Unraveling The Cyber Battle Between Ukraine And Russia

The talk opens with the presenters' background at a Czech cloud provider serving public administration, and frames threat intelligence as a source of early warning and better resilience. It then walks through cyber activity linked to the Ukraine conflict, from earlier campaigns against Estonia and Georgia to the wiper malware, website defacements and satellite and mobile network disruption seen before the February 2022 invasion. The speakers describe how attacks continued afterward, including constant denial-of-service pressure and a sharp rise in hacktivist groups, one of which was a volunteer call to arms that drew many participants.

The middle section explains how their team moved from reactive monitoring toward active cyber defense. They present a six-step loop that starts with threat intelligence input, then analyzes and prioritizes threats, models likely adversary behaviour, verifies current detection coverage, tunes detections and deception elements such as decoy personas and honeypots, and finally validates the setup. To support this, they extended MISP with custom taxonomy, object and threat-group records. They also note that active defense has traditionally belonged to militaries and intelligence services, so smaller organizations need to choose what is practical for them.

In the question session, an attendee asked where system modeling fits in the process. The presenters said attack surface and threat landscape understanding came first and is still being improved, and they acknowledged relying on information from national authorities that they could not fully verify themselves. The main takeaway is that intelligence must be processed before it is useful, and that deception and intelligence-driven detection can help cover blind spots that traditional security misses.