Ukraine’s volunteer ‘IT Army’ is hacking in uncharted territory

Vladimir Putin’s attack on Ukraine has been met with fierce resistance throughout the country’s towns and cities. As Russian forces have moved closer to Kyiv, lawyers, students, and actors have taken up arms to defend their country from invasion. They are not the only ones: Volunteers have also flocked to join a Ukrainian volunteer “IT Army” that’s fighting back online.

At around 9 pm local time on February 26, Ukraine’s deputy prime minister and minister for digital transformation, Mykhailo Fedorov, announced the creation of the volunteer cyber army. “We have a lot of talented Ukrainians in the digital sphere: developers, cyber specialists, designers, copywriters, marketers,” he said in a post on his official Telegram channel. “We continue to fight on the cyber front.”

Ukraine has seen other volunteer-organized cyber defense and attack efforts leading up to and early in the war effort. Separately hacktivists, including the hacking group Anonymous, have claimed DDoS attacks against Russian targets and taken data from Belarusian weapons manufacturer Tetraedr. But the development of the IT Army, a government-led volunteer unit that’s designed to operate in the middle of a fast-moving war zone, is without precedent.

The IT Army’s tasks are being assigned to volunteers through a separate Telegram channel, Fedorov said in his announcement. So far more than 175,000 people have subscribed—tapping Join on the public channel is all it takes—and multiple tasks have been dished out. The channel’s administrators, for instance, asked subscribers to launch distributed denial of service attacks against more than 25 Russian websites. These included Russian infrastructure businesses, such as energy giant Gazprom, the country’s banks, and official government websites. Websites belonging to the Russian Ministry of Defense, the Kremlin, and communications regulator Roskomnadzor were also listed as potential targets. Russian news websites followed.

Since then the IT Army channel has expanded its scope. On February 27, it asked volunteers to target websites registered in Belarus, one of Russia’s key allies. The channel has also told subscribers to report YouTube channels that allegedly “openly lie about the war in Ukraine.”

One former Ukrainian official who knows the IT Army’s organization says it was formed as a way for Ukraine to hit back against Russian cyberattacks. Russia has significant hacking capabilities: Wiper attacks hit a Ukrainian bank in the buildup to the invasion, and government websites were knocked offline. “Our country didn’t have any forces or intentions to attack anyone. Therefore, we made a call,” the former Ukrainian official says. “We already know that they are quite good at cyberattacks. But now we will find out how good they are in cyber defense,” the former official says.

“For a country that’s facing an existential threat, like Ukraine, it’s not surprising that this sort of call would go out and that some citizens would respond,” says J. Michael Daniel, the head of the industry group Cyber Threat Alliance and former White House cyber coordinator for President Obama. “Part of it is also a signaling exercise. It’s signaling a level of commitment across the country of Ukraine to resisting what the Russians are doing.”

The impact of the IT Army is hard to gauge thus far. While thousands of members have joined the Telegram channel, there is no indication of who they are or their involvement in any response. The channel has shared screenshots of some Russian websites allegedly being taken offline, but it’s unclear how successful these efforts have been or where they originated from.