Belarus under Lukashenka intensifies digital transnational repression targeting exiles and opposition abroad using spyware, hacking, AI-driven disinformation, surveillance, and DDoS attacks to silence dissent and intimidate civic actors.

Cyber & Information WarfareCyber AttacksHacking, malware, ransomware

Aggressor

Summary

The Lukashenka regime in Belarus conducts extensive digital transnational repression (TNR) targeting Belarusian exile communities, independent media, civil society, and opposition activists across various countries. Methods include unauthorized spyware surveillance (e.g., Pegasus and Resident Bat espionage software), hacking social media and email accounts, coordinated disinformation and intimidation campaigns aided by AI tools, location tracking with face recognition, and Distributed Denial-of-Service (DDoS) attacks on independent online resources. Targets include journalists, political opposition, solidarity initiatives, and monitoring projects like Belarusian Hajun. These actions have facilitated arrests and criminal prosecutions of individuals inside Belarus based on evidence collected abroad, undermined civic space and freedom of expression, and induced fear, insecurity, and self-censorship among exile communities. The regime also threatens exiles with forcible return and persecutes their families. The repression extends to surveillance and harassment of diaspora activities abroad, including filming protests in Poland, Lithuania, and Czech Republic to identify participants. The practices infringe on privacy rights, distort democratic norms, and undermine host state sovereignty. iSANS presented this analysis and recommended that OSCE and democratic states prioritize addressing TNR as a multi-dimensional threat and adopt coordinated protective and investigative frameworks.

Classification

Confidence: High

The documented activities constitute hostile state-sponsored hybrid warfare tactics targeting civil society actors abroad through digital means including espionage, hacking, disinformation, and cyberattacks. These tactics align with aggressive repression and intimidation by an authoritarian regime to silence opposition beyond its borders.

Source URL

https://isans.org/human-rights/digital-transnational-repression-a-growing-threat-to-civic-space-an-example-of-belarus.html

Open source

Provenance

Publisher: extension
Submitted: Jun 25, 2026, 11:59 UTC
Last updated: Nov 8, 2026, 18:32 UTC
Event time: Feb 23, 2025, 12:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "d0ed9c77-f116-4ac6-902d-48fd07a69d34",
  "url": "https://isans.org/human-rights/digital-transnational-repression-a-growing-threat-to-civic-space-an-example-of-belarus.html",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Hacking, malware, ransomware",
  "country": "Unknown",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "transnational repression",
    "digital repression",
    "Belarus",
    "Pegasus spyware",
    "Resident Bat spyware",
    "hacking",
    "DDoS attacks",
    "diaspora surveillance",
    "disinformation",
    "AI-powered content moderation",
    "civil society",
    "human rights",
    "OSCE"
  ],
  "nodes": [],
  "countries": [],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "The Lukashenka regime in Belarus conducts extensive digital transnational repression (TNR) targeting Belarusian exile communities, independent media, civil society, and opposition activists across various countries. Methods include unauthorized spyware surveillance (e.g., Pegasus and Resident Bat espionage software), hacking social media and email accounts, coordinated disinformation and intimidation campaigns aided by AI tools, location tracking with face recognition, and Distributed Denial-of-Service (DDoS) attacks on independent online resources. Targets include journalists, political opposition, solidarity initiatives, and monitoring projects like Belarusian Hajun. These actions have facilitated arrests and criminal prosecutions of individuals inside Belarus based on evidence collected abroad, undermined civic space and freedom of expression, and induced fear, insecurity, and self-censorship among exile communities. The regime also threatens exiles with forcible return and persecutes their families. The repression extends to surveillance and harassment of diaspora activities abroad, including filming protests in Poland, Lithuania, and Czech Republic to identify participants. The practices infringe on privacy rights, distort democratic norms, and undermine host state sovereignty. iSANS presented this analysis and recommended that OSCE and democratic states prioritize addressing TNR as a multi-dimensional threat and adopt coordinated protective and investigative frameworks.",
  "summary_short": "Belarus under Lukashenka intensifies digital transnational repression targeting exiles and opposition abroad using spyware, hacking, AI-driven disinformation, surveillance, and DDoS attacks to silence dissent and intimidate civic actors.",
  "summary_extended": null,
  "actor_primary": "Belarusian KGB",
  "target_primary": null,
  "location_text": "Poland, Lithuania, Czech Republic",
  "location_region": "Europe",
  "location_coordinates_lat": 51.9194,
  "location_coordinates_lon": 19.1451,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The documented activities constitute hostile state-sponsored hybrid warfare tactics targeting civil society actors abroad through digital means including espionage, hacking, disinformation, and cyberattacks. These tactics align with aggressive repression and intimidation by an authoritarian regime to silence opposition beyond its borders.",
  "event_time_utc": "2025-02-23T12:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "unknown",
  "created_at": "2026-06-25T11:59:00.048Z",
  "updated_at": "2026-11-08T18:32:16.888Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "unknown",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: UnknownLocation: Regional

