Russia's invasion of Ukraine, which began on Thursday, 24 February 2022, opened a second front within three days, and it is one anyone with a laptop can watch. On Saturday, 26 February, Ukraine's vice-prime minister and minister of digital transformation, Mykhailo Fedorov, tweeted: "We are creating an IT army. We continue to fight on the cyber front." The tweet linked to a Telegram channel that listed targets: Russian government websites, state banks, energy companies and the personal accounts of prominent figures.
What the volunteers did
The channel passed 100,000 subscribers within days. Its first assignments were distributed denial-of-service attacks, flooding a site with traffic until it falls over, and by the weekend the Kremlin's own website, kremlin.ru, and several ministries were intermittently offline. Ukrainian officials also asked local hackers to gather intelligence on Russian troop movements. Nothing like it had been organised openly by a government before.
What came before it
The cyber war did not start with Ukraine's call. In the week before the invasion, DDoS attacks knocked out the websites of Ukraine's defence ministry and two state banks; the United States and Britain publicly blamed Russia's military intelligence agency. On 23 February the antivirus firm ESET found data-wiping malware, later named HermeticWiper, on hundreds of computers at Ukrainian organisations, timed to detonate as the tanks moved.
Why not to join from Bangladesh
Bangladeshi Facebook groups were sharing the Telegram link within hours, and some young people asked how to "help". Three reasons to close the tab:
- It is illegal here. Taking part in a DDoS, whatever the target, is an offence under the Digital Security Act, and your ISP logs make attribution trivial.
- The tools bite back. Several "DDoS kits" circulating for the IT Army were later found to carry password-stealing malware aimed at the volunteers themselves.
- Collateral damage is real. Attacks on Russian banks and payment networks hit ordinary people, including the Bangladeshi students and workers in Russia who depend on them.
The better lesson for Bangladesh is defensive. The same wiper and DDoS techniques do not respect borders, and the country's own critical systems, from banks to the power grid, run on the same software. BGD e-GOV CIRT, the national incident response team, issued its own alert that week asking institutions to patch, back up offline and watch for unusual traffic. That is the cyber front that actually matters here.
