On February 18, 2026, Ukrainian President Volodymyr Zelenskyy imposed sanctions against Belarusian dictator Alyaksandr Lukashenka for his role in escalating and prolonging Russia’s aggressive war against Ukraine. One of the stated reasons is that in the second half of 2025, Russia deployed a system of repeaters for the control of attack UAVs on the territory of Belarus. This significantly expanded Russia’s ability to strike the northern regions of Ukraine, from Kyiv to Volyn. Some of the attacks, including strikes on energy and railway infrastructure, would not have been possible without the assistance of the Belarusian side.
The imposition of sanctions was the culmination of a months-long cyber operation by Ukrainian hacktivists from the Fenix cyber analytics center, supported by volunteers of InformNapalm international intelligence community.
Details of the cyber operation
During the operation, hacktivists broke into the accounts of dozens of Russian military personnel and gained access to monitoring systems used by attack drone operators. Round-the-clock covert surveillance of their activities was organized, and the data obtained was promptly transmitted to the Ukrainian Defense Forces. This increased the effectiveness of countering Russian drone attacks, in particular by providing information about drone routes and flight missions.
The operation continued from at least mid-2025 and by February 2026 had exhausted its reconnaissance potential, one of the reasons being successful strikes by the Defense Forces of Ukraine on Russian command posts.
Let’s go back to September 2025. The analysis of intercepted drone operator chats revealed that Russia actively used Belarusian civilian infrastructure—primarily cell towers—to plan drone routes. This ensured stable communication channels and made it possible to reach targets on the northern and western borders of Ukraine. In addition, deliberate UAV incursions into the territory of NATO countries were recorded.
A broadcast screen of the desktop and software of Russian operators, displaying the image from the drone’s camera. On the right side of the chat there is a message from an operator with the nickname user5214: “Drone ЫЫ12057 normal takeoff at 11:08 in the direction of Chernihiv.” Date: 9/25/2025.
Route planning broadcast screen.
On the right side of the screen there is operators’ chat:
– “Please inform me when Comrade General arrives.”
– “Gerbera 14922, normal 14:58, Gerbera 29097, normal 14:40, Gerbera 26153, normal 15:06.”
– “Geran 1140, normal at 16:07.”
A typical route plan: takeoff from Russian territory, fly over Belarus along the Ukrainian border, and then strike targets in Ukraine.
Hidden threat monitoring
For months, Ukrainian IT specialists covertly monitored the chats and activities of dozens of Russian attack drone operators, promptly transmitting the information to the Defense Forces. This significantly increased situational awareness and the effectiveness of drone interception and suppression.
The operation lasted over six months and facilitated a number of related actions by the Ukrainian Defence Forces:
- strikes on command posts and UAV launch sites on the Russian territory and in the temporarily occupied territories of Ukraine;
- strikes on the Rubicon locations, the elite Russian drone unit;
- other measures that thwarted Russian drone operations.
As early as September 2025, operational information was transmitted to NATO partners: the flight of dozens of Russian UAVs into Poland on the night of September 9-10 was part of a test of new tactics and the capabilities of the Belarusian civilian telecommunications infrastructure. The ultimate goal of such operations is to plan strikes against logistics routes in Ukraine and Poland in order to disrupt Western arms supplies to Ukraine.
It was also established that UAVs of the “ЫЫ” series regularly appeared in the software and in the operator chats. Drones of this series were subsequently discovered in Poland and the Baltic states following Russian attacks.
Russian Gerbera decoy drones with the characteristic side numbers ЫЫ32384 and ЫЫ31402, found in Poland.
A the tail section fragment of a Gerbera decoy drone, serial number ЫЫ31704, found on a beach in Latvia.
Conclusion: war in cyberspace requires legal framework
The experience of this and many other successful cyber operations has shown that deep penetration into the enemy’s communications, planning, and coordination systems can have a significant impact on the course of military operations.
Ukrainian cyber specialists—both government and civilian—have been showing high efficiency for several years now. However, their interaction still does not have a full legal framework.
The adoption of the law on the creation of Cyber Forces has been delayed since 2023. On October 9, 2025, the Verkhovna Rada adopted in the first reading bill No. 12349 on the creation of the Cyber Forces Command, the formation of a cyber reserve of civilian specialists, the conduct of active cyber operations, and cooperation with NATO. However, the process of creating Cyberforces is still not complete.
On February 19, 2026, Mykhailo Makaruk, thespokesman for informNapalm volunteer intelligence community, publicly noted that final adoption of the bill had been heavily delayed by the parliament.
In fact, Ukrainian specialists conducting offensive cyber operations against the Russian Federation remain in a legal gray area.
The creation of the Cyber Forces of Ukraine would allow to:
- systematically coordinate the state and civil segments;
- scale successful operations;
- legalize the mechanisms of interaction;
- improve the level of strategic planning in cyberspace.
The recent successful cyber operation against Russia’s attempts to bypass the Starlink blockade is another example of effective horizontal cooperation between Ukrainian hackers, OSINT volunteers, and the Ukrainian Ministry of Defense. But the potential of this cooperation format is much greater.
A six-month cyber operation that exposed the use of Belarusian infrastructure to launch attacks on Ukraine and test attack routes against NATO countries confirms that cyberspace is a theater of war, not a supporting tool.
And this theatre needs not only specialists, but also a government solution, the need for which has been long overdue.
Read more:
- OKBMLeaks: classified documents from a Russian components manufacturer for Su-57 fighter and PAK DA Poslannik next-gen bomber
- Budapest as a hub for the Russian defense industry: Hungary facilitating dodging of international sanctions against Russia
- “We can smuggle even nukes”: Russian officers from the 291st Regiment and Vostok-Akhmat establish weapons smuggling channel through Crimea
