While not always directly controlled by the Russian state, pro-Russia hacktivist groups also support Kremlin objectives by launching disruptive cyberattacks, promoting propaganda or amplifying strategic messaging.
The nature of such groups often provide covert shelter to the Kremlin, helping it maintain plausible deniability while contributing to wider influence efforts.
Understanding dynamics
GTIG’s research identifies ten defining characteristics that explain why Russia’s influence ecosystem continues to be effective.
Researchers note that large-scale information operations now form a permanent capability than one-off temporary campaigns, with new operations replacing older ones as strategic priorities evolve.
Persistence is another defining feature. Even after infrastructure is exposed or disrupted, operators frequently recycle domains, create mirror websites and continue using compromised assets to maintain momentum.
The report also highlights the growing convergence of cyber operations and influence campaigns. Stolen data is increasingly weaponised through so-called “hack and leak” operations, while cyberattacks are often accompanied by coordinated disinformation designed to maximise psychological impact.
