Ukraine’s IT Army

Abstract The IT Army of Ukraine is unlike any other cyber-threat actor. Created by the Ukraine Ministry of Digital Transformation two days after the Russian invasion, it has gathered, trained and directed thousands of people from inside and outside Ukraine to participate in persistent DDoS campaigns against Russian civilian infrastructure. In its current form, the IT Army is neither civilian nor military, neither public nor private, neither local nor international. Notably, whether it is lawful or unlawful remains unclear. Given its apparent adaptability and its continuing ability to recruit participants and mount cyber campaigns, it is positioned to become an advanced persistent threat.