IT Army of Ukraine

Ukrainska Pravda reported that the IT Army of Ukraine claimed a large-scale DDoS operation against the Russian banking system, including the National Payment Card System (NSPK) which operates Mir cards. According to the group and Russian state media coverage, services at VTB, Sberbank, Tinkoff, Alfa-Bank, Gazprombank and several telecommunications operators were intermittently unavailable, with disruption reported from around 10:00 local time and peaking near 14:00 before being contained. The IT Army described it as 'possibly the largest DDoS attack in history'; NSPK characterised the impact as short-lived.

CSIS's Strategic Technologies Blog published an analysis tracing the IT Army's evolution from an ad-hoc volunteer effort into a more structured organisation with ongoing support from Ukrainian officials. The piece reports a public Telegram membership that peaked around 300,000 in March 2022 and declined to roughly 170,000 by August 2023, and cites estimates of around 65,000 active volunteers in May 2022 and approximately 2,000 attacks conducted by June 2022.

The Center for Security Studies (CSS) at ETH Zurich published 'The IT Army of Ukraine: Structure, Tasking, and Ecosystem' by Stefan Soesanto, describing the initiative as a hybrid construct that is 'neither civilian nor military, neither public nor private, neither local nor international, and neither lawful nor unlawful'. The report documents how, in the absence of a dedicated Ukrainian military cyber command, Kyiv merged emerging state cyber capabilities with a large international volunteer community and an ad-hoc Telegram-based tasking model.

Two days after Russia's full-scale invasion, Ukraine's Vice Prime Minister and Minister of Digital Transformation Mykhailo Fedorov announced via social media the creation of an 'IT Army' and pointed volunteers to a dedicated Telegram channel publishing operational tasks. Ukrainska Pravda quoted Fedorov: 'We are creating an IT Army. All operational tasks will be posted [here]. There's plenty to do for everyone. We continue our fight at the cyber-front.' The channel grew rapidly and an initial target list focused on Russian government, banking and corporate sites including Sberbank and the Moscow Stock Exchange.