# ESSAY: Ukraine's Cyber War Enters the European Age — the Cybersecurity Reserve

> In June 2026, Ukraine crossed a decisive threshold in the digital war that Russia has imposed on it for more than four years: the Ukrainian parliament ratified an agreement giving Kyiv access to the European Union Cybersecurity Reserve. This mechanism, managed by ENISA — the European Union Agency for Cybersecurity — and established under the European Cyber Solidarity Act, now a

- Author: Maxime Marquette
- Publisher: MadMax (https://mad-max.co)
- Section: Essay
- Published: 2026-06-29
- Canonical URL: https://mad-max.co/en/article/essai-la-cyberguerre-ukrainienne-entre-dans-l-age-europeen-la-reserve-de-cyberse

## Introduction: when digital warfare demands digital alliances

### Unprecedented access to the European cyber arsenal

In **June 2026**, **Ukraine** crossed a decisive threshold in the digital war that **Russia** has imposed on it for more than four years: the Ukrainian parliament ratified an agreement giving **Kyiv** access to the **European Union Cybersecurity Reserve**. This mechanism, managed by **ENISA** — the European Union Agency for Cybersecurity — and established under the European **Cyber Solidarity Act**, now allows **Ukraine** to request the intervention of EU-certified private experts in the event of a major cyberattack against its critical infrastructure.

This is not a declaration of principle or a symbolic memorandum. It is an operational mechanism: if a large cyberattack strikes Ukrainian government networks, the electrical grid, or hospitals, **Kyiv** can now trigger emergency European assistance, benefit from support in containing and neutralizing the attack, assess threats, and restore systems as quickly as possible. According to **Militarnyi**, the **EU** has completed all required legal procedures, and the mechanism is officially in force.

*What Europe is doing with this Cybersecurity Reserve is acknowledging a truth that policymakers still hesitate to state plainly: Ukraine is not at Europe's border — it is Europe's cyber shield. What strikes Kyiv today is preparing what will strike Warsaw, Berlin, or Paris tomorrow.*

## The Cybersecurity Reserve: anatomy of a novel mechanism

### The Cyber Solidarity Act as legal framework

The European **Cyber Solidarity Act** — adopted by the **EU** to strengthen collective incident response capabilities — is the legal framework within which the **Cybersecurity Reserve** sits. This legislative text provides for the creation of a network of **Security Operations Centers (SOCs)** across Europe, the establishment of a reserve of trusted private providers, and mechanisms for information sharing and mutual assistance between member states.

Integrating **Ukraine** into this arrangement represents an extension of the European cyber solidarity perimeter beyond **EU** borders. It recognizes that the Russian cyber threat does not respect geographic or political boundaries — and that defending **Ukraine** digitally contributes directly to the security of the entire European digital space.

### What access to the Reserve changes in concrete terms

Before this agreement, **Ukraine** had to manage its cyber crises with its own resources — often limited, often saturated — or seek ad hoc bilateral assistance from partners such as the **United States**, the **United Kingdom**, or the Baltic states. From now on, a formal and pre-activated mechanism grants access to a pool of private cybersecurity providers certified by **ENISA**.

The practical difference is considerable. Searching for cyber experts in an emergency during an active attack is like looking for firefighters during the fire. Having a **pre-activated Reserve** mechanism, with already-vetted providers and established response protocols, means having firefighters on site before the flames begin. For **Ukraine**, which has endured continuous cyberattacks for years, this time difference can mean the difference between containing an attack and suffering a national catastrophe.

*Since 2014, Ukraine has been the global laboratory of Russian cyberwarfare. NotPetya in 2017 began as a Ukrainian attack before spreading worldwide and costing tens of billions of dollars. Europe was slow to understand that this laboratory was right on its doorstep. At last, it is acting accordingly.*

## Russian cyberattacks: a war running parallel to the trenches

### The documented scale of Russian digital aggression

The cyberwar that **Russia** is waging against **Ukraine** is the longest and most intense ever documented in the history of modern conflicts. According to available data, Ukrainian intelligence services (**SSU**) and the American **Federal Bureau of Investigation (FBI)** exposed in **June 2026** a Russian cyber-espionage campaign targeting email accounts of government officials, military personnel, politicians, and activists in **Ukraine**, **Europe**, and the **United States**.

This campaign is sophisticated in its methods: sending SMS messages impersonating official support services, tricking users into revealing their passwords, and often targeting victims in the early hours of the morning when vigilance is reduced. Dozens of government officials in **Romania**, **Greece**, **Bulgaria**, and **Serbia** were also targeted — a concrete illustration of the transnational reach of this Russian digital war.

### The Jaguar Land Rover precedent: when cyberwar hits the economy

In **August 2025**, an attack attributed by British and American investigators to Russian hackers struck automaker **Jaguar Land Rover**. The result: five weeks of complete production shutdown in plants across **England**, **Brazil**, **China**, **India**, and **Slovakia**, a cost of **$350 million** to the company and **$2.5 billion** to the British economy according to **United24 Media** — making it the most expensive cyberattack in **UK** history.

This case illustrates a reality that **British Defense Secretary Dan Jarvis** stated bluntly: hostile countries have understood that "the most effective way to attack is not through direct military confrontation, but by silently hollowing out the economy from within." Russian cyberwarfare is not only a war against Ukrainian military networks — it is a war against the economic fabric of all the democracies supporting **Kyiv**.

*$2.5 billion. For a single attack on a single automaker. And Moscow denies everything, as usual. That figure must be understood not as an anomaly but as a reproducible template — one that Russia will apply whenever the cost-benefit calculation favors it. The European Cybersecurity Reserve is a partial answer to that template. Partial, but real.*

## Ukrainian Cyber Forces legislation: a delicate legislative undertaking

### A bill pending since October 2025

Paradoxically, at the very moment **Ukraine** was gaining access to the **European Reserve**, its own legislative framework for cyber operations remained unfinished. The bill establishing **Cyber Forces** as a separate branch of the armed forces had been approved in a first reading in **October 2025**, then revised in **March 2026** to include provisions for active cyber defense, incentives for successful operations, and the creation of a civilian resistance component.

But in **June 2026**, a second reading had still not taken place, despite parliamentary officials declaring the text "finalized." This legislative paralysis has practical consequences: Ukrainian cyber units are already operating — conducting cyber intelligence and military cyber operations — but doing so without formal legal status, in a legal grey zone that complicates command, budgets, and accountability.

### The problem of inter-institutional competition

Member of Parliament **Oleksandr Fediienko** identified a structural problem in the Ukrainian approach to cyberwarfare: Ukrainian institutions sometimes compete in cyberspace rather than working together against the enemy. The intelligence services (**SSU**), the armed forces, and the Ministry of Digital Transformation sometimes operate parallel cyber capabilities with mandates and priorities that can overlap or conflict.

Creating unified command under the direct authority of the **Commander in Chief of the Armed Forces** — which the **Cyber Forces** bill provides for — is precisely the structural reform that would eliminate these duplications and internal friction. While waiting for the law's passage, access to the **European Cybersecurity Reserve** at least provides an external emergency resource that partially offsets internal organizational weaknesses.

*Inter-institutional competition in a war zone is a luxury Ukraine cannot afford. I understand the bureaucratic logic — it exists everywhere, in every country — but in a real-time cyberwar, legislative slowness has a cost. Every week without a unified cyber command is a week where Russia exploits coordination gaps. That is not a criticism — it is a finding.*

## NotPetya and the legacy of Ukrainian cyberwarfare

### Ukraine as a global testing ground

The history of Russian cyberwarfare against **Ukraine** predates the large-scale invasion of **2022** by years. The attacks on the Ukrainian electrical grid in **2015** and **2016** were the first cyberattacks to physically cut electricity to civilian populations. The **NotPetya** attack of **2017** — initially deployed against Ukrainian companies via accounting software — spread worldwide and caused more than **$10 billion** in global damages.

This legacy is crucial for understanding why access to the **European Reserve** matters: **Ukraine** is not a naive or helpless state in the face of the Russian cyber threat. It has developed significant defensive expertise over a decade, often acquired under fire. But that expertise, however real, is no longer sufficient against the scale of Russian attacks in **2025–2026**, which combine sophisticated espionage operations, unique ransomware, and large-scale digital disinformation campaigns.

### The multiplication of attacks since 2022

Since the start of the full-scale invasion in **February 2022**, Russian cyberattacks against **Ukraine** have taken on a new dimension: they are coordinated with ground and air military operations, targeting Ukrainian command and communication systems before major offensives, or civilian infrastructure in parallel with bombardments. Attacks on Ukrainian government networks, energy operators, and transportation systems have become nearly daily.

In **April 2026**, Reuters revealed that Russian hackers had compromised more than **170 email accounts** belonging to Ukrainian prosecutors and investigators responsible for combating corruption and identifying Russian agents — a targeted intelligence operation of surgical precision aimed at the most sensitive institutions of the Ukrainian state. It is against that backdrop of continuous and sophisticated attacks that access to the **European Reserve** must be evaluated.

*Compromising 170 prosecutors' and investigators' accounts — that is human intelligence carried out by digital means. Not mass hacking, but precise targeting of individuals who investigate corruption and Russian networks. That is where the true sophistication of Russian cyberwarfare lies: it does not merely seek to destroy — it seeks to know and to infiltrate.*

## ENISA and the architecture of European cyber defense

### The European Cybersecurity Agency as a pivot

**ENISA** — the European Union Agency for Cybersecurity — is the central institution managing the **Cybersecurity Reserve** at the **EU** level. Established in **2004** and with a mandate substantially strengthened by the **Cybersecurity Act** of **2019** and the more recent **Cyber Solidarity Act**, **ENISA** now plays a role for cybersecurity comparable to what **NATO** plays for conventional defense: it provides a common framework, shared standards, and mechanisms for collective solidarity.

Integrating **Ukraine** into this system represents a qualitative leap in the cyber relationship between **Brussels** and **Kyiv**. It is no longer merely ad hoc assistance or occasional bilateral support — it is integration into the European institutional architecture of cybersecurity, with the rights and obligations that entails in terms of information sharing and operational cooperation.

### Certified private providers: the backbone of the Reserve

The **Cybersecurity Reserve** relies on a network of private cybersecurity providers certified by **ENISA** — specialist firms capable of responding in emergencies in areas including incident response, forensic analysis, remediation, and restoring compromised systems. These providers are pre-selected, vetted, and prepared to intervene according to pre-established protocols within tight timeframes.

For **Ukraine**, accessing this network means being able to mobilize within hours — not weeks — dozens of experienced specialists who have already worked on the most sophisticated threats documented in **Europe**. It is a significant cyber force multiplier — all the more so because large-scale Russian cyberattacks are rarely simple events: they combine multiple vectors, customized malware, and zero-day exploits that require precisely this kind of specialized expertise available at short notice.

*I long believed cybersecurity was a domain of solitary expertise — computing geniuses solving complex problems in air-conditioned basements. The reality of cyberwarfare is quite different: it is about teams, coordination, protocols, and mutual trust between institutions. The European Reserve builds exactly that — and it is precious.*

## Russia in cyberspace: a hostile power to be contained

### APT28, Fancy Bear, and the gallery of Russian groups

Western intelligence services have documented numerous hacker groups linked to Russian services. The best known is **APT28** — also known as **Fancy Bear** — linked to the **GRU**, Russian military intelligence. This group has been accused of hacking the American **Democratic National Committee** ahead of the **2016** elections, running campaigns against **NATO** targets, and exploiting standard Internet routers to steal passwords and sensitive data from allied countries providing military support to **Ukraine**.

The **British National Cyber Security Centre** had issued specific warnings about **APT28** well before the **Jaguar Land Rover** attack — and yet that attack happened. This painful finding illustrates a fundamental challenge of defensive cybersecurity: perfect prevention is impossible against adversaries with state resources, time, and strategic motivation. The response must therefore combine prevention with rapid response capability — which is precisely what the **European Reserve** specifically provides.

### The digital supply chain as an attack vector

The **NotPetya** attack of **2017** exploited a vulnerability in a widely used Ukrainian accounting software package — **M.E.Doc** — to spread massively. This so-called **software supply chain attack** technique is one of the most formidable because it strikes not the final target but its software suppliers or partners, who are often less well protected.

In **2025–2026**, this tactic became more sophisticated: Russian services now target legitimate software updates, enterprise collaboration platforms, and cloud service providers used by Ukrainian institutions or their partners. Responding to this type of attack requires precisely the combination of specialized private expertise and coordinated inter-state response that the **European Cybersecurity Reserve** enables.

*The supply chain attack is the perfect metaphor for Russian cyberwarfare: strike not the adversary but those the adversary depends on. NotPetya began in Ukraine and spread worldwide via corporate software. That was the lesson Europe should have learned in 2017. It seems to have finally learned it — nine years late, but better late than never.*

## The strategic stakes of Euro-Ukrainian cyber integration

### A signal of European integration beyond declarations

Ukraine's access to the **European Cybersecurity Reserve** is a concrete act of integration that precedes formal **EU** membership — a model that could be reproduced in other domains. It sends a strong diplomatic signal: **Brussels** treats **Ukraine** as a full security partner, not as an accession candidate waiting in the wings.

This signal has geopolitical implications beyond cybersecurity: it reinforces **Ukraine**'s legitimacy as a European state integrated into collective security structures, and creates a precedent for other operational partnerships with non-member states. **Moldova**, **Georgia**, or other states potentially targeted by Russian cyber operations could benefit from similar agreements.

### The question of data and digital sovereignty

Integration into the **European Reserve** nevertheless raises complex questions about Ukrainian digital sovereignty. When European private providers intervene in Ukrainian computer systems — even with Ukrainian consent and under Ukrainian supervision — this creates flows of sensitive data and access to critical systems that require rigorous governance frameworks.

**ENISA** and the Ukrainian government have established protocols to frame these interventions, but the question of confidentiality for Ukrainian government data shared with foreign private providers deserves continuous attention. That is not a reason to refuse access to the **Reserve** — the operational benefits far outweigh the risks — but it is a dimension that the architects of this agreement have had to, and will need to keep managing carefully.

*Digital sovereignty is a luxury one affords in peacetime. In total cyber war, Ukraine has no choice: it must accept a degree of dependence on its partners to hold its defenses. True sovereignty is rebuilt afterward, once Ukrainian legal and institutional structures are solid enough to operate autonomously. For now, collaboration takes priority.*

## The implications for critical infrastructure defense

### Power grids, hospitals, transport: priority targets

The **European Cybersecurity Reserve** specifically covers attacks against **government networks**, **websites**, **power grids**, and "other critical infrastructure." For **Ukraine**, these three categories correspond exactly to the preferred attack vectors of Russian services: attacks on the Ukrainian power grid in **winter 2022–2023**, in **2024**, and in **2025–2026** deprived millions of civilians of heating and electricity.

Having access to emergency cyber assistance for these infrastructures is not merely a national security issue — it is a direct humanitarian one. An uncontained attack on the Ukrainian power grid in winter can mean deaths from hypothermia among the most vulnerable populations. The **European Reserve** therefore indirectly contributes to protecting civilian life in **Ukraine** — an argument that deserves to be made well beyond technical cybersecurity circles.

### Civil-military coordination in cyber defense

One of the innovations in the pending Ukrainian **Cyber Forces** bill is the creation of a **civilian cyber resistance** component. This provision acknowledges that cyber defense cannot be a purely military affair: civilian infrastructure is a priority target, and its defense requires close coordination between civilian operators and the armed forces.

Access to the **European Reserve** fits this logic: it creates a bridge between European cybersecurity capabilities — primarily developed in the private sector — and Ukraine's cyber defense needs, which are both military and civilian. It is a hybrid architecture matching the hybrid reality of modern cyberwarfare, where the distinction between military and civilian targets is deliberately blurred by the aggressor.

*Civilian cyber resistance — the idea that ordinary citizens can contribute to their country's digital defense — may be the most enduring legacy of the Ukraine war for the rest of the world. Ukraine has de facto built a citizen cyber army since 2022. Giving it a legal framework and European resources means institutionalizing a major military innovation.*

## Toward a broader cyber defense agreement

### Beyond the Reserve: toward systemic integration

Access to the **Cybersecurity Reserve** is an important step but not a destination. For the Euro-Ukrainian cyber collaboration to reach its full potential, several complementary developments are needed: the adoption of the Ukrainian **Cyber Forces** legislation, Ukraine's full integration into the European network of **Security Operations Centers (SOCs)**, and the development of real-time threat intelligence sharing protocols between **Ukraine** and its partners.

These developments fit within a broader frame: the process of **Ukraine**'s accession to the **EU**, which involves the progressive transposition of the full body of European law into Ukrainian legislation — including the directives on the cybersecurity of **network and information systems (NIS2)**. Every step toward legislative harmonization is a step toward more robust collective defense.

### The Ukrainian model as inspiration for NATO

The Ukrainian cyber experience has become a reference in Western defense circles. **NATO**'s **Cooperative Cyber Defence Centre of Excellence** in **Tallinn** has incorporated lessons drawn from the Ukraine war into its operational doctrines. Emergency cyber procedures developed by **Ukraine** under Russian fire — rapid triage, isolation of compromised systems, maintenance of degraded operating capabilities — are being studied by armies that have never faced a state-level cyberattack of this scale.

In that sense, **Ukraine**'s access to the **European Reserve** is not only a benefit for **Kyiv**: it is an investment in transferring cyber knowledge to **Europe**. European experts who intervene in **Ukraine** under this mechanism will learn as much as they teach — and will return home with practical experience of cyberwarfare that no theoretical exercise can replicate.

*There is an irony in the fact that Ukraine — a country so often viewed with condescension as a developing nation on Europe's periphery — has become the world's foremost expert in real-war cyber defense. Europeans would do well to listen as much as they speak when interacting with their Ukrainian counterparts.*

## The limits of cyber defense: what the Reserve cannot do

### A reactive response, not total prevention

Useful as it is, the **Cybersecurity Reserve** mechanism is fundamentally an **incident response** tool — it intervenes after an attack has begun, not before. Preventing cyberattacks remains the responsibility of Ukrainian cybersecurity teams, internet service providers, and critical infrastructure operators who must keep their systems updated, reduce attack surfaces, and apply proper security practices.

No emergency assistance mechanism can compensate for fundamentally vulnerable systems or deficient security practices. The **European Reserve** is a safety net — but a net does not replace solid rails and an attentive conductor. **Ukraine** will need to continue investing massively in training its own cyber experts, upgrading its digital infrastructure, and building a security culture within its institutions.

### The question of funding Ukrainian cybersecurity

Upgrading Ukrainian cyber capabilities requires considerable financial investment — for training experts, acquiring modern security software and equipment, and building functional security operations centers. These investments must be partially funded by Western partners, on equal footing with weapons deliveries and direct budgetary support.

The **EU**'s cyber support program for **Ukraine** includes capacity-building components, but their scale remains insufficient relative to needs. If access to the **Reserve** is a major step forward, investing in Ukraine's indigenous capabilities remains the most important long-term task — the one that will allow **Ukraine** to defend its cyberspace autonomously and sustainably, whether in wartime or peace.

*I note with concern that cybersecurity rarely makes the headlines of military aid announcements for Ukraine. We count tanks, missiles, planes — but security software, training, operational SOCs receive far less attention. That is a strategic mistake that donor countries should correct. Digital warfare is cheaper to fund but yields just as much in terms of defense.*

## What this means for the future of digital security in Europe

### Ukraine as a model for vulnerable states

The agreement between **Ukraine** and the **EU** on the **Cybersecurity Reserve** creates a precedent that could be extended to other states exposed to Russian cyber operations. The Baltic states — **Estonia**, **Latvia**, **Lithuania** — have already developed robust cyber capabilities within **NATO** and the **EU**. **Poland**, **Finland**, and **Sweden** have also invested massively in their cyber defense.

For more vulnerable states — **Moldova**, **Georgia**, and in time other countries in the European eastern neighborhood — the Ukrainian agreement could serve as a model. A wider network of states integrated into the **European Reserve** would create a collective cyber defense perimeter that would significantly reduce opportunities for Russian attacks with regional impact.

### The digital arms race and its ethical implications

The Russian-Ukrainian cyberwar also has a dimension that must be named: it is fueling a digital arms race whose ethical and legal consequences are still poorly defined. The offensive cyber capabilities developed in this conflict — on both sides — are weapons that can have devastating effects on civilian populations when they target essential infrastructure.

International humanitarian law is adapting slowly to this reality. The principles of proportionality and distinction between military and civilian targets must apply to cyber operations — but their practical application in a conflict as intense as the Russian-Ukrainian war remains unclear and contested. The **European Reserve** is a defensive and humanitarian response — it is not an offensive weapon. That distinction must be maintained clearly.

*I am uncomfortable with the idea of normalizing cyberwarfare the way we normalize drones or missiles. Striking a missile factory in Voronezh with cruise missiles is a military action with defined rules of engagement. Striking a power plant with malware in winter, knowing that civilians will die of cold — that is something else entirely. These ethical distinctions matter, even in wartime.*

## The offensive dimension of the Cyber Reserve — between defense and retaliation

### Cyber defense or cyber offense — the blurred line Ukraine navigates

The **Ukrainian Cyber Reserve** is officially presented as a defensive tool — protecting critical infrastructure, detecting intrusions, responding to incidents. But in the context of war, the boundary between defense and offense in cyberspace is particularly permeable. Units maintaining the resilience of Ukrainian computer systems could, with the same tools and skills, conduct offensive operations against Russian infrastructure.

Security reports document Ukrainian cyber operations against Russian targets — disruptions of transportation infrastructure, infiltrations of military communication systems, compromise of Russian government databases. These operations, attributed to groups like **IT Army of Ukraine** or to actors linked to Ukrainian intelligence services, demonstrate that Ukrainian cyber capability is not purely defensive. The **Cyber Reserve**, with its **115 profiles** of Russian malware and its accumulated expertise, is a potential platform for operations in both directions.

### The legal and strategic implications of offensive cyber operations

Offensive cyber operations in wartime raise complex legal questions that international law has not yet fully resolved. When a cyberattack disrupts civilian infrastructure — even in an aggressor country — can it be justified by the same principles that authorize military strikes against dual-use installations? The **Tallinn Manual**, developed by international cyber law experts, attempts to answer these questions — but its conclusions remain contested.

For **Ukraine**, the practical answer is proportionality: targeting Russian military infrastructure in cyberspace the same way it targets them with drones and missiles. This doctrine is defensible. And the **Cyber Reserve**, with its expertise on **OT** (**Operational Technology**) systems — the industrial control systems used in power plants, pipelines, and transportation infrastructure — possesses exactly the capabilities needed for such operations.

*The line between defense and offense in cyberspace is a useful fiction — useful for treaties, useful for official statements, useful for public relations. In operational reality, the same tools serve both purposes. And Ukraine, fighting for its survival, cannot afford a purely passive cyber defense when its adversaries are on total offense.*

## The future of cooperation: toward a Euro-Ukrainian cyber shield

### The next steps of Ukraine-ENISA cyber integration

The agreement on the **Ukrainian Cyber Reserve** with **ENISA** is a starting point, not a finish line. The logical next steps of this integration include broader access to threat intelligence from **ENISA** and its national partners, joint exercises simulating major cyberattacks, and potentially a bilateral cyber defense agreement that goes beyond the **ENISA** framework to include mutual response commitments in the event of a major attack.

In the perspective of **Ukraine**'s accession to the **EU**, building this cyber cooperation infrastructure is as important as legislative harmonization or judicial reforms. An **EU** member state that is not integrated into European cyber defense systems is a vulnerability for the entire **Union**. Building that integration now, during the war, while **Ukraine** is developing its expertise at an exceptional pace, is far more effective than waiting for formal accession.

### The Ukrainian model as a template for other vulnerable countries

What **Ukraine** is building — a **civilian Cyber Reserve** integrated into a national cyber defense architecture, connected to European intelligence-sharing systems, with a documented library of adversary attack methods — could serve as a model for other countries facing persistent state-level cyber threats. The Baltic states, exposed to the same Russian actors, have already developed advanced cyber defense capabilities. **Moldova**, **Georgia**, other post-Soviet states targeted by the same Russian techniques could benefit from an adaptation of the Ukrainian model.

**ENISA** has a natural role to play in this dissemination — by standardizing methods, facilitating expertise sharing, and creating a European network of cyber resilience of which the Ukrainian experience is the centerpiece. A **Europe** that learns from this war, that transforms hard-won lessons into lasting institutional capabilities — that is the Europe that will be able to resist future hostile state cyber actors.

*Ukraine is building during wartime what other countries take decades to build in peace. Its Cyber Reserve, its operational experience, its 115 profiles of Russian malware — that is a knowledge heritage it shares with its allies. Learning from Ukraine is the best way to pay it tribute.*

## Conclusion: a cyber agreement for a total cyberwar

### A milestone in Euro-Ukrainian security integration

Ukraine's access to the **European Cybersecurity Reserve** marks a significant moment in the history of the collective Western response to the Russian cyber threat. It is not spectacular like the announcement of a tank or missile delivery, but it is potentially just as important: a digital defense infrastructure that can make the difference between a contained cyberattack and a national infrastructure catastrophe.

**Europe** took too long to understand that the Russian cyberwar against **Ukraine** was its war too. With this agreement, it is beginning to act accordingly. Much remains to be done — the Ukrainian **Cyber Forces** law still needs to be adopted, investments reinforced, protocols refined — but the direction is right. And in a war where every week counts, a right direction is already a great deal.

### The cyber war does not end with the physical war

We must prepare for an uncomfortable reality: the Russian cyberwar against **Ukraine** and its partners will not stop with an eventual ceasefire on the ground. Russian offensive cyber capabilities are a permanent infrastructure, not a tactical response to a limited conflict. Even in "peacetime," **Russia** will continue to use its cyber capabilities against states that have sanctioned it, supported **Ukraine**, and documented its war crimes.

The **European Cybersecurity Reserve**, the integration of **Ukraine** into the **EU**'s cyber architecture, and the final adoption of the Ukrainian **Cyber Forces** are therefore investments in the long-term security of the European digital space — regardless of how military operations on the ground evolve. It is in that durable perspective that their importance must be evaluated.

*A cyber agreement. One hundred and fifteen profiles of Russian malware catalogued. A civilian reserve integrated with ENISA. Not glamorous as a military victory headline. But perhaps it is there — in these invisible infrastructures of digital resistance — that some of the most enduring battles of this war are being fought. I believe in that dimension of the conflict as much as I believe in missile strikes.*

**By Maxime Marquette, columnist**

## Columnist's transparency note

### Editorial stance

I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

### Method and sources

This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here.

**Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

**Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**.

### Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.

## Sources

### Primary sources

- [Militarnyi — Ukraine Secures Access to EU Cybersecurity Reserve as Cyber War Intensifies — June 23, 2026](https://militarnyi.com/en/news/ukraine-access-to-eu-cybersecurity-reserve/)

- [Militarnyi — SSU, FBI Uncover Russian Hacking Campaign Against Officials in Ukraine, Europe and the U.S. — June 25, 2026](https://militarnyi.com/en/news/ssu-fbi-uncover-russian-hacking-campaign-against-officials-in-ukraine-europe-and-the-u-s/)

- [United24 Media — Investigation Reveals Russian Hackers Behind Massive Cyberattack That Cost UK $2.5 Billion — June 27, 2026](https://united24media.com/world/investigation-reveals-russian-hackers-behind-massive-cyberattack-that-cost-uk-25-billion-20208)

### Secondary sources

- [Euromaidan Press — Russia is manipulating global AI chatbot ecosystems with fabricated reference sites — June 23, 2026](https://euromaidanpress.com/2026/06/23/russia-expands-disinformation-strategy-to-target-ai-ecosystems/)

- [Kyiv Independent — Fact check: Russian disinformation takes aim at Poland-Ukraine rift — June 24, 2026](https://kyivindependent.com/fact-check-russian-disinformation-takes-aim-at-poland-ukraine-rift/)

- [Ukrainian Presidency — Joint Leaders Statement of Ukraine and the UK on Strategic Dialogue — June 23, 2026](https://www.president.gov.ua/en/news/spilna-zayava-lideriv-ukrayini-ta-spoluchenogo-korolivstva-v-103389)

---

Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/essai-la-cyberguerre-ukrainienne-entre-dans-l-age-europeen-la-reserve-de-cyberse