09 - Three Paths of Hacktivism: Russia, Ukraine and Belarus

Presented by Ian Litschko at BSides Toronto 2026 on October 3rd. Exploring the hacktivist landscapes of Russia, Ukraine and Belarus, this talk will look at how the war in Ukraine has shaped the three diverging paths for each country's hacktivist landscape. It will explore novel approaches adopted by hacktivist personas across the three countries, and the differing circumstances for each country that have influenced these choices. The result is a novel framework through which to explore the broader global hacktivist landscape and how real world changes can significantly influence hacktivist activity. The audience will leave this talk with a deeper understanding of hacktivism within Russia/Ukraine/Belarus, and a framework through which to consider hacktivism in a global context. For attendees, they can then apply this to their individual company threat landscapes and explore how the hacktivist landscape can change to inform leadership as the global environment changes. This talk will dissect the distinct paths hacktivist activity from Russia, Ukraine and Belarus have taken. Attendees will learn the differences between each country's hacktivist persona TTPs, with a focus on novelty, and how different approaches lead to different outcomes. There are 3 key takeaways that participants will hopefully leave with. 1) A deeper understanding of the Eastern European hacktivist landscape. Highlights include the different types of threats. For example a Russian hacktivist threat is more akin to a state-nexus threat due to integration with the security services, compared to a Ukrainian hacktivist threat that is more grassroots, aimed at Russia, but patriotically driven, significantly influenced by the situation Ukraine is in. 2) System of governance as a key driver in the dynamic of individual country hacktivist landscapes. Russia as authoritarian is inorganic, with a highly controlled landscape operating in lockstep with, if not in total control of, the security services. Ukraine with its far more democratic tendencies and robust civil society, has a more grassroots driven and organic hacktivist landscape. Conversely, Belarus is unique in that it is a highly authoritarian state, but the hacktivist landscape is driven by a pro-Belarus but anti-regime group. 3) Existential threats drive innovation in hacktivism. Russia, Ukraine and Belarus can each be understood as facing existential threats as of submission, though the existential threat to each is unique to each country's situation. Taken outside of Eastern Europe, how can we apply this hypothesis to understanding the hacktivist threat from other countries, particularly as defenders? This can influence how we as defenders assess threats in countries our businesses already operate in or are looking to expand to. Effectively, what triggers exist in any given country that can lead to the creation of an existential threat that can impact local hacktivists?