GC3 Cyber Diplomacy: How Pre-War Ties Helped Ukraine to Build Energy Sector Resilience During the War

The Cyber Defense Assistance Collaborative (CDAC) has published a case study on Naftogaz’s cyber resilience, an example of how pre-war investments and international coordination helped Ukraine’s energy sector withstand large-scale cyberattacks.

On January 25, 2024, a DDoS attack temporarily disabled the digital infrastructure of Naftogaz, Ukrposhta, Ukrzaliznytsia, and DSBT. However, the companies were restored within days thanks to systematic preparation.

Naftogaz’s success was based on the Security Operations Center (SOC) created back in 2020, which covered 15 subsidiaries and 25,000 endpoints. This allowed the attack to be localized within an hour.

Volodymyr Pavelko of the Global Cyber Cooperation Center (GC3) emphasized the critical importance of relationships built long before a full-scale invasion. It was GC3 that, since 2019, has been building professional and personal trust with foreign organizations, which has allowed for the rapid mobilization of international support since March 2022.

Ukrainian companies are forced to balance investments in cyber defense with the costs of recovering from kinetic attacks. At the same time, the level of donor involvement is decreasing due to the duration of the war.

The conclusion of the study: cyber resilience is a long-term investment, not a military response. Maintaining resilience requires a dual responsibility – from Ukrainian organizations and international partners.

Read the full study