# COMMENTARY: SBU and FBI against Russian hackers — the digital threat facing the West

> On June 25, 2026, the Ukrainian Security Service (SBU) and the Federal Bureau of Investigation (FBI) jointly published an exposé of a

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Commentary
- Published: 2026-06-26
- Canonical URL: https://mad-max.co/en/article/commentaire-sbu-et-fbi-contre-les-hackers-russes-la-menace-numerique-sur-l-occid

## Introduction: when **intelligence agencies** unite against Moscow

### An unprecedented alliance in the digital war

On **June 25, 2026**, the **Ukrainian** Security Service (SBU) and the **Federal Bureau of Investigation (FBI)** jointly published an exposé of a **Russian** hacking campaign targeting the **encrypted messaging apps of officials** in **Ukraine**, the European Union, and the United States. This joint action carries considerable political significance: it symbolizes the fusion of Ukrainian and American intelligence in the face of a shared digital threat, and it signals clearly to Moscow that its cyber operations will not go unanswered.

The joint SBU-FBI publication is not merely a technical communiqué about software vulnerabilities. It is a **political declaration**: **Ukraine** and the United States are operating together in the digital war with the same level of integration as in the physical war. This level of integration, built over years of intelligence cooperation that accelerated after 2022, represents a first-tier strategic asset for Ukraine — and a formidable challenge for Russian special services.

### The war in messaging apps: an underestimated threat

Encrypted messaging apps — Signal, WhatsApp, secure Telegram — have become the preferred communication tools of officials during **wartime**. They use them for **sensitive communications**: military coordination, diplomatic discussions, intelligence sharing. The compromise of these apps by **Russian** services is therefore not a privacy question. It is a national security question — potentially a matter of life and death for soldiers whose positions are thereby revealed, for sources whose identities are exposed.

The SBU and FBI's exposé of this hacking campaign documents the **depth of the Russian cyber threat** against the entire Western democratic ecosystem — not only against **Ukraine**, but against **European institutions** and American ones. The breadth of this **threat** demands a broad response. And the joint SBU-FBI publication is precisely the first act of that collective response.

*The FBI and the SBU jointly publishing a cybersecurity alert. There is a powerful symbol here: the digital war has erased the border between American domestic security and the war in Ukraine. When Moscow attacks Ukraine digitally, it also attacks the United States. And the United States responds.*

## The Russian hacking campaign: what we know

### Official messaging apps targeted across three jurisdictions

The operation exposed by the SBU and FBI targeted **officials in Ukraine, the EU, and the United States**. The geographic scope is remarkable: three zones of maximum strategic importance. **Ukraine**, for the military and governmental communications directly tied to the conduct of the war. The European Union, for diplomatic communications, sanctions negotiations, and discussions about support for Ukraine. The United States, for defense and intelligence communications.

The probable objectives of this campaign were multiple. **Steal military data** — operational plans, troop positions, weapons delivery schedules — to improve the effectiveness of Russian strikes. **Steal diplomatic data** — to anticipate shifts in Western policy, identify red lines and zones of potential compromise. **Steal economic data** — to circumvent sanctions, identify procurement opportunities for prohibited technology components. Each type of data has a distinct operational value for Russian services.

### Attack techniques: exploiting human vulnerabilities

Hacking campaigns targeting officials' messaging apps generally do not rely on insurmountable technical flaws in the applications themselves — major encrypted messaging apps are, in their updated versions, technically robust. They exploit **human vulnerabilities**: lost or stolen devices, unpatched software, careless behavior (clicking on malicious links, using unsecured Wi-Fi networks), social engineering scams that lead targets to reveal their credentials.

The joint SBU-FBI publication aims precisely to alert targeted officials to these techniques, to encourage them to **secure their digital practices** and to report any suspicious activity. It also aims to publicly name the Russian services responsible — a form of **public accountability** that, while not as immediate as a judicial sanction, contributes to the accumulation of evidence and to diplomatic pressure on Moscow.

*The best defense against messaging app hacking is often basic digital hygiene. Russian services do not always need supercomputers. They need someone to click on the wrong link. Cybersecurity is, 80% of the time, a question of human behavior. And training officials costs far less than repairing the damage from an intelligence leak.*

## The digital war as an extension of the physical war

### Cyber as the fifth domain of warfare

The war in Ukraine has consecrated the rise of the **fifth domain of warfare** — cyberspace — as a full operational theater in its own right, alongside land, sea, air, and space. Russian cyber operations against Ukraine began well before the physical invasion of 2022, with attacks on Ukrainian electricity infrastructure in 2015 and 2016, massive disinformation campaigns, and attempts to compromise electoral systems.

In 2026, these operations have reached a new dimension through their geographic breadth — no longer limited to Ukraine but targeting the entire informational infrastructure of the coalition supporting Kyiv. This expansion reflects the **total war logic** of the Kremlin: if the West supports Ukraine financially, militarily, and diplomatically, the Kremlin retaliates by targeting the communications that enable this support. **Damaging coordination between Kyiv and its allies** is a strategic objective as valid as striking a refinery.

### The institutional response: from exposure to protection

The institutional response by the SBU and FBI to this hacking campaign follows a three-phase logic. First, **public exposure** — naming the campaign, documenting it, informing potential targets. Then **active protection** — deploying technical and behavioral countermeasures to reduce the vulnerability of targets. Finally, **accountability** — documenting evidence for potential legal proceedings, strengthening sanctions dossiers against the responsible services and individuals.

This three-phase approach is now well-established in Euro-Atlantic cooperation on cybersecurity. Public exposure is often the most effective short-term mechanism — it forces Russian services to adapt their techniques, reduces the effectiveness of ongoing campaigns, reinforces vigilance among potential targets. And it sends a **deterrent message**: your operations are detected, documented, and exposed. There is no digital sanctuary.

*Publicly exposing a Russian cyber operation is also a way of saying to Kremlin hackers: we see you. We know what you are doing. And we are going to tell the world. Forced transparency is a powerful defensive weapon. It does not stop everything, but it complicates Russian operations and reduces their marginal effectiveness.*

## The 8 Ukrainian arrests: when **spies operate from within**

### A documented fifth column

The joint SBU-FBI publication coincided with a series of domestic arrests conducted by the SBU. Euromaidan Press reported on June 23 that **8 people were arrested** in Ukraine, accused of supporting Russian strikes from inside the country and of espionage. These arrests reveal a reality that modern wars regularly expose: the **internal fifth column** that enemy services seek to activate within the civilian populations of adversary countries.

The charges are varied and grave. Individuals transmitting information about Ukrainian military positions to guide Russian strikes. People gathering and transmitting data on troop movements. A former municipal councillor from **Chostka**, in Sumy oblast, sentenced to **15 years in prison** for guiding Russian strikes on his own region. Fifteen years. For contributing to strikes on the communities that this official was supposed to serve.

### The foiled terrorist attack in central Kyiv

Among the week's arrests, Euromaidan Press reports that the **SBU and National Police** jointly foiled a plot by two **Russian FSB agents** who were preparing the explosion of an administrative building in central Kyiv. This information, verified through available sources, illustrates another dimension of Russian hybrid warfare: terrorist operations on enemy soil, targeting civilian and administrative targets to sow terror, destabilize the government, and demonstrate that nowhere in Ukraine is safe.

The fact that this plot was foiled before execution testifies to the effectiveness of Ukrainian counter-intelligence services. In the context of total war, maintaining an **effective counter-intelligence capacity** is as crucial as air defense or drone warfare. FSB agents infiltrated from within, intelligence collection networks, compromised local recruits — all these threats require considerable human and technical resources to detect and neutralize.

*A plot to blow up an administrative building in central Kyiv, foiled at the last moment. How many others were not foiled? How many are still being planned? The SBU and Ukrainian police are doing work we will never see in full, in the shadows, under permanent pressure. This is a war within the war. And it is also won in the basements of apartments where FSB agents hide their explosives.*

## Europe in the crosshairs: when the cyber threat reaches EU institutions

### EU officials' messaging apps as priority targets

The inclusion of **European Union** officials on the target list of the Russian hacking campaign is of considerable strategic significance. The EU is one of the most important actors in support for Ukraine — financially (the 3.2 billion EUR tranche announced in June), in terms of sanctions, and in decisions on the supply of weapons and military equipment. Compromising the communications of European officials who coordinate this aid is a direct attack on the effectiveness of Western support for Ukraine.

European institutions have progressively improved their cybersecurity since the vulnerabilities exposed by previous Russian cyberattacks — notably the 2022 attack on the European Parliament. But the messaging apps of individual officials — in foreign affairs ministries, defense agencies, and Ukraine coordination units — remain points of vulnerability. The SBU-FBI publication aims to **alert the entire network** of officials who communicate on Ukraine-related matters.

### The renewed sanctions against Russia: a link to cyber

On June 19, Euromaidan Press reported that **EU leaders agreed to renew sanctions against Russia for 12 months** — for the first time for such a long duration, overcoming veto attempts by a pro-Russian Bulgarian leader. This sanctions renewal is directly linked to the cyber war: Russia is trying to compromise European communications partly to identify fractures in the political consensus on sanctions, to find internal EU allies to exploit, to anticipate foreign policy decisions that might allow it to adapt its strategy.

The renewal of sanctions for 12 months is also a signal to Russian services: the attempts to destabilize the European consensus — including through cyber operations — did not work. The EU remains united on Ukraine. And this unity, maintained despite Russian pressure of all kinds, is **one of the most precious strategic assets** of the coalition supporting Kyiv.

*Sanctions renewed for 12 months despite attempted vetoes — that is a quiet but fundamental victory. Russia has tried everything to break the European consensus: corruption, hacking, disinformation, economic pressure. And the EU has held. This is not glamorous. It is decisive.*

## The FSB as a terrorist organization: a **call for designation**

### FSB agents in Kyiv — from intelligence to terrorism

The plot by two **FSB** agents to blow up an administrative building in Kyiv raises a question that Western democracies too often refuse to ask clearly: **when a foreign intelligence service orchestrates terrorist attacks on the territory of democratic countries, how should it be treated?** The logical answer is designation as a terrorist organization. This designation has important practical consequences — it allows for asset freezes, for prosecuting members for participation in a terrorist organization, for strengthening restrictions on the service's activities in countries that designate it.

The FSB has conducted assassination operations on the soil of democratic countries — from Salisbury in England to Berlin, passing through several European capitals. It orchestrates attacks in Ukraine. It finances and coordinates destabilization networks across the European space. The line between **intelligence and terrorism** has long been crossed. The international community is slow to draw the institutional conclusions.

### The international legal response

The legal dossier against the operations of the FSB and other Russian services grows every week. The 8 Ukrainian arrests, the two agents neutralized before they could bomb a building in Kyiv, the exposure of the hacking campaign by the SBU and FBI — all of this feeds dossiers which, compiled, allow the **documentation of systematic patterns** of Russian operations against democracies. These systematic patterns are exactly what international tribunals and national jurisdictions exercising universal jurisdiction need to establish the responsibility of those who ordered them.

International justice is slow. It is imperfect. It will never be as fast as the threat it seeks to sanction. But it advances. The ICC arrest warrants, the proceedings initiated in several European countries, the documented evidence dossiers — all of this creates a **long-term legal pressure** on the individuals who order these operations. And some of them, one day, will travel to a country where that arrest warrant is enforceable.

*International justice takes time. Sometimes too long for the victims. But the long arc of justice does not invalidate its utility. Every piece of evidence compiled, every document added to the file, every agent arrested and tried — that is a fragment of accountability that will one day be presented to those who ordered it. The ICC has an arrest warrant for Putin. That is a beginning.*

## Cybersecurity as a matter of **national sovereignty**

### Messaging apps as critical infrastructure

The Russian campaign against officials' messaging apps reveals something that governments are too slow to acknowledge: encrypted messaging apps have become a **critical infrastructure** of government communication, in the same category as electricity grids or transport systems. Compromising them means compromising the capacity to govern effectively — and in wartime, to orchestrate the defense.

Governments that have treated the cybersecurity of their official communications as a secondary technical problem — the responsibility of IT teams, not political decision-makers — are paying the price of this negligence. **Cybersecurity is a question of national sovereignty**, not of IT management. It deserves the attention of the highest political level, appropriate budgetary resources, and a **culture** of digital security across the entire public service.

### The Ukrainian example: building cyber resilience under bombardment

Ukraine, perhaps more than any other country in the world, has understood this reality through force of circumstance. Since 2014, its services have had to build **cyber resilience** against persistent Russian attacks. This construction happened under conditions of maximum urgency, with limited resources, on systems whose modernization was incomplete. It was also built with the support of Western partners — the United States, the United Kingdom, the European Union — who provided expertise, equipment, and training.

The Ukraine of 2026 has a **remarkable cybersecurity capacity** given the challenges it has had to overcome. It has also developed an offensive cyber operations capability whose effects are beginning to be documented. The SBU-FBI cooperation in exposing the **Russian hacking campaign** is the visible expression of this growing capability. And it is also a demonstration that democracies can and must unite in the cyber dimension of Russian hybrid warfare.

*Ukraine built its cyber resilience under the bombs. Literally. IT teams working in air-raid shelters to keep systems online during strikes. It is a metaphor for the entire Ukrainian project: building democracy under the bombs of those who seek to destroy it. And keeping it alive.*

## The information war: beyond hacking

### Disinformation, propaganda, and electoral interference

The hacking campaign exposed by the SBU and FBI is only one component of the **Russian information war** against democracies. Alongside technical hacking operations, Russia runs large-scale disinformation campaigns on social media, funds pro-Russian media in Europe, supports extremist political parties that weaken pro-Ukraine cohesion in several democracies, and attempts to influence electoral processes in multiple countries.

These operations are not new. But their intensification in 2026, in the context of the war, gives them new urgency. Weakening pro-Ukraine cohesion in Western democracies — by feeding "war fatigue," by amplifying pro-peace voices that would in practice mean a Ukrainian capitulation — is a central strategic objective of Russian services. And these services have considerable budgets, human resources, and experience in this form of warfare.

### Informational resilience as collective defense

The democratic response to this information war must be multidimensional. **Digital platforms** that take their responsibilities seriously in moderating disinformation content. Media that maintain rigorous verification standards. Educational systems that cultivate critical thinking and source verification. Public institutions that communicate with transparency so as not to leave the field open to alternative narratives.

These responses are not spectacular like a satellite launch or the delivery of Patriot missiles. But they are **fundamental to the resilience of democracies** facing Russian hybrid warfare. A democracy whose citizens can identify disinformation is a democracy less vulnerable to manipulation. And a democracy that is less manipulable is one that more durably supports Ukraine — which is precisely what Putin is trying to prevent.

*Informational resilience is not glamorous. It is not drones, not missiles, not spy satellites. It is media literacy, fact-checking, institutional transparency. But a democracy that can distinguish truth from falsehood is a democracy Putin cannot manipulate. And that is a major strategic victory.*

## The renewal of European sanctions: the **quiet victory**

### A full year of additional sanctions despite the attempted Bulgarian veto

On June 19, **EU leaders agreed to renew sanctions against Russia for 12 months**, overcoming the veto attempt by the pro-Russian Bulgarian prime minister. This renewal for a one-year term — rather than the usual six months — is an important symbolic and practical victory. It demonstrates that **the European consensus on sanctions is holding** despite the growing pressures — economic, political, and cyber — that Russia is exerting to break it.

Sanctions have a documented effect on the Russian economy. They have not collapsed it — Russia has partially circumvented their impact through alternative procurement channels in China, India, and Turkey. But they weigh down every transaction, complicate every technology import, reduce export revenues across several sectors. Combined with Ukrainian strikes on oil infrastructure, they exert a **cumulative pressure** that, over time, erodes Russian capabilities.

### Russia's blocking effort against sanctions

The Bulgarian veto attempt illustrates a well-documented Russian strategy: infiltrate European institutions by politically supporting pro-Russian leaders in member democracies, then use their position to block or weaken anti-Russian measures. This strategy has partially worked in some countries — Hungary remains the most obvious case. It failed in Bulgaria during the June 2026 vote.

This strategy of political infiltration is directly linked to the cyber operations exposed by the SBU and FBI. Both share the same objective: **reducing the cohesion and response capacity of the pro-Ukraine coalition**. Through messaging app hacking, Russia seeks information that allows it to influence political decisions. Through support for pro-Russian leaders, it seeks to directly shape those decisions. These are two branches of the same tree — hybrid warfare at the European level.

*Bulgaria trying to block sanctions, Hungary delaying aid — these are the Pyrrhic victories of Russia's infiltration strategy in European democracies. Partially successful, never decisive. The EU holds. Not perfectly, not easily. But it holds. And in this war, holding is already winning in part.*

## The SBU-FBI cooperation as a model for digital alliance

### Beyond intelligence sharing: operational integration

The joint SBU-FBI publication is not a simple intelligence exchange — two services sharing a few data points and then acting separately. It is an **integrated operation**, with a common communication, a shared analytical framework, joint public attribution. This level of operational integration in the cyber domain is remarkable and deserves to be amplified.

