In late 2025, Russia used Belarusian civilian infrastructure to control attack UAVs targeting northern Ukraine, revealed via a Ukrainian cyber operation.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

AggressorDefense

Summary

From at least mid-2025 through February 2026, Ukrainian hacktivists from the Fenix cyber analytics center, supported by InformNapalm volunteers, conducted a cyber operation breaking into Russian military personnel accounts. They gained access to monitoring systems for Russian attack drone operators, providing real-time intelligence to Ukrainian Defence Forces. The operation revealed Russia's deployment of UAV control repeaters on Belarusian territory, enabling strikes on northern Ukraine regions and infrastructure. Belarusian civilian infrastructure, especially cell towers, was used to maintain communication channels for drone operations. Telegram-style chats from September 25, 2025, show Russian operators planning drone routes near Chernihiv and referencing targets near NATO borders. The cyber operation ended after successful Ukrainian strikes on Russian command posts diminished reconnaissance value. In response, Ukrainian President Zelenskyy sanctioned Belarusian leader Lukashenka in February 2026 for facilitating Russian aggression.

Classification

Confidence: High

The event clearly details Russian hostile drone operations coordinated via Belarusian infrastructure and a Ukrainian cyber counter-operation that gathered intelligence and enabled defense against these attacks, with official sanctions by Ukraine against Belarus confirming the hostile nature.

Source URL

https://informnapalm.org/en/russian-drone-operators-use-belarus

Open source

Provenance

Publisher: extension
Submitted: Mar 8, 2026, 22:16 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Sep 25, 2025, 11:08 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "137c27a5-85be-4cc9-af1d-d78931dd7154",
  "url": "https://informnapalm.org/en/russian-drone-operators-use-belarus",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Belarus",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "Russia",
    "Belarus",
    "Ukraine",
    "cyberattacks",
    "UAV",
    "drone warfare",
    "hybrid warfare",
    "sanctions",
    "Fenix center",
    "inform napalm",
    "offensive cyber operations",
    "military drone control",
    "Belarusian infrastructure"
  ],
  "nodes": [
    "Node 1: Borders",
    "Node 2: 5th Column"
  ],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "A Ukrainian-led cyber operation from mid-2025 to early 2026 infiltrated Russian military accounts controlling attack drones operated from Belarus. The operation disclosed Russia's deployment of UAV control repeaters within Belarus and use of Belarusian civilian cell towers to coordinate drone attacks on northern Ukraine, impacting Kyiv to Volyn regions. Operators' chat logs from September 25, 2025, include times and code names for UAV missions toward Chernihiv and mention incursions into NATO territory. The intelligence was shared with Ukrainian Defense Forces, bolstering counterdrone responses and culminating in sanctions against Belarusian officials by Ukraine in February 2026.",
  "summary_short": "In late 2025, Russia used Belarusian civilian infrastructure to control attack UAVs targeting northern Ukraine, revealed via a Ukrainian cyber operation.",
  "summary_extended": "From at least mid-2025 through February 2026, Ukrainian hacktivists from the Fenix cyber analytics center, supported by InformNapalm volunteers, conducted a cyber operation breaking into Russian military personnel accounts. They gained access to monitoring systems for Russian attack drone operators, providing real-time intelligence to Ukrainian Defence Forces. The operation revealed Russia's deployment of UAV control repeaters on Belarusian territory, enabling strikes on northern Ukraine regions and infrastructure. Belarusian civilian infrastructure, especially cell towers, was used to maintain communication channels for drone operations. Telegram-style chats from September 25, 2025, show Russian operators planning drone routes near Chernihiv and referencing targets near NATO borders. The cyber operation ended after successful Ukrainian strikes on Russian command posts diminished reconnaissance value. In response, Ukrainian President Zelenskyy sanctioned Belarusian leader Lukashenka in February 2026 for facilitating Russian aggression.",
  "actor_primary": "Fenix cyber analytics center",
  "target_primary": null,
  "location_text": "Belarus",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The event clearly details Russian hostile drone operations coordinated via Belarusian infrastructure and a Ukrainian cyber counter-operation that gathered intelligence and enabled defense against these attacks, with official sanctions by Ukraine against Belarus confirming the hostile nature.",
  "event_time_utc": "2025-09-25T11:08:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-03-08T22:16:19.528Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "exact",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: ExactLocation: Unknown

Source reliability

Info credibility

Event time

Sep 25, 2025, 11:08 UTC

Event time confidence

exact

Location

Belarus

Primary actor

Fenix cyber analytics center

Country

Belarus

Tags

Russia, Belarus, Ukraine, cyberattacks, UAV, drone warfare, hybrid warfare, sanctions, Fenix center, inform napalm, offensive cyber operations, military drone control, Belarusian infrastructure

Nodes

Node 1: Borders, Node 2: 5th Column

Loading signal...

{ "id": "137c27a5-85be-4cc9-af1d-d78931dd7154", "url": "https://informnapalm.org/en/russian-drone-operators-use-belarus", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Belarus", "source_reliability": "B", "info_credibility": "3", "tags": [ "Russia", "Belarus", "Ukraine", "cyberattacks", "UAV", "drone warfare", "hybrid warfare", "sanctions", "Fenix center", "inform napalm", "offensive cyber operations", "military drone control", "Belarusian infrastructure" ], "nodes": [ "Node 1: Borders", "Node 2: 5th Column" ], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "A Ukrainian-led cyber operation from mid-2025 to early 2026 infiltrated Russian military accounts controlling attack drones operated from Belarus. The operation disclosed Russia's deployment of UAV control repeaters within Belarus and use of Belarusian civilian cell towers to coordinate drone attacks on northern Ukraine, impacting Kyiv to Volyn regions. Operators' chat logs from September 25, 2025, include times and code names for UAV missions toward Chernihiv and mention incursions into NATO territory. The intelligence was shared with Ukrainian Defense Forces, bolstering counterdrone responses and culminating in sanctions against Belarusian officials by Ukraine in February 2026.", "summary_short": "In late 2025, Russia used Belarusian civilian infrastructure to control attack UAVs targeting northern Ukraine, revealed via a Ukrainian cyber operation.", "summary_extended": "From at least mid-2025 through February 2026, Ukrainian hacktivists from the Fenix cyber analytics center, supported by InformNapalm volunteers, conducted a cyber operation breaking into Russian military personnel accounts. They gained access to monitoring systems for Russian attack drone operators, providing real-time intelligence to Ukrainian Defence Forces. The operation revealed Russia's deployment of UAV control repeaters on Belarusian territory, enabling strikes on northern Ukraine regions and infrastructure. Belarusian civilian infrastructure, especially cell towers, was used to maintain communication channels for drone operations. Telegram-style chats from September 25, 2025, show Russian operators planning drone routes near Chernihiv and referencing targets near NATO borders. The cyber operation ended after successful Ukrainian strikes on Russian command posts diminished reconnaissance value. In response, Ukrainian President Zelenskyy sanctioned Belarusian leader Lukashenka in February 2026 for facilitating Russian aggression.", "actor_primary": "Fenix cyber analytics center", "target_primary": null, "location_text": "Belarus", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The event clearly details Russian hostile drone operations coordinated via Belarusian infrastructure and a Ukrainian cyber counter-operation that gathered intelligence and enabled defense against these attacks, with official sanctions by Ukraine against Belarus confirming the hostile nature.", "event_time_utc": "2025-09-25T11:08:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-03-08T22:16:19.528Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "exact", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }