Dave Maasland

What Yesterday’s Cyber Ops Tell Us About Tomorrow

Dave Maasland’s core message was that tomorrow’s cyber operations should not be understood primarily through the search for the next spectacular, highly sophisticated attack. His key value proposition for the audience was a reframing: the power of hybrid operations lies in “combination and repetition,” where cyberattacks, information operations, psychological pressure, and economic or political tensions reinforce each other over time. He introduced the talk as a personal distillation of research for a book he has been writing with a coauthor about the first years of Russia’s invasion of Ukraine from a digital perspective, based on interviews with more than 35 people directly involved in defending the digital frontline. He began with the early hours of the 2022 invasion, describing how ESET had discovered wiper attacks a few hours before the physical invasion and how one communications colleague saw the alerts while watching the news at night. For Maasland, this raised the question of whether cyber can act as an early warning system, while also cautioning that this is not the complete role of cyber in war. He then argued that many of the cyber operations seen in recent years were not especially sophisticated, even when some attacks on critical infrastructure and energy systems were advanced. In the case of attacks on the Polish energy sector, he emphasized that the psychological effect of headlines such as “digital tanks are here” may have mattered more than direct consumer disruption. The talk then shifted to GammaRedon, which Maasland described as ESET’s most active group targeting Ukraine over the past five years, despite not being a highly sophisticated actor. He highlighted its targeting of communication systems such as Delta, Signal, WhatsApp, and Telegram web clients, and then connected that espionage activity to psychological operations run on the same infrastructure. Operation Texonto, for example, used denigrating fake emails about food shortages and eating pigeons, alongside fear-inducing messages about avoiding mobilization. This illustrated his point that future cyber operations may matter most when they combine technical access with attempts to shape behavior, fear, and perception. In the available transcript, Maasland concluded this section by arguing that defenders should look less for a single “cyber Pearl Harbor” or breakthrough event and more for coordinated patterns of repeated pressure. He warned that cyber disruption, hack-and-leak operations, altered documents, fake news websites, AI poisoning, and misleading chatbots could all be aligned around one narrative: that democratic systems, intelligence services, or public institutions are failing. His closing emphasis in the excerpt was that these operations build on existing tensions around oil, food, gas, political distrust, and emotionally charged issues, making repeated pressure against trust, unity, and democratic resilience the real strategic concern.