Lyce · Hybrid Watch

hw_3a57e84e36c9ec70

Russian-linked hackers target Kosovo government websites in cyber-assault.

Kosovo’s government confirmed that several government websites—including those of the Prime Minister and President—were hit by a distributed-denial-of-service (DDoS) and defacement campaign, which the IT-authority attributed to Russian hackers in response to Kosovo’s military support for Ukraine. According to the report, the websites went offline for several hours, with the Government spokesperson stating that the action was “in retaliation for our support for Ukraine with military equipment.” Cybersecurity analysts pointed to IP-addresses and command-and-control infrastructure that traced back to Russia-linked cyber-crime groups. The geographic focus is Kosovo’s capital and national institutional infrastructure rather than only border zones, indicating that hybrid threats reach deep into national systems. The dynamics reflect classic hybrid-warfare logic: the attacker uses cyber-means to impose cost, degrade institutional readiness and create uncertainty, rather than deploying missiles or bombs. The incident shows how even smaller states in the Balkans like Kosovo are drawn into Russia’s broader hybrid-warfare environment through digital operations, especially when they take a stand—such as supporting Ukraine.

Occurrence
2024-05-08
Publication
2024-05-07T22:00:00Z
First observed
2026-09-24T06:09:10.079Z
Review status
Not assessed
Countries
XK
Updated
2026-09-27T23:56:59.668Z

E/M/R/S scores

  • EExistence0/4 · Not assessed
  • MIntent0/4 · Not assessed
  • RRussian actor link0/4 · Not assessed
  • SRussian state responsibility0/4 · Not assessed

Facts

No facts

Sources

  1. Role
    discovery_lead
    Date
    2024-05-07T22:00:00Z

    Kosovo’s government confirmed that several government websites—including those of the Prime Minister and President—were hit by a distributed-denial-of-service (DDoS) and defacement campaign, which the IT-authority attributed to Russian hackers in response to Kosovo’s military support for Ukraine. According to the report, the websites went offline for several hours, with the Government spokesperson stating that the action was “in retaliation for our support for Ukraine with military equipment.” Cybersecurity analysts pointed to IP-addresses and command-and-control infrastructure that traced back to Russia-linked cyber-crime groups. The geographic focus is Kosovo’s capital and national institutional infrastructure rather than only border zones, indicating that hybrid threats reach deep into national systems. The dynamics reflect classic hybrid-warfare logic: the attacker uses cyber-means to impose cost, degrade institutional readiness and create uncertainty, rather than deploying missiles or bombs. The incident shows how even smaller states in the Balkans like Kosovo are drawn into Russia’s broader hybrid-warfare environment through digital operations, especially when they take a stand—such as supporting Ukraine.