From Cyber Attacks to Missile Barrages: Russia’s Evolving Ukraine Strategy

Summary

Last winter, Russia attempted to break the will of the Ukrainian people to force a peace settlement through widespread attacks against Ukraine’s energy sector. Having failed, and in the face of an increasingly advanced Ukrainian air defense posture, Moscow likely shifted tactics.

On 29 December 2023, Russia launched the largest barrage of missiles and drones against key cities across Ukraine since the start of the war. Similar large-scale attacks have continued into 2024. These barrages have primarily targeted the front line, as shown in Figure 1, striking energy infrastructure with far less frequency than in 2023.

Background

Ukraine’s energy grid operator, Ukrenergo, indicated that Russia damaged or destroyed more than 40% of Ukraine’s electric transmission grid in late 2022. Russia increased attacks on energy infrastructure in the fall of 2022, peaking in October, according to OMEN™ curated data, as shown in Figures 1 and 2. These attacks were designed to cripple Ukraine’s electric grid leading into winter, which runs from December through March, and to freeze the civilian population into submission.

Another threat to Ukraine’s critical infrastructure remains looming—attacks from cyber groups such as Sandworm. Sandworm is a highly sophisticated threat actor operated by Russia’s military intelligence service. In 2016 and 2022, Sandworm attacked Ukraine’s power grid, as shown in Figure 3. Sandworm continues to conduct cyber attacks, with the most recently reported incident targeting Ukrainian military communications in August 2023.

Since the physical and cyber attacks in the winter of 2022, Ukraine has prepared for an expected renewed assault on its energy infrastructure this winter. In addition to repairing the damage, workers have moved what they can underground while fortifying above-ground infrastructure against attacks. Ukraine’s allies have ramped up air defense system deliveries to intercept missiles and drones. Aid groups have delivered new generators to provide heat when Russia disables electricity in a region. And new green energy installations have diversified the grid for resilience against fuel shortage threats.

Current Situation

In October and November 2023, Russia ramped up shelling of energy infrastructure. Portions of Donetsk, Kharkiv, Kherson, and Dnipropetrovsk Oblasts experienced electrical and natural gas disruptions from these attacks. This shelling continued into December, with attacks on thermal power plants (TPPs) near the frontline. However, the number of attacks against energy infrastructure pales in comparison to the prior winter.

It is possible that the lack of Russian missile attacks against Ukraine’s energy infrastructure was a delay as Moscow prepared for a winter campaign. Ukrainian intelligence reported that Russia had stockpiled hundreds of missiles in preparation for a winter air campaign. A U.K. Defence Intelligence update indicated that the 7 December 2023 air-launched cruise missile barrage against Ukraine referenced in Figure 4 were likely the start of a dedicated effort to degrade Ukraine’s electric grid. Russia’s attacks on critical energy and water infrastructure continued with 11 and 13 December strikes across Ukraine.

However, as winter in Ukraine continues without a notable uptick in strikes, alternative explanations may better account for Russia’s shifting tactics. Having not achieved its objective last winter of breaking the will of the Ukrainian population, Moscow possibly shifted its focus to militarily relevant targets and population centers.

On 29 December 2023, Russia launched the largest barrage of missile and drone attacks reported since the start of the invasion. Some of the damage from this attack is shown in Figure 5. Ukrainian officials have indicated that this and subsequent barrages have primarily targeted civilian population centers, the military industrial complex, and positions along the front line.

This shift in tactics may also be the result of the effectiveness of Ukraine’s air defense system improvements in 2023 and Russia’s dwindling stockpile of weapons. Ukraine increasingly thwarted smaller-scale Russian attacks throughout 2023. The improved intercept rate was the result of increased missile defense production and the acquisition of western-made systems better able to intercept Russian systems.

In response, Moscow has likely shifted to large-scale assaults in the hope that at least some weapons penetrate air defenses. To do this, they have had to rely on their limited allies around the world.

The U.S. and its allies have linked the missiles used on 30 December and 2 January attacks to North Korea. This is illustrated by Ukrainian analysis of missile wreckage, shown in Figure 6, indicating a North Korean KN-23 short- range ballistic missile was used during the 2 January strikes. Moscow violated multiple U.N. security council resolutions imposing a weapons export embargo on North Korea. An embargo that Moscow previously supported.

Russia has also begun diversifying its Shahed drone arsenal from Iran. Russia’s early 2024 attacks on Ukraine have included jet, rather than propeller, powered Shahed drones. Figure 7 shows the wreckage of one of these jet- powered Shahed drones. Iran only publicly revealed the existence of these jet-powered drones in September 2023.

Implications

Russia’s increasing reliance on North Korea and Iran for military support amidst global sanctions is reshaping regional dynamics and international relations. These collaborations underscore a strategic shift, where Russia, cornered by Western sanctions, turns to North Korea and Iran for essential armaments. In exchange, North Korea and Iran gain advanced military technologies and vital economic assistance.

These burgeoning partnerships pose significant challenges to international sanctions and diplomacy. It also reflects a broader realignment in global politics, with Russia, North Korea, Iran, and China forming a counterbalance to Western power. This cooperation not only exacerbates regional tensions, but also underscores the complexities and limitations of traditional diplomatic measures in a multipolar world.

As the U.S. and its allies navigate the intricate and evolving landscape of the Russia-Ukraine conflict, the importance of accurate, real-time intelligence becomes increasingly clear. The strategic shifts and alignments, like Russia’s turn to North Korea and Iran for military support, are more than just momentary changes; they are indicative of a broader transformation in global politics. These dynamics demand a sophisticated understanding of geopolitical shifts and their implications.

At 3GIMBALS, we recognize that staying ahead in this multifaceted conflict requires a robust, adaptable intelligence framework. Our OMEN™ solution is designed to provide persistent monitoring and insightful analysis, tailored to these emerging global challenges. Whether it’s understanding the implications of Sandworm’s cyberattacks or dissecting the nuances of international arms trade, our team is equipped to deliver the critical intelligence that organizations and decision-makers need in these complex times.

To further explore the implications of Russia’s evolving tactics, the role of cyber warfare in modern conflicts, or to discuss how our OMEN™ solution can be customized to your specific intelligence needs, use info@3gimbals.com to connect with 3GIMBALS.