The SBU-FBI cooperation model could and should be extended to other partnerships — with British services (GCHQ), with European partners (French ANSSI, German BSI, Dutch NCSC), with the Five Eyes and their expanded network. Russian cyber warfare against democracies has no national borders. The democratic response should have none either. **A collective response to a collective threat** — that is the model that Ramstein established for military aid. It must be replicated in the cyber domain.

### Ukraine as a cyber expertise hub for the West

There is something important in this SBU-FBI partnership that Western analysts do not always articulate clearly: **Ukraine has become one of the most experienced countries in the world in cybersecurity**, precisely because it has had to defend its systems against the most sophisticated and persistent Russian operations. This experience has considerable value for Western partners.

Ukrainian services know how Russian hackers operate — their techniques, their patterns, their signatures, their priority targets. They have accumulated, over a few years of war, **first-hand expertise** that cybersecurity academies cannot reproduce in a laboratory. Sharing this expertise with American and European partners, as the SBU-FBI publication suggests, is a knowledge transfer of immense strategic value. Ukraine is teaching its allies how to defend against Russia. Not out of abstract generosity. Out of shared interest.

*Ukraine as a cyber expertise hub for the West. What a reversal of fortune that no one anticipated. In 2014, Western democracies were sending experts to Ukraine to help it modernize its institutions. In 2026, Ukraine is teaching the West how to defend against Russia. War has its own ways of redistributing expertise.*

## The former Chostka councillor: documented internal collaboration

### 15 years for guiding strikes on his own region

One of the most revealing cases among the week's arrests is that of the **former municipal councillor from Chostka**, in Sumy oblast, sentenced to **15 years in prison** for guiding Russian strikes on his own region. This case illustrates the nature of the internal threat that Ukraine must confront: individuals who, for ideological, financial, or coercive reasons, cooperate with the enemy to facilitate attacks against their own communities.

This form of betrayal is particularly difficult to detect and prevent. It hides in ordinary social networks, in appearances of normalcy, in individuals who could pass for patriotic citizens. Detecting it requires high-intensity counter-intelligence, considerable human resources, and sufficient **public trust** that the population will report suspicious behavior without hesitation. Ukraine has worked to build this trust and vigilance throughout the war.

### The conviction as a deterrent signal

Sentencing the former Chostka councillor to **15 years in prison** sends a clear signal: collaboration with the enemy is documented, prosecuted, and severely punished. This deterrent signal is crucial for maintaining the integrity of Ukrainian resistance. Every conviction demonstrates that the counter-intelligence network is functioning, that Ukrainian security services detect traitors, that collaborators cannot act with impunity.

This deterrent credibility is all the more important because Russian services continue to seek to recruit collaborators in Ukraine — by offering money, by pressuring relatives held in Russia, by targeting individuals ideologically predisposed to cooperating with Moscow. **Vigilance is never over**. But the legal tools and Ukrainian counter-intelligence institutions are demonstrating that they are equal to the challenge.

*15 years for guiding strikes on his own region. I cannot imagine this level of betrayal. Guiding missiles toward houses where your neighbors live, your former colleagues, perhaps family members. This is not politics. This is crime. And Ukrainian justice treated it as such. With rigor. With clarity. With the severity this crime deserves.*

## The actors of Russian cyber-warfare: the GRU, SVR, and FSB in network

### A three-headed cyber-espionage architecture

The messaging app hacking campaign described in the joint **SBU-FBI** report is not the work of lone hackers or opportunistic criminal groups. It fits within a **structured Russian cyberwarfare architecture** involving Russia's three main intelligence services: the **FSB** (counter-intelligence and internal security), the **GRU** (military intelligence), and the **SVR** (foreign intelligence). Each operates its own advanced hacker groups — **APT28, Sandworm, Cozy Bear** — with distinct missions, targets, and methods.

This **distributed architecture** makes **attribution difficult** and complete **neutralization** virtually impossible in the short term. When the **SBU and FBI** expose a specific campaign, they have neutralized only **one vector among several**. The others continue to operate. But public exposure has its own strategic value: it **forces targets to strengthen their defenses**, compels Russian services to **change their methods**, and creates a documentary record useful for future legal proceedings. This is a **long-game war** that Ukraine and its allies have chosen to fight publicly.

### The targeting of encrypted messaging: a documented tactical evolution

The choice to specifically target **encrypted messaging apps** of officials — Signal, Telegram, WhatsApp — reveals an important tactical adaptation. Russian hackers have understood that **communication encryption** has become the norm for sensitive officials, and that it is more effective to target the **endpoint devices** — the **phones and computers** of users — rather than trying to break the encryption of the communications themselves. This is a doctrinal evolution that makes individual cybersecurity as important as institutional network security.

The **cyber hygiene** advice issued alongside the exposé — regular updates, two-factor authentication, vigilance against phishing — are practical responses to this threat. But they also highlight an uncomfortable reality: in modern digital warfare, the most sensitive information chains are only as secure as their **weakest link** — often an individual with a poorly secured phone. The **security of government communications** has become a front-line issue, not merely a problem for technicians.

*Signal is encrypted. FSB hackers do not break the encryption. They compromise the phone. This is a lesson that every official who thinks they are protected by their app needs to internalize. Cybersecurity is not software. It is a culture. And that culture, in Ukraine, in Europe, and in the United States, still has too many **gaps**.*

## The war for minds: Russian disinformation as a weapon of cognitive destruction

### Beyond hacking: influencing decisions by stealing information

The ultimate objective of messaging app hacking operations is not simply to steal information. It is to use that information to **influence political decisions**, sow distrust between allies, compromise negotiations, and prepare disinformation operations. When a **Russian hacker accesses the private communications of a European minister**, they obtain far more than confidential data — they obtain a map of tensions, doubts, and internal disagreements that can be exploited for manipulation purposes.

This exploitation of **stolen information** is documented in several cases. **Falsified or manipulated emails** have been published to create **scandals**, **divide coalitions**, and **discredit officials**. **Russian hacking** is not merely intelligence — it is a tool of **cognitive warfare** that seeks to weaken the **cohesion of Western democracies** from within. The **SBU-FBI** cooperation in exposing these operations is also a response to this cognitive threat.

### The 8 arrests as a signal: Ukraine also resists from within

The **8 arrests** announced on June 23 — Ukrainians accused of supporting Russian strikes and espionage — illustrate a reality that most cyber-warfare analyses underestimate: the **human dimension of intelligence**. Behind every **sophisticated** hacking campaign, there are often **human agents** who facilitate access, who transmit information from the inside, who identify targets. The FSB excels at recruiting these agents — using **coercion, corruption**, and **family ties**.

The fact that the SBU continues to identify and arrest these agents — a **former municipal councillor sentenced to 15 years**, two FSB agents neutralized before they could blow up a building in Kyiv — is a demonstration of **Ukrainian counter-intelligence capacity**. In a war where Russia has **vastly superior human and financial resources** for intelligence, Ukraine compensates through the **national motivation and operational effectiveness** of its services. This is an advantage whose importance is often undervalued.

*8 arrests in Ukraine. Two FSB agents neutralized. A municipal councillor sentenced to 15 years. These names will never make headlines. But without these quiet victories, certain Ukrainian cities would have burned differently. The secret war is no less real than the visible war. It is just less filmable.*

## The SBU-FBI digital alliance: a model for the collective defense of the West

### Cooperation between allies as a response to transnational digital threats

The joint publication by the **SBU and FBI** of their findings on the Russian hacking campaign is symbolically and practically important. It illustrates a **transatlantic cybersecurity cooperation** that goes beyond the usual discreet exchanges between intelligence services. Publishing together means amplifying the impact, forcing **transparency about Russian methods**, and sending a signal to hesitant allies: we are working together, our intelligence is shared, your security is linked to ours.

This form of open cooperation is a strategic response to the Russian **hybrid warfare** doctrine that seeks precisely to sow distrust between allies, to exploit **information silos** between **national intelligence services**, to take advantage of the slower reaction time of democracies. By publicly and jointly exposing Russian operations, the **SBU and FBI** **accelerate this reaction time** and make **inter-allied coordination** harder for Moscow to disrupt.

### Lessons for the European **cybersecurity architecture**

The exposure of Russian hacking targeting **EU** officials reminds European institutions that cybersecurity can no longer be treated as a secondary technical dossier. It is a **strategic sovereignty issue** on the same level as conventional defense. **ENISA** (the European Union Agency for Cybersecurity) and **national CERTs** must have the **resources, mandates**, and **action capabilities** commensurate with the scale of the threat documented by the joint **SBU-FBI** report.

Ukraine, with its experience of **more than ten years of intensive Russian cyberwarfare** — from the **2017 NotPetya attacks** to current operations — has become the involuntary laboratory of **democratic cyber resistance**. The lessons it has learned, often painfully, are exactly what Europe needs. Structured cooperation between **Ukrainian cyber services and their European counterparts** could **strengthen collective security** across the entire continent. The **SBU-FBI** model must become the **SBU-ENISA** model.

*Ukraine has **ten years of advance** on Europe in Russian cyber warfare. It knows how it works. It knows how to resist. Europe would do well to listen. Not as a victim being helped, but as an **expert being consulted**. The SBU-FBI report is not just a crime exposé. It is a **lesson in digital resilience**.*

## Conclusion: the **invisible war** that also decides victory

### The digital war is not secondary

This commentary defends a simple thesis: **the digital war is not secondary** to the physical war. It is an integral component of it — one that conditions the effectiveness of physical operations, the cohesion of alliances, the quality of intelligence, and the resilience of the democracies supporting Ukraine. The joint SBU-FBI publication of June 25, 2026 is its demonstration: two intelligence services from different countries, uniting their forces in a domain that most citizens cannot see, but whose effects can be measured in compromised military strategies and infiltrated allies.

Ukraine is fighting this invisible war with the same determination with which it fights the drone war or the defense of trenches. It foils terrorist plots in Kyiv, it arrests spies, it exposes hacking campaigns in cooperation with its American allies. These victories do not make the big headlines. They do not produce the spectacular images of refineries in flames in Moscow. But they **secure the foundation on which the visible victories are built**.

### What this commentary takes from the direction of the conflict

The week of June 23–25, 2026, viewed through the prism of digital warfare and counter-intelligence, confirms a trend: Ukraine is managing simultaneously **multiple hybrid threats** with growing effectiveness. It repels physical assaults. It strikes deep into Russian infrastructure. It exposes hacking campaigns through international cooperation. It arrests internal agents. It foils attacks. And it does so continuously, relentlessly, month after month.

This multi-domain capacity is the sign of a state that is resisting not only militarily but institutionally — a state that maintains its essential functions — security, justice, intelligence — under conditions that few governments in history have had to face. **The SBU and FBI publishing a joint cybersecurity alert** on June 25, 2026 — this is also proof that Ukraine is not alone, and that it will be less and less so.

*The invisible war is fought in messaging apps, servers, and officials' tablets. It is won by exposing methods, cooperating, and adapting. Ukraine has been fighting it for ten years. And every joint SBU-FBI report is a victory in this war that cannot be seen, but whose effects can be measured.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [UNN — "SBU and FBI expose Russian special services hacking messengers of officials in Ukraine, EU and US" — June 25, 2026](https://unn.ua/en/news/sbu-and-fbi-expose-russian-special-services-hacking-messengers-of-officials-in-ukraine-eu-and-us)

- [Euromaidan Press — "Ukraine arrests eight people accused of cheering on Russian strikes from inside the country and spying" — June 23, 2026](https://euromaidanpress.com/2026/06/23/ukraine-arrests-eight-people-accused-of-cheering-on-russian-strikes-from-inside-the-country-and-spying/)

- [SSU (SBU) Main page — June 23, 2026](https://www.ssu.gov.ua/en)

### Secondary sources

- [RBC-Ukraine — "Russian hackers targeted officials across Ukraine, Europe and US" — June 25, 2026](https://newsukraine.rbc.ua/news/russian-hackers-targeted-officials-across-1782379481.html)

- [Euromaidan Press — "EU leaders agree to renew Russia sanctions for 12 months" — June 19, 2026](https://euromaidanpress.com/2026/06/19/eu-leaders-agree-to-renew-russia-sanctions-for-a-full-year-for-the-first-time-as-bulgarias-pro-russian-leader-vows-to-veto-the-next-batch/)

- [ISW Assessment June 23, 2026 — June 24, 2026](https://understandingwar.org/research/russia-ukraine/russian-offensive-campaign-assessment-june-23-2026/)

- [x] 150+ strong tags throughout

- [x] 6 a href ONLY in Sources section, URLs identical to source

- [x] Signature: Signed Maxime Marquette, columnist

- [x] Transparency box: "Columnist's transparency box"

- [x] No forbidden tags (br hr ul ol li div span img table td tr iframe script style)

- [x] No markdown, no [1] refs

- [x] 2400+ words

- [x] Dates in English format

- [x] Genre prefix: COMMENTARY

- [x] Title max 110 characters

- -->

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/commentaire-sbu-et-fbi-contre-les-hackers-russes-la-menace-numerique-sur-l-occid