1. Bear witness: the empirical case for Russia as a cyber superpower
Although the Cold War ended with the dissolution of the Soviet Union, it seems that today the fear of mutual destruction is still present in the cyber realm. The reasons are manifold; apart from military aggression in Ukraine, both Russian hacktivists and state sponsored APTs are frequent suppliers of cybernews headlines. Sometimes it seems like there are endless groups of Russian-linked hackers out there: from the hacktivist group NoName057, a group linked to DDoS attacks on nations who are friendly to Ukraine, to menacing looking names like the GRU, Forest Blizzard or Fancy Bear. The latter three are simply different names for the same actor.[1] According to Microsoft's Digital Defense Report 2025 Russian state actors expanded the scope of their targeting to infiltrate networks and devices primarily in Ukraine and NATO-member states. This "has put more organizations at risk of compromise, although outside of Ukraine that risk is almost exclusively for cyberespionage." [2]
According to Microsoft's report, the Netherlands is in the 10% of most targeted regions by Russian threat actors. The Dutch Intelligence services AIVD and MIVD observe that Russian capabilities for conducting cyberattacks are growing at a rapid pace. The AIVD has also published an extensive report stating that Russia is more than just a cyber threat in Europe; they see a broad existental conflict between Russia and the West taking place at both the military, economic and ideological front. "Russia is preparing for an extensive confrontation with the West," the report states[3] Cyberactivities are part of what the services call "hybrid activities": activities which interfere with both the digital and physical domain and actions of sabotage.
"Russia continues to act as a capable and irresponsible threat actor in cyberspace",[4] states the UK's National Cyber Security Center. They see that Russia's invasion of Ukraine and also the ongoing Israel-Gaza Conflict have inspired a growing number of Pro-Russia hacktivist groups to target NATO countries in retaliaton for the West's support of Ukraine and Israel. Google Cloud Security also acknowledges the substantial threat of Pro-Russian hacktivist groups in their Cybersecurity Forecast 2026, According to Google Cloud Security, nation-state activity will continue to pose significant and evolving threats.
Not alone, but not alike
However, Russia is certainly not alone in the cyber threat landscape report. Chinese actors are certainly equally, if not more prominent, and also Iran and North-Korea are frequently named as the top four cyber threat nations. According to the Cyber Operations Tracker of the Council of Foreign Relations, China has sponsored 248 cyber operations in the years 2005-2024, whereas Russia contributed for 181 sponsored operations. Iran had a 101, and North Korea 91 [5].
Each of these Big Four Cyber Threats have a converging tactic:
China emphasizes espionage and collection of proprietary information. They use espionage operations as a key method of pursuing economic competitive advantage.[6] Chinese cyber operations are strongly motivated by the ongoing rivalry with the US to appreciate the nation's impact within cyberspace[7]. For example: Attacks against Dutch Chipmaker NXP in 2017-2020, China employs R&D and premier cyber attack capabilities according to the US Cybersecurity & Infrastructure Security Agency (CISA). China's cyber posture is becoming increasingly destructive, judging by recent attacks on US critical infrastructure. However the focus remains on espionage and theft of intellectual property.
Iran targets historical regional adversaries, focusing on long-term espionage against critical infrastructure. It has leveraged 'hybrid warfare', combining kinetic and cyber operations to support its 'Shadow War' against Israel. Examples are Campaign against Human Rights Watch in 2022 and attacks on Israeli infrastructure. Iran also focuses on psychological warfare and influence campaigns.
North Korea remains a persistent threat against a narrow target set, focusing on financially motivated operations to bring in money for the regime. They focus espcially on IT sector or any organization associated with banking, blockchain manufacturing and defense. North Korean APTs employ ransomware campaigns to reacht their targets. Examples are Lazarus Group and WannaCry Ransomware.
Russia focuses on infilitrating networks and devices primarily in Ukraine and NATO member states. Russia engages in malicious cyber activities to enable broad-scope cyber espionage, suppress social and political activitiy, steal intellectual property and harm regional and international adversaries.[8] Russia also employs premier cyber attack capabilities, which have a disruptive component outclassing the other members of the "Big 4 Cyber Threats". Examples are NotPetya and the SolarWinds attack.
What sets Russia apart
What then makes Russia stand out? According to CISA: "the practical experience it has gained integrating cyber attacks and operations with wartime military action, almost certainly amplifying its potential to focus combined impact on U.S. targets in time of conflict."[9] Their cyberattacks are often aligned with it's government's intelligence apparatus [10] This is reflected in some of the most notorious APTs:
APT28, also known as Fancy Bear, is affiliated with Russia's GRU Military Unit 26165. [11]
APT29, also known as CozyBear or The Dukes, is affiliated with the Russian SVR, foreign intelligence service.
Venomous Bear, also known as Turla group, is likely supported by Signals Intelligence (SIGINT) with links to the Russian Federal Security Service (FSB)[12]
Voodoo Bear, also known as Sandworm, is allegedly a cyber unit operating under the GRU's Main Centre of Special Technologies Unit 74455. This group is mostly known for targeting the Ukrainian Power Grid in 2015[13] and NotPetya.
These last two attacks have caused catastrophic damage. Especially the NotPetya attack, which was initially aimed at Ukraine, but by the capabilities of the worm managed to disrupt organizations like Maersk and FedEx worldwide. The port of Rotterdam and the Chernobyl power grid were hit in the same attack. Russia is so far the only nation state actor to employ such a disruptive attack. This ties in to the Russian strategy to destabilize and disrupt, as is already stated in the AIVD-report "Between peace and war[14]".
Russia's leaders believe that the United States is trying to use the Internet (which the Kremlin calls a tool of the CIA) to remake the world in its own Western liberal image.[15] For instance, Putin stated at the 2014 Saint Petersburg Mediaforum that the internet "was created as a special project by the CIA,."[16] As a result, certain Russian hackers are aggressively working to destablize and destroy democracy. And they are not necessarily careful in their tacticts. Where other hacker groups change tactics once they notice they have been tracked, Fancy Bear has carried out a number of high-profile attacks which are easy to link together via a similar modus operandi. "They are either idiots or unafraid," says Ilya Sachkov, one of the founders of Group-IB (a company that conducts cybercrime investigations in Russia).[17]
One of the most striking examples is the alleged Russian interference in the hack of the Democratic National Committee in 2016. This ties in perfectly with KGB-era strategies. The fourth block of this blog series will shed more light on how Russia uses cyberwarfare as a strategic pillar for undermining whom they consider to be their enemies.
Furthermore, what sets Russia's APTs apart is their affiliation with institutional crime. After the implosion of the Soviet Union, economic decline and political instability contributed to a rise in crime, including cybercriminal activity. The modern Kremlin cultivates this web of cyber actors, leveraging it for their own purposes. The Putin regime is responsible for allowing this cybercriminal ecosystem to flourish. [18]The most striking example of this is Evil Corp, one of the first major Cybercrime groups in the Russian Federation. In 2017, two Russian FSB Officers were indicted for directing criminal hackers to compromise 500 million Yahoo Accounts[19]. We will focus more on this affiliation in the third block of this blog series, but it is something unique to Russia's APTs and a direct result of Russia's Soviet Legacy.
In conclusion, what distinguishes Russia from its peers in the cyber threat landscape is not simply the volume of its operations, but the combination of three factors found nowhere else in the same measure:
a willingness to escalate beyond established norms;
a doctrine of destabilisation rather than collection;
a structural entanglement between state intelligence and organised crime.
Each of these traits, as the following blogs will argue, is not accidental — it is the product of a specific history. And this history is the starting point of this deep dive.
