensions, doubts, and internal disagreements that can be exploited for manipulation purposes.

This exploitation of stolen information is documented in several cases. Falsified or manipulated emails have been published to create scandals, divide coalitions, and discredit officials. Russian hacking is not merely intelligence — it is a tool of cognitive warfare that seeks to weaken the cohesion of Western democracies from within. The SBU-FBI cooperation in exposing these operations is also a response to this cognitive threat.

The 8 arrests as a signal: Ukraine also resists from within

The 8 arrests announced on June 23 — Ukrainians accused of supporting Russian strikes and espionage — illustrate a reality that most cyber-warfare analyses underestimate: the human dimension of intelligence. Behind every sophisticated hacking campaign, there are often human agents who facilitate access, who transmit information from the inside, who identify targets. The FSB excels at recruiting these agents — using coercion, corruption, and family ties.

The fact that the SBU continues to identify and arrest these agents — a former municipal councillor sentenced to 15 years, two FSB agents neutralized before they could blow up a building in Kyiv — is a demonstration of Ukrainian counter-intelligence capacity. In a war where Russia has vastly superior human and financial resources for intelligence, Ukraine compensates through the national motivation and operational effectiveness of its services. This is an advantage whose importance is often undervalued.

The SBU-FBI digital alliance: a model for the collective defense of the West

Cooperation between allies as a response to transnational digital threats

The joint publication by the SBU and FBI of their findings on the Russian hacking campaign is symbolically and practically important. It illustrates a transatlantic cybersecurity cooperation that goes beyond the usual discreet exchanges between intelligence services. Publishing together means amplifying the impact, forcing transparency about Russian methods, and sending a signal to hesitant allies: we are working together, our intelligence is shared, your security is linked to ours.

This form of open cooperation is a strategic response to the Russian hybrid warfare doctrine that seeks precisely to sow distrust between allies, to exploit information silos between national intelligence services, to take advantage of the slower reaction time of democracies. By publicly and jointly exposing Russian operations, the SBU and FBIaccelerate this reaction time and make inter-allied coordination harder for Moscow to disrupt.

Lessons for the European cybersecurity architecture

The exposure of Russian hacking targeting EU officials reminds European institutions that cybersecurity can no longer be treated as a secondary technical dossier. It is a strategic sovereignty issue on the same level as conventional defense. ENISA (the European Union Agency for Cybersecurity) and national CERTs must have the resources, mandates, and action capabilities commensurate with the scale of the threat documented by the joint SBU-FBI report.

Ukraine, with its experience of more than ten years of intensive Russian cyberwarfare — from the 2017 NotPetya attacks to current operations — has become the involuntary laboratory of democratic cyber resistance. The lessons it has learned, often painfully, are exactly what Europe needs. Structured cooperation between Ukrainian cyber services and their European counterparts could strengthen collective security across the entire continent. The SBU-FBI model must become the SBU-ENISA model.

Conclusion: the invisible war that also decides victory

The digital war is not secondary

This commentary defends a simple thesis: the digital war is not secondary to the physical war. It is an integral component of it — one that conditions the effectiveness of physical operations, the cohesion of alliances, the quality of intelligence, and the resilience of the democracies supporting Ukraine. The joint SBU-FBI publication of June 25, 2026 is its demonstration: two intelligence services from different countries, uniting their forces in a domain that most citizens cannot see, but whose effects can be measured in compromised military strategies and infiltrated allies.

Ukraine is fighting this invisible war with the same determination with which it fights the drone war or the defense of trenches. It foils terrorist plots in Kyiv, it arrests spies, it exposes hacking campaigns in cooperation with its American allies. These victories do not make the big headlines. They do not produce the spectacular images of refineries in flames in Moscow. But they secure the foundation on which the visible victories are built.

What this commentary takes from the direction of the conflict

The week of June 23–25, 2026, viewed through the prism of digital warfare and counter-intelligence, confirms a trend: Ukraine is managing simultaneously multiple hybrid threats with growing effectiveness. It repels physical assaults. It strikes deep into Russian infrastructure. It exposes hacking campaigns through international cooperation. It arrests internal agents. It foils attacks. And it does so continuously, relentlessly, month after month.

This multi-domain capacity is the sign of a state that is resisting not only militarily but institutionally — a state that maintains its essential functions — security, justice, intelligence — under conditions that few governments in history have had to face. The SBU and FBI publishing a joint cybersecurity alert on June 25, 2026 — this is also proof that Ukraine is not alone, and that it will be less and less so.

Signed Maxime Marquette, columnist

Columnist's transparency box

Editorial positioning

This commentary is written from an engaged editorial position in favor of Euro-Atlantic cooperation on cybersecurity and support for Ukraine. It expresses a clear judgment about the nature of the Russian threat in the cyber domain and the necessity of a collective democratic response. This position is not neutral, but it is grounded in available facts and consistent with the standards of rigorous opinion journalism.

Methodology and sources

This commentary is founded on verified and dated facts from identified primary sources: UNN, Euromaidan Press, SSU (official SBU page), RBC-Ukraine. The figures on arrests and convictions derive from Euromaidan Press reports on official Ukrainian communications. No fact, no figure, no quote has been invented. Analysis of cyber techniques remains at a level of generality compatible with publicly available information.

Nature of the analysis

This text is an analytical commentary combining documented facts with strategic and political analysis of their implications. The italicized passages are clearly identified personal editorial comments. The columnist acknowledges the limits of available information on cyber operations — which are by nature partially classified — and adjusts his level of assertion accordingly.

Sources

Primary sources

UNN — "SBU and FBI expose Russian special services hacking messengers of officials in Ukraine, EU and US" — June 25, 2026

Euromaidan Press — "Ukraine arrests eight people accused of cheering on Russian strikes from inside the country and spying" — June 23, 2026

SSU (SBU) Main page — June 23, 2026

Secondary sources

RBC-Ukraine — "Russian hackers targeted officials across Ukraine, Europe and US" — June 25, 2026

Euromaidan Press — "EU leaders agree to renew Russia sanctions for 12 months" — June 19, 2026

ISW Assessment June 23, 2026 — June 24, 2026