Counterintelligence & Tradecraft — 2026-04-30

Ukrainian Cyber Division Infiltrates Russian Military Satellite System Gonets in Multi-Year Intelligence Operation

Ukraine's 256th Cyber Assault Division, along with the Ukrainian Militant analytical group and InformNapalm intelligence community, conducted a multi-year CYBINT operation against Gonets, Russia's low-orbit satellite communications system integrated into Roscosmos and the military-industrial complex. Between 2023 and 2025, the operators intercepted private communications and internal documents, compromising data of senior officials overseeing the entire IT network and cryptographic protection.

Analysis
Ukraine's decision to publicly disclose this operation after apparent access conclusion, per a single coordinated release from Ukrainian-affiliated outlets with no independent corroboration, converts intelligence equity into strategic messaging aimed at both partners and adversaries. If the reported compromise of cryptographic protection data yielded key material or architecture, Russia faces a remediation burden extending well beyond standard patching. The public release more plausibly functions as a psychological operation to degrade Russian operator confidence in Gonets than as a complete accounting of collected intelligence. Moscow's acknowledgment of any disruption within the next 30 days is very unlikely, consistent with its pattern of denying state-system compromises.
4 sources
  1. Ukraine Cyber Division Infiltrates Russian Military Satellite Comms Gonets in Multi-Year Breach - United24 Media
  2. Ukrainian Hackers Breach Internal Data of Russia's Starlink-Like Gonets System - Militarnyi
  3. Ukrainian cyber experts have been reading emails from top management of Russian analogue Starlink for years - Dev.ua
  4. We breached Russian satellite network, say pro-Ukraine partisans - Cybernews

View in full brief →

UNCLASSIFIED // OPEN SOURCE