In 2025, Russia used Belarusian cell towers to support drone attacks on Ukraine and tested drone routes into Poland; Ukrainian hackers infiltrated Russian systems to gather counterintelligence.

Cyber & Information WarfareCyber AttacksData theft / leaks

AggressorDefense

Summary

Since mid-2025, Russian military forces employed Belarusian civilian cell phone towers to enhance control and routing of drone attacks on Ukraine's northern and western borders. Ukrainian hackers from the Fenix cyber center, supported by the international InformNapalm community, conducted a six-month cyber operation by hacking dozens of Russian military personnel accounts. They gained access to drone monitoring systems, enabling real-time intelligence that improved Ukrainian countermeasures and led to successful strikes on Russian checkpoints. In September 2025, Russian drones were tested entering Poland, using Belarusian infrastructure to plan strikes along logistics routes in Ukraine and Poland, aiming to disrupt Western arms supplies. The operation revealed use of YI-series drones, also found in Baltic states and Poland. The investigation highlights cyberspace as a full theater of military operations. Ukraine imposed sanctions on Belarusian leader Lukashenka partly due to this drone infrastructure support.

Classification

Confidence: High

Classified as aggressor signal because the event describes Russian military use of Belarusian cell towers for drone attacks on Ukraine and incursion into NATO territory. Classified as defense preparation because Ukrainian hackers infiltrated these systems to gather intelligence and support counter drone measures.

Source URL

https://en.belsat.eu/91739697/informnapalm-russia-uses-belarusian-cell-towers-for-drone-attacks-on-ukraine

Open source

Provenance

Publisher: extension
Submitted: Mar 24, 2026, 10:35 UTC
Last updated: Nov 4, 2026, 08:35 UTC
Event time: Feb 23, 2026, 12:04 UTC

Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "5bb50c40-8839-4ade-9ef4-4df4c6ddd0ca",
  "url": "https://en.belsat.eu/91739697/informnapalm-russia-uses-belarusian-cell-towers-for-drone-attacks-on-ukraine",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Data theft / leaks",
  "country": "Belarus",
  "source_reliability": "B",
  "info_credibility": "3",
  "tags": [
    "poland",
    "nato",
    "belarus",
    "uavs",
    "russia",
    "ukraine",
    "cell towers",
    "russian-ukrainian war",
    "belarus-russia",
    "belarusian military",
    "drone attacks",
    "cyber operation",
    "fenix cyber center",
    "inform napalm",
    "yi-series drones"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "A Ukrainian cyber operation starting in mid-2025 identified that Russian forces utilized Belarusian civilian cell phone towers as repeaters to support drone attacks on Ukraine, particularly targeting northern and western regions. Hackers from the Fenix center infiltrated accounts of Russian military personnel and accessed drone operator monitoring systems, enabling covert surveillance and transmission of activity data to Ukrainian Defense Forces. This intelligence helped Ukraine counter Russian drone strikes effectively and conduct successful counterattacks on Russian checkpoints. In September 2025, hackers discovered that drones utilized Belarusian signals to plot routes, including incursions into NATO member Poland, which was assessed as intentional testing of new drone strike tactics to disrupt Ukraine's logistical and supply routes. Data also revealed use of YI-series drones found in Baltic states and Poland after attacks. This six-month cyber operation exposed Belarusian infrastructure's key facilitation role in Russian drone strikes, underlining the prominence of cyberspace as an active military operational domain.",
  "summary_short": "In 2025, Russia used Belarusian cell towers to support drone attacks on Ukraine and tested drone routes into Poland; Ukrainian hackers infiltrated Russian systems to gather counterintelligence.",
  "summary_extended": "Since mid-2025, Russian military forces employed Belarusian civilian cell phone towers to enhance control and routing of drone attacks on Ukraine's northern and western borders. Ukrainian hackers from the Fenix cyber center, supported by the international InformNapalm community, conducted a six-month cyber operation by hacking dozens of Russian military personnel accounts. They gained access to drone monitoring systems, enabling real-time intelligence that improved Ukrainian countermeasures and led to successful strikes on Russian checkpoints. In September 2025, Russian drones were tested entering Poland, using Belarusian infrastructure to plan strikes along logistics routes in Ukraine and Poland, aiming to disrupt Western arms supplies. The operation revealed use of YI-series drones, also found in Baltic states and Poland. The investigation highlights cyberspace as a full theater of military operations. Ukraine imposed sanctions on Belarusian leader Lukashenka partly due to this drone infrastructure support.",
  "actor_primary": "Russian military",
  "target_primary": null,
  "location_text": "Belarusian civilian cell phone towers",
  "location_region": null,
  "location_coordinates_lat": null,
  "location_coordinates_lon": null,
  "location_precision": "Unknown",
  "is_aggressor_signal": true,
  "signal_type": "DEFENSE_PREP_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "Classified as aggressor signal because the event describes Russian military use of Belarusian cell towers for drone attacks on Ukraine and incursion into NATO territory. Classified as defense preparation because Ukrainian hackers infiltrated these systems to gather intelligence and support counter drone measures.",
  "event_time_utc": "2026-02-23T12:04:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "exact",
  "created_at": "2026-03-24T10:35:00.035Z",
  "updated_at": "2026-11-04T08:35:32.139Z",
  "reliability_band": "strong",
  "location_precision_band": "unknown",
  "time_precision_band": "exact",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: ExactLocation: Unknown

