Ukrainian hackers expose Belarusian role in Russian drone war

07:50

By: Dakir Madiha

Ukrainian hackers expose Belarusian role in Russian drone war

A covert Ukrainian cyber operation has revealed how Russia has been using civilian infrastructure in Belarus to extend the reach and precision of its drone attacks on Ukraine and to probe potential routes over NATO territory. Over several months beginning in mid‑2025, specialists from the Fenix Cyber Center, working with the international volunteer intelligence community InformNapalm, gained access to the accounts and monitoring tools of dozens of Russian military drone operators. The hackers maintained continuous, discreet surveillance of these systems, intercepting flight‑planning data, operational software screens and internal chat logs, which were then relayed in real time to Ukraine’s defense forces. Ukrainian officials say this intelligence helped them anticipate attack routes, improve air defenses and carry out targeted strikes on Russian command posts and launch sites.

Analysis of the intercepted data showed that Russian forces had built a relay network using mobile communication towers and other civilian infrastructure on Belarusian territory close to the Ukrainian border. These repeaters were used to guide Shahed‑type attack drones and other unmanned systems deeper into Ukrainian airspace, significantly increasing Russia’s ability to hit targets in northern and western regions, including around Kyiv and Volyn. Some of the same infrastructure was also used to test drone routes that skirt or briefly cross NATO airspace, including incursions into Poland, prompting concerns among allied governments about the security of weapons supply corridors to Ukraine. Ukrainian cyber teams also traced the network to specific Russian military units, with several successful Ukrainian strikes later reported on facilities used to coordinate or launch drone missions.

The exposure of the Belarus‑based relay system coincided with a shift in Russian drone communications technology after Russian forces lost access to Starlink satellite internet services. Aviation and defense experts say Moscow has increasingly turned to mesh networking, in which communication towers in Belarus connect to the nearest drones, which then relay signals onward to others flying further into Ukrainian territory. This creates an airborne web in which each unmanned aircraft acts as a node, allowing operators to maintain control and receive video feeds over long distances even in contested electromagnetic conditions. According to Ukrainian aviation specialist Anatolii Khrapchynskyi, mobile towers along the Belarusian border have been adapted to provide communications and even non‑GPS navigation support for Russian drones. He argues that disabling the network of repeaters and supporting infrastructure could effectively cripple Russia’s current drone command‑and‑control model.

The intelligence gathered by Ukrainian hackers fed directly into Kyiv’s diplomatic and legal response to Minsk. On 18 February 2026, President Volodymyr Zelensky announced a package of sanctions against Belarusian leader Alexander Lukashenko, explicitly citing Russia’s deployment of relay stations on Belarusian soil in the second half of 2025. Zelensky said that without support from Belarus, Russia would not have been able to conduct some of its most damaging attacks on Ukrainian energy facilities and railway infrastructure. He added that more than 3,000 Belarusian companies were now supplying goods and components to Russia’s war effort, including equipment used in missile and drone production. While analysts note that the new Ukrainian sanctions are largely symbolic given existing US and EU measures against Lukashenko, Kyiv has framed them as part of a broader effort to raise the costs for any state that enables Russia’s military campaign.

Belarus, a close ally of Moscow, has complained of repeated drone incursions into its own airspace and says its air defenses shot down multiple unmanned aircraft in 2025. Lukashenko has publicly acknowledged that Minsk is still struggling to respond effectively to these incidents, even as Western intelligence links Belarusian territory and infrastructure to operations against Ukraine. The Fenix‑InformNapalm operation has also reignited debate in Kyiv about the legal status of offensive cyber units, whose activities remain in a gray zone despite their growing impact on the battlefield. InformNapalm spokespersons and Ukrainian cyber experts have urged lawmakers to formalize the role of such specialists, arguing that deep access to Russian communications and planning systems is becoming as strategically important as traditional intelligence and air defense assets.