Offensive Cyber Operations

1982 · 44 years ago

A widely repeated account by a former US National Security Council official held that sabotaged pipeline control software caused a massive explosion on a Soviet gas pipeline in Siberia

The claim, that the CIA allowed the Soviet Union to steal flawed industrial control software which later triggered a huge explosion, has never been fully verified from Soviet-era records, but it remains the earliest and most frequently cited example offered for a software-triggered physical attack on infrastructure.

2007 · 19 years ago

Israeli aircraft reportedly used a cyberattack to disable Syrian air defence radar ahead of a strike on a suspected nuclear reactor site

Accounts of the operation, never officially confirmed by Israel, described a system that fed Syrian air defence operators a false picture showing empty skies while strike aircraft crossed the border undetected, an early and still only partly acknowledged example of cyber operations enabling a physical strike.

2008 · 18 years ago

Cyberattacks against Georgian government and media websites accompanied Russia's 2008 invasion, an early integration of cyber and conventional military operations

Denial-of-service attacks and website defacements ran alongside the physical invasion, disrupting Georgian government communications at a critical moment and offering an early template for combining cyber operations with a conventional military campaign rather than treating them as a separate domain of conflict.

2010 · 16 years ago

The Stuxnet worm was discovered after physically destroying centrifuges at Iran's Natanz enrichment plant

Widely reported to be a joint US-Israeli operation, the malware manipulated industrial equipment to spin centrifuges to destructive speeds while feeding operators false readings showing normal operation, the first confirmed case of software causing deliberate physical destruction of infrastructure.

2012 · 14 years ago

Iran-linked attackers destroyed data on roughly 30,000 computers at Saudi Aramco using malware called Shamoon

The wiper overwrote files with an image and left much of the world's largest oil company's corporate network unusable for weeks, forcing a reliance on manual processes and a global buying spree of replacement hard drives, and it remains one of the most costly corporate cyberattacks on record.

2014 · 12 years ago

North Korea carried out a destructive attack on Sony Pictures Entertainment in retaliation for a film mocking its leader

Attackers wiped data across the studio's networks and leaked internal emails and unreleased films, and the United States took the unusual step of publicly attributing a major cyberattack to a specific government within weeks, followed by new sanctions against North Korea.

• The attack was among the first nation-state cyberattacks framed as retaliation for speech

2015 · 11 years ago

China established the Strategic Support Force, consolidating cyber, space and electronic warfare under one command

Bringing offensive and defensive network operations together with space and electronic warfare capabilities under a single organisation reflected a doctrine that treated information itself, not just territory, as a domain to be fought over and controlled.

2015 · 11 years ago

Russia's Sandworm unit caused the first confirmed cyberattack-induced power outage, cutting electricity to around 230,000 Ukrainian customers

Attackers who had spent months inside utility networks remotely opened circuit breakers at three regional power distributors, briefly plunging parts of Ukraine into darkness in the depths of winter and demonstrating for the first time that a cyberattack alone could switch off part of a national grid.

2016 · 10 years ago

A second Russian attack on Ukraine's power grid used purpose-built malware, later named Industroyer, to automate the attack rather than relying on manual intrusion

Unlike the previous year's outage, which required attackers to manually operate grid control software, the new malware could speak the grid's own control protocols directly, a level of specialised engineering that suggested a template reusable against electrical grids anywhere in the world.

2018 · 8 years ago

US Cyber Command was elevated to a full unified combatant command

The change gave cyber operations the same institutional standing as other military domains such as land, sea, air and space, reflecting a judgement that offensive and defensive cyber capability had become a standing requirement of modern warfare rather than a specialist support function.

July 2025 · last year

Pro-Ukrainian hacktivist groups disrupted Aeroflot, Russia's flagship carrier, grounding flights and leaking passenger data

Groups identifying themselves as Silent Crow and a Belarusian partner claimed to have spent months inside the airline's systems before triggering mass cancellations, one of the most visible disruptive cyberattacks against Russian infrastructure since the invasion of Ukraine began.

June 2025 · last year

A group presumed linked to Israel, calling itself Predatory Sparrow, disrupted Iran's Bank Sepah and destroyed tens of millions of dollars held on a major Iranian cryptocurrency exchange

The attacks, timed to the wider Israel-Iran conflict, knocked banking services offline and burned funds held on the Nobitex exchange rather than stealing them, a deliberately destructive act intended to demonstrate reach into the Iranian financial system rather than to profit from the intrusion.

• The group had previously disrupted Iranian steel plants and fuel payment systems

May 2025 · last year

Hacktivist groups aligned with India and Pakistan traded disruptive attacks and website defacements during the two countries' May 2025 conflict

Government and military-linked websites on both sides faced denial-of-service attacks and defacements, mostly low in sophistication and effect, running alongside the more serious military confrontation rather than materially shaping its outcome.

2025 · last year

Russia's Sandworm military intelligence unit timed wiper malware attacks on Ukrainian networks to coincide with missile strikes

Destructive malware aimed at government and energy sector systems was deployed alongside physical attacks on the same targets, an integration of cyber and kinetic operations that Ukrainian and allied analysts said had become a consistent feature of Russian military planning rather than an occasional tactic.

• Ukrainian grid operators had built up years of experience recovering from such combined attacks

2025 · last year

Ukraine's volunteer <b>IT Army</b> continued a sustained campaign of disruptive attacks on Russian banking, telecoms and transport services

Coordinated through public channels and loosely affiliated with Ukrainian military intelligence, the volunteer collective claimed responsibility for periodic outages at Russian banks and internet providers, part of a wider ecosystem of state-linked and informal hacking groups operating alongside conventional military operations on both sides.

2025 · last year

China's Volt Typhoon maintained pre-positioned access inside US power, water and transport networks

US officials continued to describe the group's presence as preparation for disruptive attacks that could be triggered in a future crisis, most likely a conflict over Taiwan, rather than for the intelligence-gathering purpose behind most Chinese cyber activity.

2025 · last year

An Iran-linked group known as CyberAv3ngers kept exploiting default and weak passwords on internet-exposed industrial control equipment

Small water utilities and other operators using programmable logic controllers left on factory-default settings remained an easy, low-cost target, letting the group deface control panels and, in some cases, disrupt equipment with comparatively little technical effort.

2025 · last year

Taiwan warned that China had pre-positioned disruptive access inside networks supporting power and telecommunications

Officials described the threat as intended to be activated to hamper military mobilisation and civilian resilience in the event of a Chinese attempt to take the island, mirroring warnings the United States had issued about similar Chinese activity inside its own infrastructure.

2025 · last year

The United States moved to simplify the approval process military commanders needed to conduct offensive cyber operations

Changes to the interagency process governing when and how the military could launch disruptive cyber operations were intended to reduce delays that officials said had left commanders unable to respond quickly to fast-moving situations compared with conventional forces.

• Critics warned the changes risked unintended escalation

2024 · 2 years ago

A Russian military intelligence unit, identified by Western agencies as Unit 29155, was linked to sabotage-enabling cyber activity against European logistics and transport firms supporting Ukraine

Western security services said the unit's activity combined digital reconnaissance with support for physical sabotage against rail and freight operators moving military aid, treating commercial logistics companies as legitimate targets in an undeclared campaign against the supply chain to Ukraine.