My latest for @lawfare on the "Cyber Corps: Ukraine's least understood cyber actor." "By the summer of 2024, the Ukrainian military intelligence service (GUR) was one of the closest-watched actors in the Russia-Ukraine war. News outlets reported extensively about the service’s maritime drone campaign against Russia’s Black Sea fleet and drone strikes against Moscow’s strategic early-warning radar network. At the same time, the GUR had begun to self-attribute its offensive cyber operations, an unusual departure from the traditional secrecy of other intelligence services. Yet, on July 1, 2024, another development connected to the GUR passed almost unnoticed. A small band of hacktivists calling themselves the Cyber Corps (Кіберкорпус) quietly appeared on Telegram, claiming the group “was created by officers of the GUR of the Ministry of Defense.” Whether the Cyber Corps is genuinely affiliated with the Ukrainian military intelligence service cannot be answered definitively. But a series of indicators and circumstantial evidence suggest some form of organizational relationship. To date, the GUR has neither endorsed the Cyber Corps’ claim that GUR officers created it, nor repudiated the corps’ claims taking credit for cyber operations the GUR officially conducted. Curiously, the Cyber Corps’ distributed denial-of-service (DDoS) activities also increasingly overlapped with, and ultimately led to the absorption of, parts of the IT Army of Ukraine." Link: lawfaremedia.org/article/the…

There are countless targets one can hit in cyberspace in peacetime to create discernible effects on an adversary's economy and inflict harm on its population. Imagine if we transpose that same targeting approach into wartime. We would never run out of targets to hit. Never run out of targets that are vulnerable. Never run out of targets to create impact. There are three fundamental constraints in the current architecture of stability in cyberspace that stand in the way of this kind of warfighting. Our laws, our morals, and our current capacities. The first two are highly likely to come under intense strain - and maybe even crumble - during a major conflict. Meanwhile, existing capabilities will likely prove insufficient and unable to scale fast enough to exploit the full range of targeting opportunities. The question that militaries and intelligence services everywhere will have to contend with is whether they are willing to fight a major war in cyberspace with the ferocity, violence, and scale necessary for survival, or whether they believe in a better version of themselves and their adversaries.

In April 2026, the IT Army of Ukraine faced an internal crisis over unexplained and potentially unlawful targets appearing in its DDoS targeting lists. Tool developers demanded an audit. Operations were temporarily suspended. Soon after, prominent IT Army DDoS contributors and tool developers migrated to the Cyber Corps, a little-known group with apparent ties to Ukraine’s military intelligence service (GUR). In my latest article for @lawfare , I take a closer look at the Cyber Corps: Where did it come from? What operations has it conducted? And what evidence links it to Ukraine’s military intelligence service? The findings raise broader questions about the relationship between volunteers, intelligence services, and the control of cyber operations during armed conflict. lawfaremedia.org/article/the…

Maybe of interest to others is also the fact that the IT Army of Ukraine's tooling/infrastructure was compromised: "An internal crisis within the IT Army in April 2026 caused the user migration to the Cyber Corps. It is unclear what happened in late April as the IT Army administrators deleted most of the relevant Telegram messages. The remaining evidence points to a major disagreement between the group’s tool developers. In one now-deleted announcement, an IT Army administrator stated that “over the past few days, we have been forced to investigate a possible compromise of part of our infrastructure. At this time, we still have serious concerns regarding the security and transparency of our current operating environment. Therefore, we ask you to temporarily stop your devices and servers until a separate announcement from us.” As part of the investigation, several developers demanded a full audit of the IT Army’s tooling and infrastructure. This demand was initially rejected due to concerns that such an audit might expose sensitive information and user data that could potentially lead to arrests by Ukrainian law enforcement. The dispute escalated when one administrator began banning people from the Telegram channel. On April 25, the official IT Army administrator account acknowledged that “the cause of the crisis was the refusal to allow even a minimal audit of the targets, after which the community was placed on pause. The community’s operations have now resumed after uninterrupted access for the audit was obtained.” The statement suggests that some aspect of the IT Army’s centrally managed DDoS target update mechanism was potentially interfered with. Three days later, the IT Army proposed developing a new open-source tool that would allow transparent auditing. On May 11, OleksandrBlack released his CyberOwl DDoS tool, and two weeks later, the IT Army published its new community-developed DDoS framework, known as the BaseTool. A longer post by the official IT Army administrator dated May 25 sheds more light on a possible GUR connection. According to the account, the dispute began over the discovery of several targets in their DDoS list whose strategic objective was either unclear or potentially unlawful, prompting the internal team to demand a full audit of the target designation pipeline. When access was eventually granted, the group around OleksandrBlack “took away all the tools, paralyzed our work here, and recruited volunteers from here while posing as intelligence agencies.” The post went on to question what kind of Ukrainian intelligence agency would be interested in shutting down the work of the IT Army—which then-Minister of Defense Mykhailo Fedorov created—and why the group in question was not officially recognized by any of the intelligence services. The post also raised concerns that IT Army volunteers could face criminal charges elsewhere in Europe if they unknowingly participate in DDoS attacks against unlawful targets."

Daryna published a good summary at The Record: therecord.media/belarusian-h… "In December 2025, the Solar 4RAYS team once again faced an attack by Partisan Zmiy (the “Cyber Partisans” group has been designated as extremist, and its activities are banned in the Russian Federation), this time targeting a healthcare organization." rt-solar.ru/solar-4rays/blog…

Great to see the Prime Minister of Japan posting this.