# Ukraine urges allies to adopt its cyber lessons Published: 2026-09-14 · Severity: routine · Sectors: government-national, defense, transportation, telecommunications, infrastructure Canonical: https://vorant.io/reports/1131d765-7b35-5b0d-8127-d67a6d5d7706/ukraine-urges-allies-to-adopt-its-cyber-lessons > Policy piece argues Ukraine's four years of Russian cyber warfare experience should be systematically shared with Western partners, citing a 2026 advisory on GRU targeting of logistics firms and border cameras. This Atlantic Council opinion piece by Iryna Volnytska (SET University/IronCyber) is a policy commentary rather than a technical threat report. It argues that Ukraine has accumulated unmatched operational experience defending against Russian cyber operations since the 2022 invasion, with recorded incidents nearly doubling from 2022-2024 (2,194 to 4,315) while critical/high-severity incidents fell sharply (1,048 to 59), reflecting improved resilience. The author calls for Western institutions to treat Ukrainian threat data as an active detection resource, for faster real-time coordination between allied CERTs/agencies rather than periodic briefings, and for Ukraine to be given a leading role in designing multilateral cybersecurity exercises rather than merely participating in them. The one piece of threat-relevant substance is a reference to a joint Western agency advisory (dated April 2026) describing Russian military intelligence (GRU-linked) targeting Western logistics and technology companies supporting Ukraine, with associated efforts to compromise internet-connected cameras near border crossings, military installations, and railway stations in both Ukraine and neighboring NATO states. No technical indicators, malware names, or CVEs are provided in this article; readers are pointed toward the underlying joint advisory for operational detail. Defenders in logistics, transportation, and technology sectors supporting Ukraine-related supply chains should review exposure of internet-connected surveillance cameras and physical-security IoT devices near sensitive infrastructure, and treat this as a reminder to map third-party and supply-chain digital dependencies even where they are not the primary target. Overall this is an informational/policy piece with limited technical content; it references but does not itself detail a targeting campaign attributed to Russian military intelligence against logistics and camera infrastructure. ## Mentioned in this report - Threat actors: Russian Military Intelligence (GRU) ## Detection guidance (public sample) ### Suspicious Internet-Connected Camera Management Access ATT&CK: T1584.008 Detects attempts to access or modify configuration of internet-connected surveillance cameras and IoT devices, particularly near critical infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Suspicious Internet-Connected Camera Management Access description: Detects network connections to common internet-connected camera and IoT device management interfaces (RTSP, HTTP/HTTPS on camera-typical ports) from external or anomalous sources. Targets reconnaissance and compromise of surveillance systems near critical infrastructure as observed in GRU targeting of border and logistics facilities. tags: - attack.reconnaissance - attack.t1584.008 logsource: category: network_connection product: windows detection: selection_camera_ports: DestinationPort: - 554 - 8080 - 8081 - 8888 - 9000 - 5000 selection_camera_protocols: DestinationHostname|contains: - camera - dvr - nvr - surveillance - rtsp filter_internal: SourceIp|cidr: - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 condition: (selection_camera_ports or selection_camera_protocols) and not filter_internal falsepositives: - Legitimate camera management traffic from authorized administrative systems - CCTV system maintenance and monitoring by IT staff level: medium id: d6d9327e-23d6-5ae6-9bfe-bed868979f78 status: experimental author: Vorant ``` ### Exploitation of Public-Facing Application via HTTP/HTTPS ATT&CK: T1190 Detects patterns consistent with exploitation attempts against public-facing web applications, including suspicious HTTP methods and payloads targeting known vulnerability vectors. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Exploitation of Public-Facing Application via HTTP/HTTPS description: Detects network traffic indicative of exploitation attempts against public-facing applications, including uncommon HTTP methods (PUT, DELETE, PATCH), SQL injection markers, command injection syntax, or path traversal patterns in URI and query strings. Generalises on attack pattern rather than specific payload encoding. tags: - attack.initial-access - attack.t1190 logsource: category: proxy product: windows detection: selection_exploit_methods: http_method: - PUT - DELETE - PATCH - TRACE - OPTIONS selection_sql_injection: uri|contains: - ''' OR ''' - ''' OR ''1''=''1' - UNION SELECT - exec( - execute( selection_path_traversal: uri|contains: - ../ - ..%2f - '...%5c' filter_legitimate_api: uri|contains: - /api/v - /rest/ filter_webdav: http_method: PUT uri|contains: - .git - .svn condition: (selection_exploit_methods or selection_sql_injection or selection_path_traversal) and not (filter_legitimate_api or filter_webdav) falsepositives: - Legitimate REST API and WebDAV operations from authorized applications - Security scanning and vulnerability assessment tools level: medium id: c8a2be54-bae5-51ed-8351-c92e26feed33 status: experimental author: Vorant ``` ### Reconnaissance of Border and Logistics Infrastructure via DNS and Network Probes ATT&CK: T1584.008 Detects DNS queries and network reconnaissance targeting domains and systems associated with border crossings, railway infrastructure, and logistics/transportation networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Reconnaissance of Border and Logistics Infrastructure via DNS and Network Probes description: Detects DNS resolution requests for hostnames associated with transportation, logistics, border crossing management systems, or railway infrastructure control networks. Targets identification of internet-exposed systems related to supply-chain and cross-border logistics supporting Ukraine. tags: - attack.reconnaissance - attack.t1584.008 logsource: category: dns_query product: windows detection: selection: QueryName|contains: - .ua - .pl - .ro - .sk - .hu filter_cdn: QueryName|contains: - cloudflare - akamai - cloudfront filter_public_registry: QueryName|contains: - whois condition: selection and not (filter_cdn or filter_public_registry) falsepositives: - Legitimate traffic from logistics and transportation companies resolving their own infrastructure - Public registries and WHOIS lookups by authorized personnel level: low id: ecfd878f-f87c-57f8-bbe5-25f8f1fca09c status: experimental author: Vorant ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. Source reporting: https://www.atlanticcouncil.org/blogs/ukrainealert/learning-from-ukraines-unrivaled-experience-of-russian-cyber-warfare --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/1131d765-7b35-5b0d-8127-d67a6d5d7706/ukraine-urges-allies-to-adopt-its-cyber-lessons. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup