Weaponizing cyberspace means turning digital tools, networks and information into instruments of coercion or destruction. A piece of code that deletes data, a botnet that floods a bank, or malware that switches off a power substation can all serve as weapons. Unlike missiles, though, these weapons travel through the same networks that businesses and citizens use every day.
This article explains the goals, the main techniques and some well-documented examples, and then shows what defenders can learn from them.
Why states weaponize cyberspace
The goals are similar to those of other military capabilities:
- Disruption: take down services, such as banking, telecom or government portals.
- Destruction: wipe data or damage physical equipment.
- Coercion: pressure a government or company with a credible threat.
- Intelligence: gain access that can later be used for sabotage.
- Influence: combine hacking with leaks or disinformation to shape opinion.
Cyber weapons are attractive because they are cheap, deniable and fast. For a fuller discussion, see the advantages and disadvantages of cyber warfare.
Main techniques
Wiper malware
Wipers destroy data and make systems unbootable. For example, Shamoon wiped data on tens of thousands of Saudi Aramco computers in 2012. Similarly, several wipers hit Ukrainian organizations around the start of the full-scale Russian invasion in 2022.
Attacks on industrial control systems
Some malware targets the systems that run power grids, factories and pipelines. Industroyer, used against Ukraine’s grid in 2016, could directly control substation equipment. Later, Triton targeted safety systems at an industrial plant in 2017.
Supply chain compromise
Attackers hide malicious code in trusted software updates. As a result, one compromised vendor can reach thousands of customers, as the SolarWinds case showed in 2020.
Distributed denial of service (DDoS)
Botnets of hijacked devices flood websites and networks with traffic. Although DDoS rarely causes lasting damage, it can disrupt services during a crisis.
Zero-day exploits
Unknown vulnerabilities give attackers a way in that defenders cannot yet patch. Consequently, states and criminal groups pay high prices for them.
Ransomware as cover
Some destructive attacks pose as ransomware. NotPetya in 2017 looked like ransomware, but recovery was not possible, so it acted as a wiper.
Information operations
Finally, hack-and-leak campaigns and disinformation turn stolen data into political pressure. Read more in our guide to psychological warfare.
Legal and ethical questions
Weaponizing cyberspace raises hard questions. When does a cyber operation count as an armed attack? Who is responsible when malware spreads beyond its target? How do states protect civilians when attackers and civilians share the same infrastructure? Our article on cyberwarfare, law and ethics explores these issues.
Lessons for defenders
Most organizations will never face a dedicated state campaign. Even so, they often suffer collateral damage. These measures help against weaponized tools:
- Offline and immutable backups, so wipers cannot destroy every copy.
- Network segmentation, especially between IT and operational technology.
- Fast patching of internet-facing systems, plus virtual patching when fixes are not ready.
- Supplier security reviews and monitoring of software updates.
- DDoS protection from your ISP or a specialist provider.
- Incident response plans that include destructive attacks, not just data theft.
Sources
Worried about targeted attacks on your business? Our VAPT services find weaknesses before attackers do, and our OSINT investigations show what is exposed about your organisation online. Contact us for a quote.
