# FACT-CHECK: Did Ukraine's IT Army really pivot toward Russian military targets? > I want to begin with a warning I apply to myself: it is easy to glorify the IT Army because it is fighting for a country that deserves our solidarity. But solidarity must not replace rigor. If certain - Author: Maxime Marquette - Publisher: MadMax (https://mad-max.co) - Section: Analysis - Published: 2026-07-02 - Canonical URL: https://mad-max.co/en/article/fact-check-l-it-army-ukrainienne-a-t-elle-vraiment-pivote-vers-les-cibles-milita ## Key takeaways - Claim 1 (rated true with nuance): The IT Army, founded in February 2022, began with DDoS attacks on Russian banks and institutions, then moved toward military targets such as Starlink terminals and CCTV systems. - Claim 2 (plausible, not verified): Reports that Ukrainian hackers tracked Russian drone launches for six months through Belarusian cell towers lack official confirmation or accessible primary evidence. - Claim 3 (partially confirmed): Fake Starlink registration channels used to locate Russian units fit known methods and are corroborated in broad outline, but lack full primary documentation. - Claim 4 (not verified): The figure of 10,000 compromised surveillance systems, attributed to the UK's NCSC, could not be found in official reports, although the threat itself is real. - Claims 5 and 6 (true in broad outline): Five Eyes assessments on offensive AI are documented, and Russia's large offensive cyber arsenal provides the symmetric context. ## Introduction: fact-checking what is said about Ukrainian cyberwarfare ### The claims circulating about the IT Army Since the start of the full-scale Russian invasion in **February 2022**, the **Ukrainian IT Army** has become one of the most commented-upon phenomena of the digital war. The accounts circulating about it pile up the superlatives: attacks on banks, infiltration of surveillance cameras, disruption of Russian **Starlink** terminals, surveillance of drone operators, creation of fake recruitment channels — all with growing sophistication. But what has been verified? What falls under careful inference? And what remains in the gray zones where unsubstantiated claims proliferate? This fact-check examines the main claims about the evolution of the **Ukrainian IT Army** — its transition from economic to military targets, its most documented operations, and its real limitations. It draws on verifiable primary sources and maintains a rigorous distinction between what is established, what is plausible, and what goes beyond the available evidence. Cyberwarfare is a domain where disinformation — on both sides — is a tactical instrument. Factual clarity is therefore an obligation here, not an option. ## Claim #1: The IT Army pivoted from economic to military targets ### What is established: TRUE, with nuance The **Ukrainian IT Army**, founded by the Ukrainian government in **February 2022** via an announcement by Digital Transformation Minister **Mykhailo Fedorov**, has indeed evolved in its target selection. In its first weeks, it focused on **distributed denial-of-service** (**DDoS**) attacks against the websites of Russian banks, businesses, and government institutions — high-visibility symbolic targets but with limited military impact. This first phase is well documented. The shift toward more military targets is corroborated by multiple sources. Operations targeting Russian **Starlink terminals**, military communication systems, and surveillance cameras (**CCTV**) in conflict zones are mentioned in Western and Ukrainian security reports. The **Foundation for Defense of Democracies** (**FDD**) and several specialized publications have documented this evolution. **VERDICT: TRUE, partially confirmed** — the pivot is real, even if the full scope of operations cannot be entirely verified from the outside. ## Claim #2: Ukrainian hackers infiltrated the chatrooms of Russian drone operators ### What is established: PLAUSIBLE but not officially confirmed The claim that Ukrainian computer specialists infiltrated communication channels of Russian drone operators using **Belarusian cellular towers**, tracking their launch routes for **six months** before transmitting the data to Ukrainian defenses, circulates in several specialized publications. The level of detail is notable — the six-month duration, the Belarusian cellular method, the transmission to air defenses. These elements are consistent with the known capabilities of the **IT Army** and with the Ukrainian doctrine of intelligence-air defense fusion. However, this claim has not been officially confirmed by the Ukrainian government or by independently verifiable sources as of the writing of this article. It belongs to the category of information that is **plausible and consistent with known capabilities**, but not documented with accessible primary evidence. The most successful intelligence operations are precisely those that are not discussed while they are still active. **VERDICT: PLAUSIBLE but not verified by independent primary sources.** ## Claim #3: Fake Starlink channels allowed Ukrainian forces to locate Russian units ### What is established: PARTIALLY CONFIRMED The operation of creating **fake Starlink registration channels** to collect data on Russian units, their contacts, and the location of their terminals has been described in multiple security reports and journalistic investigations. This tactic fits within a broader strategy of exploiting Russian operational security failures in their use of commercial technologies. Russian soldiers using **Starlink** terminals for internet access frequently underestimated the location and tracking risks that such use entails. Corroborating elements exist: the Ukrainian government has documented and communicated on operations of this type in general terms, without revealing operational details that would compromise still-active capabilities. The operation's logic is sound from an offensive security standpoint. **Starlink** is used extensively by both sides, and its vulnerabilities have been documented in academic and industry publications. **VERDICT: PARTIALLY CONFIRMED** — a credible operation consistent with known methods, corroborated in its broad outlines but without complete primary documentation. ## Claim #4: Five Eyes confirmed that 10,000 surveillance systems were compromised ### What is established: NOT VERIFIED in its exact wording The claim that the British **NCSC** — the **United Kingdom**'s national cybersecurity agency — confirmed that **10,000 surveillance systems** had been compromised to spy on Western aid to **Ukraine** circulates in some cyberwarfare summaries. That precise figure of **10,000** and its attribution to the **NCSC** could not be verified in the official public reports of that agency at the time of writing this article. What is independently confirmed: the **Five Eyes** has published joint alerts on Russian cyber threats targeting Western infrastructure and **Ukraine** support networks. Civilian surveillance systems (**CCTV**) are regularly identified as espionage vectors in Western security bulletins. But the figure of **10,000** systems compromised specifically to spy on aid to **Ukraine**, attributed to an explicit **NCSC** confirmation, goes beyond what available public documents allow one to assert. **VERDICT: NOT VERIFIED in its exact wording — the threat to surveillance systems is real, the specific figure is not corroborated by accessible primary sources.** ## Claim #5: Offensive AI could reshape cyberwarfare in months, according to Five Eyes ### What is established: TRUE in its broad outlines Western intelligence alliances, including the **Five Eyes**, have indeed published assessments on the potential of **offensive artificial intelligence** in cyber operations. These assessments express growing concerns about the use of AI to automate attacks, accelerate vulnerability discovery, and sophisticate disinformation campaigns. The formulation **"offensive AI could reshape cyberwarfare in months"** is consistent with the tone of recent bulletins. The Ukrainian context amplifies these concerns: the war in **Ukraine** is the first high-intensity conflict in which both parties have access to the latest generation of commercial and military AI tools. Reports from **CNBC** in **July 2026** confirm that **China** is also using AI-powered cyberattacks against American technology companies, signaling a convergence of state-sponsored cyber threats. **VERDICT: TRUE** — Five Eyes assessments on the risks of offensive AI are real and documented, even if the exact wording of the citation may vary across reports. ## Claim #6: Russia also uses cyberspace — the symmetric threat ### Russian cyberattacks against Ukraine and the West: current state Any analysis of Ukrainian cyberwarfare would be incomplete without examining the Russian dimension. **Russia** maintains a considerable offensive cyber arsenal, deployed by entities such as the **GRU**, the **FSB**, and affiliated groups like **APT28** (**Fancy Bear**), **APT29** (**Cozy Bear**), and **Sandworm**. These actors have targeted Ukrainian critical infrastructure — power grids, communications systems, government databases — repeatedly since **2014** and with increased intensity since **2022**. The **NotPetya** attacks of **2017**, technically attributed to **Russia**, caused billions of dollars in global damage — that is the level of capability to which the **Ukrainian IT Army** is responding. Western intelligence services have regularly warned of Russian operations aimed at spying on **Ukraine** support networks — notably weapons supply logistics chains, diplomatic communications, and port infrastructure. The **Kyiv Post** reported in **June 2026** that Latvian intelligence had detected Russian preparations for **hybrid operations** against the **Baltic states** and **Poland**. This symmetric context is essential for evaluating Ukrainian cyberwarfare: the **IT Army** is not operating in a vacuum; it operates in an environment where the adversary possesses equally sophisticated capabilities. ### Lessons for NATO cybersecurity What the war in **Ukraine** has produced most usefully for Western partners is an unprecedented accumulation of operational experience in cybersecurity under real wartime pressure. **Intrusion detection systems**, incident response protocols, **threat hunting** tactics developed or tested in this context are directly transferable to the defense of **Atlantic Alliance** infrastructure. Cybersecurity companies such as **Microsoft**, **CrowdStrike**, and European players have established operational partnerships with Ukrainian agencies, creating a two-way skills transfer. **Ukraine** transmits cyber combat knowledge just as it transmits drone warfare lessons to its allies. For **NATO**, the cyber dimension of the Ukrainian conflict has reinforced awareness that **collective cyber defense** is not a theoretical subject. **Alliance** communication systems are targets. The critical infrastructure of **NATO** members is vulnerable. And the tools developed by the **Ukrainian IT Army** and its partners to respond to these threats in real time constitute a catalog of best practices that **NATO** would be unwise not to study systematically. ## Fact-check assessment and a real portrait of the IT Army in 2026 ### What the IT Army has actually accomplished Beyond the specific claims verified or refuted, there is an overall picture of the **Ukrainian IT Army** that emerges from available reliable sources. The organization has demonstrated real capabilities for disrupting Russian services, conducting information operations, and supporting air defense through the collection of intelligence via digital channels. It has contributed to documenting and exposing Russian violations of international law, notably through the collection of geospatial data and open-source analysis (**OSINT**). It has also evolved from a disorganized volunteer force into a more professional structure, integrated to varying degrees with Ukraine's official intelligence services. Partnerships with Western private cybersecurity companies have strengthened its technical capabilities. **Italy**, according to a **United 24 Media** report from **June 2026**, allocated a new million euros to strengthen **Ukrainian cyber defense** — a sign that allies are taking this dimension of the conflict seriously. Ukrainian cyberwarfare is real, documented, and supported. What demands exaggeration is what falls short of the mark. ## Conclusion: Ukrainian cyberwarfare, between impressive reality and amplified narrative ### What the fact-check tells us about the information war This fact-check highlights a tension inherent in covering cyberwarfare: the most successful operations are precisely those that cannot be discussed while they are still active. The **Ukrainian IT Army** has real successes — but complete external validation of its most sensitive operations arrives with a structural delay. Unverifiable claims are not necessarily false. They may simply reflect real operations whose public documentation is not yet available. What we can state with certainty: **Ukraine** has developed remarkable cyber capabilities since **2022**. These capabilities have evolved from economic to military targets, in line with the needs of the war. They benefit from Western partner support. And they exist within a global context where major powers — **Russia**, **China**, **Iran** — use cyberspace as a full theater of war. Vigilance is necessary. Factual rigor is too. **By Maxime Marquette, columnist** ## Columnist's transparency note ### Editorial stance I am not a journalist but a **columnist and analyst**. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies. I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. **I claim analytical clarity**, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events. ### Method and sources This text keeps the basic distinction between **verified facts and interpretive analysis**. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under **Sources**, never here. **Primary source families** used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies. **Secondary source families**: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations. When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under **Sources**. ### Nature of the analysis The analyses, interpretations and perspectives in the analytical sections of this article are a **critical, contextual synthesis** based on the information available, the trends observed and the expert comments cited in the sources consulted. My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors. This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text. ## Sources ### Primary sources - [Euromaidan Press — Archives on hackers and Ukrainian cyber operations — July 2026](https://euromaidanpress.com/tags/hackers/) - [United 24 Media — Italy to allocate another EUR 1 million to strengthen Ukraine's cyber defense — June 2026](https://united24media.com/world/italy-to-allocate-another-eur1-million-to-strengthen-ukraine-cyber-defense-20367) - [Kyiv Independent — Ukraine war news — July 2026](https://kyivindependent.com/ukraine-war-latest-141/) ### Secondary sources - [Euromaidan Press — Ukraine defense and cybersecurity news — July 2026](https://euromaidanpress.com/category/news-ukraine/) - Militarnyi — Ukrainian defense and military operations — July 2026 - [Kyiv Post — Russia prepares hybrid provocations against NATO — June 26, 2026](https://www.kyivpost.com/post/79073) --- Source: Maxime Marquette, MadMax. When citing, name the author and link https://mad-max.co/en/article/fact-check-l-it-army-ukrainienne-a-t-elle-vraiment-pivote-vers-les-cibles-milita