Lecturer @hslu, Computer Science and Information Technology // Former @CSS_ETHZurich/@ETH, @ECFR, @Pacificforum // all cyber op flavors, IW, CEMA, space 🃔
Zurich (Switzerland)
Joined October 2013
- Tweets11.2K
- Following769
- Followers2.2K
- Likes4.3K
Pinned Tweet
My latest for @lawfare on the "Cyber Corps: Ukraine's least understood cyber actor."
"By the summer of 2024, the Ukrainian military intelligence service (GUR) was one of the closest-watched actors in the Russia-Ukraine war. News outlets reported extensively about the service’s maritime drone campaign against Russia’s Black Sea fleet and drone strikes against Moscow’s strategic early-warning radar network. At the same time, the GUR had begun to self-attribute its offensive cyber operations, an unusual departure from the traditional secrecy of other intelligence services. Yet, on July 1, 2024, another development connected to the GUR passed almost unnoticed. A small band of hacktivists calling themselves the Cyber Corps (Кіберкорпус) quietly appeared on Telegram, claiming the group “was created by officers of the GUR of the Ministry of Defense.”
Whether the Cyber Corps is genuinely affiliated with the Ukrainian military intelligence service cannot be answered definitively. But a series of indicators and circumstantial evidence suggest some form of organizational relationship. To date, the GUR has neither endorsed the Cyber Corps’ claim that GUR officers created it, nor repudiated the corps’ claims taking credit for cyber operations the GUR officially conducted. Curiously, the Cyber Corps’ distributed denial-of-service (DDoS) activities also increasingly overlapped with, and ultimately led to the absorption of, parts of the IT Army of Ukraine."
Link: lawfaremedia.org/article/the…
If anyone is interested or wants to dig deeper.
According to DC8044, the breach of Russia's emergency alert system was conducted by a group called Honeyshoa.
The group even released a 20-page report on the vulnerability they identified in the API they exploited.
Dropping this 20 page report is very unusual for a hacktivist group.
Then again Honeyshoa's main Telegram account only exists since June 2026.
Stefan Soesanto retweeted
Today @cpartisans and SilentCrow took down Russia's Federal State Statistics Service — the nerve center behind every socioeconomic number this regime produces.
Full breakdown below 👇
Well ... a nice shoutout by the Cyber Corps for my Lawfare piece.
If you haven't read the article yet: lawfaremedia.org/article/the…
The new head of the GRIB - Ri Kyong Chol - is going places.
Hackers stole $6.3 billion from Binance, the world's biggest cryptocurrency exchange, in a record theft that analysts pinned on North Korea and said could shake faith in digital assets reut.rs/4yTqwyz
Just leaving this October 28, 2026, capture of the Cyber Corps' all-time leaderboard here for another write-up.
Reuters: "Pentagon treating military base freezer malfunctions as suspected cyberattack, officials say" reuters.com/technology/penta…
Stefan Soesanto retweeted
#ESETresearch released the latest #ESETAPTActivityReport (Apr–Sep 2026): 🇧🇾 Belarus-aligned APT groups are converging with Russia'’s war priorities; for the first time, we documented a destructive cyberattack by a Belarus-aligned group in 🇺🇦 Ukraine web-assets.esetstatic.com/wl… 1/3
Stefan Soesanto retweeted
Міжнародна розвідувальна спільнота InformNapalm у співпраці з аналітичною групою Ukrainian Militant ексклюзивно публікує результати CYBINT-дослідження масивів даних, здобутих хактивістами групи @256CyberAssault.
Серед отриманих для дослідження матеріалів — документи, особисте і службове листування, фотографії та інші файли, пов’язані з діяльністю співробітників російської Служби зовнішньої розвідки (рос. Служба внешней разведки, СВР). Аналіз цих даних допоміг встановити зв’язок між особами, причетними до російської зовнішньої розвідки, та підготовкою публічних акцій у Будапешті на підтримку будівництва атомної електростанції «Пакш-2», яке здійснюється за участі російської державної корпорації «Росатом».
«Активка» для Росатома: слід СВР у підготовці мітингу за «Пакш-2» в Угорщині 🇭🇺
informnapalm.org/ua/aktyvka-…
Запрошуємо читати та поширювати це дослідження українською, пізніше на сайті також будуть доступні інші мовні версії цього матеріалу.
🤣😂🤣
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
Stefan Soesanto retweeted
Dozens of court hearings in Russia were disrupted due to “technical malfunctions” after strikes by Ukraine’s armed forces on Yandex data centers.
meduza.io/en/news/2026/10/16…
Stefan Soesanto retweeted
Scoop: The US has begun the process of selecting leaders for its private-sector offensive cyber program, sources say. But questions remain about how companies will be paid and who bears responsibility if operations go wrong.
nextgov.com/cybersecurity/20…
