Washington —
Repeated failures by Russian cyberattacks and disinformation campaigns to inflict lasting damage during the Kremlin’s ongoing war against Ukraine is unlikely to dampen Moscow’s resolve and could instead spur a new wave of riskier efforts against a wider set of targets.
The assessment, from a variety of U.S. government agencies, comes as Russia’s invasion of Ukraine has dragged into a second year, with Ukraine and its Western backers preparing for Moscow to unleash a new round of cyber campaigns aimed at helping to change the trajectory of the battle on the ground.
“The weight of this conflict remains significant,” a spokesperson for U.S. Cyber Command told VOA, sharing information on the condition of anonymity due to the nature of the ongoing fight. “We anticipate their cyber activities may become bolder and look at broader targets.”
Officials at the National Security Agency have reached similar conclusions.
“If the conflict continues to not go well for Russia, there is some chance that Russia will be increasingly brazen in its cyberattacks on civilian infrastructure as we have already seen with their kinetic activity,” an NSA spokesperson told VOA, who like their Cyber Command counterpart spoke on the condition of anonymity.
Only Russia’s cyber wrath will likely not be limited to Ukraine.
“We anticipate that Russian actors will increasingly look outside of Ukraine's territorial borders when planning and conducting operations, be it related to aid that Western countries are giving to Ukraine or to try to undermine Western unity with disinformation as the conflict drags on,” the NSA spokesperson added.
Hardening such assessments is the reality that Russia’s hopes that it would be able to quickly topple Kyiv’s government failed to materialize, leaving Russia’s military planners fighting a war for which they were not prepared.
By late last year, Pentagon cyber officials were warning the Kremlin’s inability to anticipate a long war with Ukraine was not a problem relegated to the physical battlefield, but one that extended into both cyberspace and the information environment.
So, when Russia’s first salvo against Ukraine in cyberspace failed to land a decisive blow, the Kremlin’s cyber forces had few answers and continued to underperform.
“Russian cyber activities remained true to their established tradecraft, such as attempts to disrupt websites, extract Ukrainian data and trying to get a forward-facing presence on the internet. These TTP [tactics, techniques and procedures] weren’t a surprise for us at all,” the CYBERCOM spokesperson said.
And due to the decision by U.S. President Joe Biden to declassify some of the early intelligence on Russia’s invasion plans and share them with allies and partners, to include Ukraine, meant Kyiv was not surprised either.
“The U.S. government’s ability to provide information and intelligence to Russia’s invasion were the critical difference,” according to the CYBERCOM spokesperson.
“It was a game changer, which Russia might not have expected,” the spokesperson added, noting the sharing of cyber intelligence “remains an incredible weapon for Ukraine.”
So far, U.S. government agencies see few signs that Russia’s range of cyber actors have been able to adjust.
Instead, both CYBERCOM and the NSA assess that despite what they describe as strategic and operational failure, Russia has stuck to its traditional cyber playbook, hoping the persistence will pay off.
“It doesn't seem Russia has been able to accomplish widespread cyber disruptions to Ukrainian civil infrastructure thus far, but we know they are continuing to try to gain accesses that would allow them to do so,” the NSA spokesperson told VOA. “The longer Russia wages this war, the harder it will be on the Ukrainian people, and the more vulnerable they will be to destructive cyberattacks against critical infrastructure.”
Some of Washington’s assessments align with the findings of other Western countries.
“Russia’s influence operations in cyberspace have not had the expected effect,” Estonia’s Foreign Intelligence Service said in its report, released earlier this year.
“It is possible that specific cyberattacks against energy, water supply or other similar critical infrastructure, which would lead to long-term service interruptions, were not organized early on because Russia expected to achieve its military objectives quicker and wanted to maintain the support of the local population,” the Estonian report added.
But Estonian intelligence also cautions that Russia has not been looking to cyberspace just for an immediate impact.