How Ukraine's Cyber Army Has Grown To Protect the Country and Attack the Russians

Ukraine's Cyber Army is now responsible for one of the most important domains in the national defense along with land, sea and air. And it contributes significantly to the performance of the other three. 

Operating in small cells to prevent wider damage in case of a hack or data leak, Ukraine's cyber warriors do everything from stopping Russian cyberattacks to launching their own using Russian cellphone SIM cards, bank cards and CCTV data. Their efforts are a primary reason why Russia's vaunted cyber capabilities have not been as destructive as initially feared. JL 

Jyoti Mann reports in Business Insider

On February 24 last year I woke up to the sounds of explosions in Kyiv. I put a call out on Facebook asking for volunteers to be a part of a cyber army. By the next day we had more than 1,000 applications. We separated the cyber army into groups of between 7 to 10 people in case of a data leak. Over the past year we've worked on more than 200 projects to find solutions to technical military challenges, such as tracking and collecting data on Russian SIM cards, use CCTV footage from streets to recognize tanks while tracking where their soldiers were and helping organizations who are under cyber attack

On February 24 last year I woke up to the sounds of explosions and bombs in Kyiv. I went to the underground car park of my building and put a call out on Facebook asking for volunteers to be a part of a cyber army to help protect our country.

Within two hours we had more than 200 applications. People said, "we can't fight with a gun but we can fight with our laptops." By the next day we had more than 1,000 applications, mostly from people in the Ukrainian cybersecurity community.

I asked if they had any qualifications and what their skills were. I checked with someone from the Ukrainian cybersecurity community because I didn't want Russian agents infiltrating.

We started creating projects that we could help with and delivered them to the Ministry of Defense and National Security and Defense Council, along with information to help our government in an unofficial capacity.

A year on, we consider ourselves one of the four faces of war and national security: ground, air, sea and cyberspace

Prior to the war, Cyber Unit Tech trained more than 1,000 employees from various organizations with the National Security and Defense Council on cybersecurity measures including how to find software bugs. It's impossible for just one institution to protect everyone, so we use our experience to help any organization that faces a cyber attack.  

Within the first few days of the war, we separated the cyber army into groups of between 7 to 10 people. I didn't want anyone in the group to know the identities of the others in case of a data leak. Our call for decentralized cyber army volunteers is probably what inspired others to create their own groups, such as Ukraine's IT army, formed a few days later by the minister of digitization, Mykhailo Fedorov.

He expanded on our idea and set up a Telegram channel. The channel still exists and has more than 200,000 people, but we have no relationship with it. It is important to understand that everything in Ukraine is decentralized.

We work on strategic projects through Cyber Unit Tech

For example, we organized the National Defence Hackathon in November 2022, where cybersecurity experts came together to find solutions to technical military challenges.

The cyber volunteer army has no single point of control and it's not an official part of Ukraine's military, which doesn't give us orders but can call upon us for support. Over the past year we've worked on more than 200 projects – some small and some big.

It mostly involves helping organizations who are under cyber attack. For example, if I receive a request from the government to protect an institution's cyberspace, I'd send five people to help them. We have only one goal: stop the enemy.

One project we worked on was when a few groups joined forces and used our technical skills to create bots that would recognize if someone tried to withdraw Russian rubles from an ATM, for example.

Another project involved using tech to recognize who was in photos left by Russian soldiers in Bucha near Kyiv. We would look at the photos and determine whether women in them were soldiers' wives or girlfriends. That was important to track which Russians soldiers may have been there and may have committed war crimes.

We also created simple solutions in the first days of the invasion such as tracking and collecting data on Russian SIM cards. We could see if there were multiple Russian SIMs in a particular small village. If it was a couple hundred Russian SIMs, of course it's Russian soldiers and not tourists. 

Another example of our work I can share is how we used CCTV footage from streets to recognize tanks and track where their soldiers were. However, there's much I can't disclose as our work is ongoing.

In the first two months of the invasion, our employees spent all our time on this work. Now it's an even split between this and our business. Many of our clients and businesses left the Ukraine market. 

The 'new normal' for Ukrainians

When I hear explosions outside, I go to the nearby bomb shelter.

I just need to keep fighting and wait for the end of the war. I dream of spending time with my two daughters and girlfriend who are in another country. It helps me to focus.