Russia’s utilization of online attacks, particularly those linked to hacktivist groups, continues to advance its geopolitical ambitions. In recent weeks, several self-proclaimed Russian hacktivist organizations have targeted online platforms in countries like the United Kingdom, France, and Spain. These actions were in response to these nations’ commitments to bolster support for Ukraine, following the U.S. decision to reduce aid under the Trump administration. The groups, including NoName057(16), KillNet, and others, often threaten distributed denial-of-service (DDoS) attacks against critics of Moscow, though the actual impact of these threats is typically minimal.
A notable incident involved TwoNet, a hacktivist group that claimed responsibility for disrupting websites belonging to the British domestic Security Service, defense contractor BAE Systems, and Vodafone UK. These disruptions were reportedly a warning to halt support for Ukraine. Meanwhile, the NoName group boasted about disrupting Spanish government websites and other entities as part of its “OpSpain” campaign, initiated after Spain pledged substantial military aid to Ukraine. Such attacks aim to create media attention rather than cause significant damage.
Following a meeting between Ukrainian President Volodymyr Zelenskyy and U.S. President Donald Trump, Europe has intensified support for Ukraine. The U.K. announced a major loan agreement to aid Ukraine’s defense, while a coalition of European governments pledged to increase defense spending. In contrast, media reports suggested that the U.S. had paused offensive cyber operations against Russia, possibly to pave the way for peace negotiations. This geopolitical shift influenced hacktivist groups like TwoNet to reconsider their strategies temporarily.
Despite the bold claims and aggressive rhetoric of these hacktivist groups, the real-world impact of their actions remains largely at the level of nuisance. Often, the targeted websites are not significantly disrupted, and normal operations resume quickly. The supposed infiltration of critical infrastructure, like oil reserves, by groups such as TwoNet, remains unverified and seems more like an attempt to gain publicity than a genuine threat.
Evidence suggests that these hacktivist groups might be closely linked to Russian state operations, serving as a psychological tool to further Moscow’s interests. Research by threat intelligence groups like Google’s Mandiant and Check Point Research highlights potential overlaps and state sponsorship within these hacktivist networks. While their claims may sound alarming, the tangible effects are often limited, and their efforts seem more focused on generating media attention than achieving substantial damage.