Source reliability

Info credibility

Event time

Feb 23, 2026, 12:04 UTC

Event time confidence

exact

Location

Belarusian civilian cell phone towers

Primary actor

Russian military

Country

Belarus

Tags

poland, nato, belarus, uavs, russia, ukraine, cell towers, russian-ukrainian war, belarus-russia, belarusian military, drone attacks, cyber operation, fenix cyber center, inform napalm, yi-series drones

Loading signal...

{ "id": "5bb50c40-8839-4ade-9ef4-4df4c6ddd0ca", "url": "https://en.belsat.eu/91739697/informnapalm-russia-uses-belarusian-cell-towers-for-drone-attacks-on-ukraine", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Data theft / leaks", "country": "Belarus", "source_reliability": "B", "info_credibility": "3", "tags": [ "poland", "nato", "belarus", "uavs", "russia", "ukraine", "cell towers", "russian-ukrainian war", "belarus-russia", "belarusian military", "drone attacks", "cyber operation", "fenix cyber center", "inform napalm", "yi-series drones" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "A Ukrainian cyber operation starting in mid-2025 identified that Russian forces utilized Belarusian civilian cell phone towers as repeaters to support drone attacks on Ukraine, particularly targeting northern and western regions. Hackers from the Fenix center infiltrated accounts of Russian military personnel and accessed drone operator monitoring systems, enabling covert surveillance and transmission of activity data to Ukrainian Defense Forces. This intelligence helped Ukraine counter Russian drone strikes effectively and conduct successful counterattacks on Russian checkpoints. In September 2025, hackers discovered that drones utilized Belarusian signals to plot routes, including incursions into NATO member Poland, which was assessed as intentional testing of new drone strike tactics to disrupt Ukraine's logistical and supply routes. Data also revealed use of YI-series drones found in Baltic states and Poland after attacks. This six-month cyber operation exposed Belarusian infrastructure's key facilitation role in Russian drone strikes, underlining the prominence of cyberspace as an active military operational domain.", "summary_short": "In 2025, Russia used Belarusian cell towers to support drone attacks on Ukraine and tested drone routes into Poland; Ukrainian hackers infiltrated Russian systems to gather counterintelligence.", "summary_extended": "Since mid-2025, Russian military forces employed Belarusian civilian cell phone towers to enhance control and routing of drone attacks on Ukraine's northern and western borders. Ukrainian hackers from the Fenix cyber center, supported by the international InformNapalm community, conducted a six-month cyber operation by hacking dozens of Russian military personnel accounts. They gained access to drone monitoring systems, enabling real-time intelligence that improved Ukrainian countermeasures and led to successful strikes on Russian checkpoints. In September 2025, Russian drones were tested entering Poland, using Belarusian infrastructure to plan strikes along logistics routes in Ukraine and Poland, aiming to disrupt Western arms supplies. The operation revealed use of YI-series drones, also found in Baltic states and Poland. The investigation highlights cyberspace as a full theater of military operations. Ukraine imposed sanctions on Belarusian leader Lukashenka partly due to this drone infrastructure support.", "actor_primary": "Russian military", "target_primary": null, "location_text": "Belarusian civilian cell phone towers", "location_region": null, "location_coordinates_lat": null, "location_coordinates_lon": null, "location_precision": "Unknown", "is_aggressor_signal": true, "signal_type": "DEFENSE_PREP_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "Classified as aggressor signal because the event describes Russian military use of Belarusian cell towers for drone attacks on Ukraine and incursion into NATO territory. Classified as defense preparation because Ukrainian hackers infiltrated these systems to gather intelligence and support counter drone measures.", "event_time_utc": "2026-02-23T12:04:00.000Z", "end_time_utc": null, "event_time_confidence": "exact", "created_at": "2026-03-24T10:35:00.035Z", "updated_at": "2026-11-04T08:35:32.139Z", "reliability_band": "strong", "location_precision_band": "unknown", "time_precision_band": "exact", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }