Offensive Cyber Operations

The claim, that the CIA allowed the Soviet Union to steal flawed industrial control software which later triggered a huge explosion, has never been fully verified from Soviet-era records, but it remains the earliest and most frequently cited example offered for a software-triggered physical attack on infrastructure.

Accounts of the operation, never officially confirmed by Israel, described a system that fed Syrian air defence operators a false picture showing empty skies while strike aircraft crossed the border undetected, an early and still only partly acknowledged example of cyber operations enabling a physical strike.

Denial-of-service attacks and website defacements ran alongside the physical invasion, disrupting Georgian government communications at a critical moment and offering an early template for combining cyber operations with a conventional military campaign rather than treating them as a separate domain of conflict.

Widely reported to be a joint US-Israeli operation, the malware manipulated industrial equipment to spin centrifuges to destructive speeds while feeding operators false readings showing normal operation, the first confirmed case of software causing deliberate physical destruction of infrastructure.

The wiper overwrote files with an image and left much of the world's largest oil company's corporate network unusable for weeks, forcing a reliance on manual processes and a global buying spree of replacement hard drives, and it remains one of the most costly corporate cyberattacks on record.

Attackers wiped data across the studio's networks and leaked internal emails and unreleased films, and the United States took the unusual step of publicly attributing a major cyberattack to a specific government within weeks, followed by new sanctions against North Korea.

Bringing offensive and defensive network operations together with space and electronic warfare capabilities under a single organisation reflected a doctrine that treated information itself, not just territory, as a domain to be fought over and controlled.

Attackers who had spent months inside utility networks remotely opened circuit breakers at three regional power distributors, briefly plunging parts of Ukraine into darkness in the depths of winter and demonstrating for the first time that a cyberattack alone could switch off part of a national grid.

Unlike the previous year's outage, which required attackers to manually operate grid control software, the new malware could speak the grid's own control protocols directly, a level of specialised engineering that suggested a template reusable against electrical grids anywhere in the world.

The change gave cyber operations the same institutional standing as other military domains such as land, sea, air and space, reflecting a judgement that offensive and defensive cyber capability had become a standing requirement of modern warfare rather than a specialist support function.

Groups identifying themselves as Silent Crow and a Belarusian partner claimed to have spent months inside the airline's systems before triggering mass cancellations, one of the most visible disruptive cyberattacks against Russian infrastructure since the invasion of Ukraine began.

The attacks, timed to the wider Israel-Iran conflict, knocked banking services offline and burned funds held on the Nobitex exchange rather than stealing them, a deliberately destructive act intended to demonstrate reach into the Iranian financial system rather than to profit from the intrusion.

Government and military-linked websites on both sides faced denial-of-service attacks and defacements, mostly low in sophistication and effect, running alongside the more serious military confrontation rather than materially shaping its outcome.

Destructive malware aimed at government and energy sector systems was deployed alongside physical attacks on the same targets, an integration of cyber and kinetic operations that Ukrainian and allied analysts said had become a consistent feature of Russian military planning rather than an occasional tactic.

Coordinated through public channels and loosely affiliated with Ukrainian military intelligence, the volunteer collective claimed responsibility for periodic outages at Russian banks and internet providers, part of a wider ecosystem of state-linked and informal hacking groups operating alongside conventional military operations on both sides.

US officials continued to describe the group's presence as preparation for disruptive attacks that could be triggered in a future crisis, most likely a conflict over Taiwan, rather than for the intelligence-gathering purpose behind most Chinese cyber activity.

Small water utilities and other operators using programmable logic controllers left on factory-default settings remained an easy, low-cost target, letting the group deface control panels and, in some cases, disrupt equipment with comparatively little technical effort.

Officials described the threat as intended to be activated to hamper military mobilisation and civilian resilience in the event of a Chinese attempt to take the island, mirroring warnings the United States had issued about similar Chinese activity inside its own infrastructure.

Changes to the interagency process governing when and how the military could launch disruptive cyber operations were intended to reduce delays that officials said had left commanders unable to respond quickly to fast-moving situations compared with conventional forces.

Western security services said the unit's activity combined digital reconnaissance with support for physical sabotage against rail and freight operators moving military aid, treating commercial logistics companies as legitimate targets in an undeclared campaign against the supply chain to Ukraine.