OVERVIEW OF 2024 ● Photo: SSSCIP government. A growing concern is that these hacktivists serve as a reserve pool for Russia’s intelligence services, which could eventually involve them in more complex cyberattacks. Oleksandr Potii cyberattacks were uncovered. These attacks aimed to disrupt the stable operations of approximately 20 energy, water and heating companies across ten Ukrainian regions. The attacks were attempted through compromised supply chains, specifically through Ukrainian companies developing specialist software for industrial systems. Thanks to operational measures to detect and respond to these preparations, the attacks were thwarted. Interestingly, the timing of these activities coincided with missile strikes against Ukrainian infrastructure in the spring of 2024, which suggests the cyberattacks were intended to amplify the impact of physical strikes. Another incident involved the discovery of malware called FrostyGoop at a Ukrainian energy-sector facility. It was specifically designed to target industrial systems. This demonstrates that Russian actors continue to refine their tools and plan further cyberattacks on critical infrastructure. How would you characterise Russian hacktivists attacking Ukraine? Are they more of a nuisance or a serious threat? We cannot say that Russian hacktivists significantly contribute to the cyber war compared with Russia’s well-known state-sponsored hacker groups. However, it is important to note that in a totalitarian state like Russia, there are no truly independent hacktivists. To some extent, they are all controlled and work for the Russian CYBER SECURITY IN ESTONIA 2025 Now that North Korea is increasingly involved in the conflict, have you seen more cyberattacks originating from that region? So far, we have not identified any cyberattacks linked to North Korean hacker groups. Still, we cannot rule out the possibility of their involvement in future cyber operations, as Russia’s collaboration with North Korea is growing by the day. What do you foresee as the biggest cyber threats in 2025, both for Ukraine and globally? In 2025, we expect an increase in cyber intelligence operations targeting Ukraine’s security and defence sectors, as well as its defence industry. Given Russia’s preparations for a potential war with NATO, cyber intelligence operations against military organisations in NATO member states will also intensify. Destructive cyberattacks on critical infrastructure will become more frequent and will likely coincide with physical sabotage activities, which Russia has already initiated against NATO member states. Given Russia’s preparations for a potential war with NATO, cyber intelligence operations against military organisations in NATO member states will also intensify. We are also seeing a growing number of financially motivated cyberattacks from Russia against Ukrainian commercial enterprises. This trend is expected to continue and will likely spread to NATO countries. The use of AI in conducting such cyberattacks and the cooperation between cybercriminals and the Russian government, which shields them from international prosecution, will further exacerbate the threat. ● 17