Ukraine urges allies to adopt its cyber lessons
Policy piece argues Ukraine's four years of Russian cyber warfare experience should be systematically shared with Western partners, citing a 2026 advisory on GRU targeting of logistics firms and border cameras.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Atlantic Council opinion piece by Iryna Volnytska (SET University/IronCyber) is a policy commentary rather than a technical threat report. It argues that Ukraine has accumulated unmatched operational experience defending against Russian cyber operations since the 2022 invasion, with recorded incidents nearly doubling from 2022-2024 (2,194 to 4,315) while critical/high-severity incidents fell sharply (1,048 to 59), reflecting improved resilience. The author calls for Western institutions to treat Ukrainian threat data as an active detection resource, for faster real-time coordination between allied CERTs/agencies rather than periodic briefings, and for Ukraine to be given a leading role in designing multilateral cybersecurity exercises rather than merely participating in them.
The one piece of threat-relevant substance is a reference to a joint Western agency advisory (dated April 2026) describing Russian military intelligence (GRU-linked) targeting Western logistics and technology companies supporting Ukraine, with associated efforts to compromise internet-connected cameras near border crossings, military installations, and railway stations in both Ukraine and neighboring NATO states. No technical indicators, malware names, or CVEs are provided in this article; readers are pointed toward the underlying joint advisory for operational detail. Defenders in logistics, transportation, and technology sectors supporting Ukraine-related supply chains should review exposure of internet-connected surveillance cameras and physical-security IoT devices near sensitive infrastructure, and treat this as a reminder to map third-party and supply-chain digital dependencies even where they are not the primary target.
Overall this is an informational/policy piece with limited technical content; it references but does not itself detail a targeting campaign attributed to Russian military intelligence against logistics and camera infrastructure.
Mentioned in this report
Detection guidance
Suspicious Internet-Connected Camera Management Access
A behavioural hunt for the technique in general.
Detects attempts to access or modify configuration of internet-connected surveillance cameras and IoT devices, particularly near critical infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Internet-Connected Camera Management Access
description: Detects network connections to common internet-connected camera and IoT
device management interfaces (RTSP, HTTP/HTTPS on camera-typical ports) from external
or anomalous sources. Targets reconnaissance and compromise of surveillance systems
near critical infrastructure as observed in GRU targeting of border and logistics
facilities.
tags:
- attack.reconnaissance
- attack.t1584.008
logsource:
category: network_connection
product: windows
detection:
selection_camera_ports:
DestinationPort:
- 554
- 8080
- 8081
- 8888
- 9000
- 5000
selection_camera_protocols:
DestinationHostname|contains:
- camera
- dvr
- nvr
- surveillance
- rtsp
filter_internal:
SourceIp|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
condition: (selection_camera_ports or selection_camera_protocols) and not filter_internal
falsepositives:
- Legitimate camera management traffic from authorized administrative systems
- CCTV system maintenance and monitoring by IT staff
level: medium
id: d6d9327e-23d6-5ae6-9bfe-bed868979f78
status: experimental
author: Vorant
Reconnaissance of Border and Logistics Infrastructure via DNS and Network Probes
A behavioural hunt for the technique in general.
Detects DNS queries and network reconnaissance targeting domains and systems associated with border crossings, railway infrastructure, and logistics/transportation networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Reconnaissance of Border and Logistics Infrastructure via DNS and Network Probes
description: Detects DNS resolution requests for hostnames associated with transportation,
logistics, border crossing management systems, or railway infrastructure control
networks. Targets identification of internet-exposed systems related to supply-chain
and cross-border logistics supporting Ukraine.
tags:
- attack.reconnaissance
- attack.t1584.008
logsource:
category: dns_query
product: windows
detection:
selection:
QueryName|contains:
- .ua
- .pl
- .ro
- .sk
- .hu
filter_cdn:
QueryName|contains:
- cloudflare
- akamai
- cloudfront
filter_public_registry:
QueryName|contains:
- whois
condition: selection and not (filter_cdn or filter_public_registry)
falsepositives:
- Legitimate traffic from logistics and transportation companies resolving their own
infrastructure
- Public registries and WHOIS lookups by authorized personnel
level: low
id: ecfd878f-f87c-57f8-bbe5-25f8f1fca09c
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.atlanticcouncil.org/blogs/ukrainealert/learning-from-ukraines-unrivaled-experience-of-russian-cyber-warfare
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs