Lecturer @hslu, Computer Science and Information Technology // Former @CSS_ETHZurich/@ETH, @ECFR, @Pacificforum // all cyber op flavors, IW, CEMA, space 🃔
Zurich (Switzerland)
Joined October 2013
- Tweets11.2K
- Following769
- Followers2.2K
- Likes4.3K
Pinned Tweet
My latest for @lawfare on the "Cyber Corps: Ukraine's least understood cyber actor."
"By the summer of 2024, the Ukrainian military intelligence service (GUR) was one of the closest-watched actors in the Russia-Ukraine war. News outlets reported extensively about the service’s maritime drone campaign against Russia’s Black Sea fleet and drone strikes against Moscow’s strategic early-warning radar network. At the same time, the GUR had begun to self-attribute its offensive cyber operations, an unusual departure from the traditional secrecy of other intelligence services. Yet, on July 1, 2024, another development connected to the GUR passed almost unnoticed. A small band of hacktivists calling themselves the Cyber Corps (Кіберкорпус) quietly appeared on Telegram, claiming the group “was created by officers of the GUR of the Ministry of Defense.”
Whether the Cyber Corps is genuinely affiliated with the Ukrainian military intelligence service cannot be answered definitively. But a series of indicators and circumstantial evidence suggest some form of organizational relationship. To date, the GUR has neither endorsed the Cyber Corps’ claim that GUR officers created it, nor repudiated the corps’ claims taking credit for cyber operations the GUR officially conducted. Curiously, the Cyber Corps’ distributed denial-of-service (DDoS) activities also increasingly overlapped with, and ultimately led to the absorption of, parts of the IT Army of Ukraine."
Link: lawfaremedia.org/article/the…
Stefan Soesanto retweeted
Refrigerator attacks in France also hit blood bank fridges. "France’s blood collection service confirmed that its refrigerators were hit by cyberattacks at the same time as supermarket fridges across the EU — though blood supplies were not affected." politico.eu/article/fridge-h…
If anyone is interested or wants to dig deeper.
According to DC8044, the breach of Russia's emergency alert system was conducted by a group called Honeyshoa.
The group even released a 20-page report on the vulnerability they identified in the API they exploited.
Hitcore - the group that claimed messing with Ukraine's air alert app (Повітряна тривога) - reacted to honeyshoa's write up as well.
My 2 cents: Watch out for this kind of tit-for-tat dynamic. If they occur more often and in quick retaliatory succession, they could produce deterrence effects that theorists have previously discounted and ignored for practical reasons.
The last time we saw something like it was when the Ukrainian Cyber Alliance breached Dozor Teleport in June 2023 - in retaliation for the Feb. 2022 ViaSat hack.
Both Hitcore and Honeyshoa were previously unknown and pretty much appeared out of nowhere. There is a different play here at hand. Hitcore's Telegram channel was created on November 1 at 21:57. And Honeyshoa's Telegram channel - where they posted the claim - was created on November 1 at 23:11.
[It's strange that honeshoa set up a new channel for the claim. Maybe they lost access to their "old" one whose last post was in August. Or the actor is pretending to be honeyshoa - but why??]
Stefan Soesanto retweeted
Today @cpartisans and SilentCrow took down Russia's Federal State Statistics Service — the nerve center behind every socioeconomic number this regime produces.
Full breakdown below 👇
Well ... a nice shoutout by the Cyber Corps for my Lawfare piece.
If you haven't read the article yet: lawfaremedia.org/article/the…
The new head of the GRIB - Ri Kyong Chol - is going places.
Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets reut.rs/4yTqwyz
Just leaving this October 28, 2026, capture of the Cyber Corps' all-time leaderboard here for another write-up.
Reuters: "Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say" reuters.com/technology/penta…
Stefan Soesanto retweeted
#ESETresearch released the latest #ESETAPTActivityReport (Apr–Sep 2026): 🇧🇾 Belarus-aligned APT groups are converging with Russia'’s war priorities; for the first time, we documented a destructive cyberattack by a Belarus-aligned group in 🇺🇦 Ukraine web-assets.esetstatic.com/wl… 1/3
Stefan Soesanto retweeted
Міжнародна розвідувальна спільнота InformNapalm у співпраці з аналітичною групою Ukrainian Militant ексклюзивно публікує результати CYBINT-дослідження масивів даних, здобутих хактивістами групи @256CyberAssault.
Серед отриманих для дослідження матеріалів — документи, особисте і службове листування, фотографії та інші файли, пов’язані з діяльністю співробітників російської Служби зовнішньої розвідки (рос. Служба внешней разведки, СВР). Аналіз цих даних допоміг встановити зв’язок між особами, причетними до російської зовнішньої розвідки, та підготовкою публічних акцій у Будапешті на підтримку будівництва атомної електростанції «Пакш-2», яке здійснюється за участі російської державної корпорації «Росатом».
«Активка» для Росатома: слід СВР у підготовці мітингу за «Пакш-2» в Угорщині 🇭🇺
informnapalm.org/ua/aktyvka-…
Запрошуємо читати та поширювати це дослідження українською, пізніше на сайті також будуть доступні інші мовні версії цього матеріалу.