Table of Contents
Introduction
Traveling this week gave me some rare downtime and my thoughts kept coming back to some news I’d read last. A cyberattack had disrupted Ukraine’s national railway. It wasn’t a derailment or physical sabotage, but a digital strike that halted trains, delayed movement, and served as a reminder of how intertwined our physical and digital worlds have become.
This incident was one of many. Across Europe and beyond, oil companies, public services, internet providers, and even smart home devices had been caught in the crosshairs of cyber campaigns. Some attacks appeared to come from nationalist hacktivist groups, others from state-aligned actors—and it can be hard to tell the difference. What we saw was a broad and borderless use of cyber capabilities, often in response to political positions, alliances, or symbolic gestures.
These were just the latest example that infrastructure itself has become a target, whether it was intended or incidental. Either way, it’s unsettling.
A Shift in the Threat Landscape
DDoS attacks and other disruption techniques have been part of the internet’s history for decades. Often dismissed as blunt instruments, they’ve taken on new relevance in recent conflicts. They’re cheap to launch, difficult to attribute, and effective at making a point.
Today, the goal isn’t always financial gain or data theft. Increasingly, it seems to be disruption itself—an intentional effort to undermine availability and confidence in systems we rely on every day.
Whether it’s a public website or a control system for critical infrastructure, if it’s connected, it’s within reach.
A Broader Impact Than We Might Expect
These events may seem distant or unrelated, but the effects can ripple far and wide. Even if your organization isn’t in the transportation or energy sector, it likely depends on those services to operate. A disruption upstream—whether through a cyberattack or an overloaded provider—can cascade into unexpected places.
And the targeting goes both ways. In many cases, organizations perceived as even loosely aligned with one side of a conflict—sometimes simply by being located within a particular country—may find themselves targeted by threat actors from the other. It’s not a one-sided campaign; it’s a dynamic and evolving environment where motivations are complex, and cause and effect are not always easy to trace.
The boundaries between state-driven actions and independent activism continue to blur, especially when nationalist groups act in parallel with or on behalf of state interests. In such a landscape, attribution becomes more art than science—and response strategies grow more complicated as a result.
Considering the Implications
For those of us in leadership roles, these events invite reflection more than prescription. We may want to ask:
- How resilient are the systems we depend on?
- Have we accounted for geopolitical risk in our continuity planning?
- Do we have clear communication channels across departments and with partners in the event of an unexpected outage?
- Do we have the visibility and response capabilities we need to defend ourselves?
CISOs in particular have been navigating this terrain for years, but these developments suggest it’s a shared conversation—not just a technical one.
Availability as a Strategic Concern
DDoS remains a pernicious and effective tactic, but how it’s employed is evolving—often reflecting the shifting strategies of both nationalist hacktivist groups and state-aligned actors. What was once considered a blunt tool is now being adapted to serve more complex objectives in an increasingly murky threat landscape. We’re seeing shifts not just in scale or frequency, but in purpose. Increasingly, these attacks aim to disrupt services outright—not to steal data or demand ransom, but to undermine availability and sow uncertainty.
Availability isn’t just a technical metric. It reflects trust, business continuity, and, increasingly, a form of political expression. In today’s climate, service disruption plays a central role in shaping how conflicts unfold and how infrastructure becomes a point of leverage.
Where this trend leads is unclear. But what’s becoming evident is that infrastructure has increasingly become a digital battleground.
If nothing else, it’s a reminder of how deeply connected we all are—and how easily that connectivity can be manipulated.