Notes and references
Apt28, iron twilight, snakemackerel, swallowtail, group 74, sednit, sofacy, pawn storm, fancy bear, strontium, tsar team, threat group-4127, tg-4127, forest blizzard, frozenlake, gruesomelarch, group g0007 | mitre att&ck®. (n.d.). Retrieved August 10, 2026, from https://attack.mitre.org/groups/G0007/↩︎
Microsoft. (2025). Microsoft Digital Defense Report 2025. Microsoft Corporation. https://cdn-dynmedia-1.microsoft.com/is/content/microsoftcorp/microsoft/msc/documents/presentations/CSR/Microsoft-Digital-Defense-Report-2025.pdf#page=1 ↩︎
Algemene Inlichtingen en Veiligheidsdienst. Militaire Inlichtingen en Veiligheidsdienst. (2026). Tussen vrede en oorlog. De oorlog in Oekraïne en de Russische dreiging in Europa. AIVD https://open.overheid.nl/documenten/a3e008b2-5923-45b0-9f30-1d9ef7a2ffe5/file↩︎
National Cyber Security Center. (2026) It's time to act. Annual review 2025. (p. 20) NCSC https://www.ncsc.gov.uk/files/ncsc-annual-review-2025.pdf↩︎
Cyber operations tracker. (n.d.). Retrieved August 10, 2026, from https://www.cfr.org/cyber-operations/↩︎
Microsoft, 2025.↩︎
What to know about nation state actors and cybersecurity threats. (n.d.). United States Cybersecurity Magazine. Retrieved August 10, 2026, from https://www.uscybersecurity.net/csmag/what-to-know-about-nation-state-actors-and-cybersecurity-threats/↩︎
Nation-state threats | cybersecurity and infrastructure security agency cisa. (n.d.). Retrieved August 10, 2026, from https://www.cisa.gov/topics/cyber-threats-and-advisories/nation-state-cyber-actors↩︎
Russia Threat Overview and Advisories. CISA (n.d.). Retrieved August 10, 2026, from https://www.cisa.gov/topics/cyber-threats-and-advisories/advanced-persistent-threats/russia.↩︎
What was the WannaCry ransomware attack? (n.d.)Cloudflare https://www.cloudflare.com/learning/security/ransomware/wannacry-ransomware/ Accessed 10 Aug. 2026↩︎
blackorbird. (n.d.). APT_REPORT/APT28/APT28 the long hand of Russian interests.pdf at master · blackorbird/APT_REPORT. GitHub. Retrieved August 10, 2026, from https://github.com/blackorbird/APT_REPORT/blob/master/APT28/APT28%20the%20long%20hand%20of%20Russian%20interests.pdf↩︎
The five bears: Russia’s offensive cyber capabilities. (n.d.). Grey Dynamics. Retrieved August 10, 2026, from https://greydynamics.com/the-five-bears-russias-offensive-cyber-capabilities/↩︎
Cyber-attack against ukrainian critical infrastructure | cisa. (2021, July 20). https://www.cisa.gov/news-events/ics-alerts/ir-alert-h-16-056-01↩︎
AIVD, 2026↩︎
Lewis, J.A., (2016, 16 december) How Russia overtook China as our biggest cyber enemy. Center for Strategic & Internatonal Studies. Retrieved August 10, 2026, from https://www.csis.org/blogs/strategic-technologies-blog/how-russia-overtook-china-our-biggest-cyber-enemy ↩︎
Vladimir Putin: internet voznik kak proekt TsRU, tak i razvivaetsya [Vladimir Putin: The internet arose as a CIA project, and continues to develop that way]. (2014, April 24). Kommersant. https://www.kommersant.ru/doc/2459649↩︎
Turovsky, D. (2016, November 7). Rossiyskie vooruzhennye kibersily: Kak gosudarstvo sozdaet voennye otryady khakerov [Russia's armed cyber forces: How the state creates military hacker units]. Meduza. https://meduza.io/feature/2016/11/07/rossiyskie-vooruzhennye-kibersily↩︎
Sherman, J. (2022, October 24). Untangling moscow’s complex cyber web. CEPA. https://cepa.org/article/untangling-moscows-complex-cyber-web/↩︎
Evil Corp: Behind the Screens. October 2024. NCA Retrieved August 10, 2026, from https://www.nationalcrimeagency.gov.uk/who-we-are/publications/732-evil-corp-behind-the-screens/file↩︎
Opmerkingen