Source reliability

Info credibility

Event time

Feb 23, 2025, 12:00 UTC

Event time confidence

unknown

Location

Poland, Lithuania, Czech Republic

Region

Europe

Primary actor

Belarusian KGB

Country

Unknown

Tags

transnational repression, digital repression, Belarus, Pegasus spyware, Resident Bat spyware, hacking, DDoS attacks, diaspora surveillance, disinformation, AI-powered content moderation, civil society, human rights, OSCE

Loading signal...

{ "id": "d0ed9c77-f116-4ac6-902d-48fd07a69d34", "url": "https://isans.org/human-rights/digital-transnational-repression-a-growing-threat-to-civic-space-an-example-of-belarus.html", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Hacking, malware, ransomware", "country": "Unknown", "source_reliability": "C", "info_credibility": "3", "tags": [ "transnational repression", "digital repression", "Belarus", "Pegasus spyware", "Resident Bat spyware", "hacking", "DDoS attacks", "diaspora surveillance", "disinformation", "AI-powered content moderation", "civil society", "human rights", "OSCE" ], "nodes": [], "countries": [], "where_text": "Cyberspace", "headline": null, "description": "The Lukashenka regime in Belarus conducts extensive digital transnational repression (TNR) targeting Belarusian exile communities, independent media, civil society, and opposition activists across various countries. Methods include unauthorized spyware surveillance (e.g., Pegasus and Resident Bat espionage software), hacking social media and email accounts, coordinated disinformation and intimidation campaigns aided by AI tools, location tracking with face recognition, and Distributed Denial-of-Service (DDoS) attacks on independent online resources. Targets include journalists, political opposition, solidarity initiatives, and monitoring projects like Belarusian Hajun. These actions have facilitated arrests and criminal prosecutions of individuals inside Belarus based on evidence collected abroad, undermined civic space and freedom of expression, and induced fear, insecurity, and self-censorship among exile communities. The regime also threatens exiles with forcible return and persecutes their families. The repression extends to surveillance and harassment of diaspora activities abroad, including filming protests in Poland, Lithuania, and Czech Republic to identify participants. The practices infringe on privacy rights, distort democratic norms, and undermine host state sovereignty. iSANS presented this analysis and recommended that OSCE and democratic states prioritize addressing TNR as a multi-dimensional threat and adopt coordinated protective and investigative frameworks.", "summary_short": "Belarus under Lukashenka intensifies digital transnational repression targeting exiles and opposition abroad using spyware, hacking, AI-driven disinformation, surveillance, and DDoS attacks to silence dissent and intimidate civic actors.", "summary_extended": null, "actor_primary": "Belarusian KGB", "target_primary": null, "location_text": "Poland, Lithuania, Czech Republic", "location_region": "Europe", "location_coordinates_lat": 51.9194, "location_coordinates_lon": 19.1451, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The documented activities constitute hostile state-sponsored hybrid warfare tactics targeting civil society actors abroad through digital means including espionage, hacking, disinformation, and cyberattacks. These tactics align with aggressive repression and intimidation by an authoritarian regime to silence opposition beyond its borders.", "event_time_utc": "2025-02-23T12:00:00.000Z", "end_time_utc": null, "event_time_confidence": "unknown", "created_at": "2026-06-25T11:59:00.048Z", "updated_at": "2026-11-08T18:32:16.888Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "unknown", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }