A document can be misfiled in a way that says nothing about whether it’s true. This one is an example. The metadata tag attached to the archive copy reads “OCR of the Document | National Security Archive,” a title that matches nothing in the pages that follow. What’s actually there is a 2022 Ukrainian government report, mirrored as a PDF through an archive that had no hand in writing it. That’s a cataloging problem, not a sign the content has been tampered with. Nothing in the body text suggests alteration, only that whoever filed it didn’t bother matching the label to the contents.
A Report, Not a Mystery File
The actual title is “Cyber Artillery & Propaganda: Comprehensive Analysis of Russian Warfare Dimensions,” issued by Ukraine’s State Service of Special Communication and Information Protection (SSSCIP), the agency responsible for the country’s civilian cybersecurity. It’s built as a running log, month by month from February through November 2022, followed by a section called “Typology of Correlations” and a conclusions chapter. The excerpt available to review stops partway through March.
The Two Weeks Before
The report’s log opens with a DDoS attack on February 15, 2022, hitting Ukrainian banking sites, government domains, and the defense ministry. A second wave followed on February 23, the same day Ukraine’s grid operator, Ukrenergo, finished a planned synchronization test linking the national grid to ENTSO-E, the European association of transmission operators. The report states Ukrenergo logged scanning activity from Russian IP ranges during that window. It does not say what the scans were aimed at, or whether any of them got through.
The Morning the Invasion Began
Between roughly 5:00 and 9:00 a.m. on February 24, 2022, a cyberattack disabled modems on Viasat’s KA-SAT satellite network, cutting internet access across Ukraine and reaching into parts of Europe. The malware behind it was later identified as AcidRain, a wiper-type program isolated the following month and linked to the Sandworm group. The report puts the collateral toll in Germany at around 6,000 wind turbines losing connectivity; a separate account instead cites roughly 2,000 turbines still disconnected a month later, a discrepancy the available record doesn’t resolve. The ground invasion and missile strikes began that same day. The report’s log counts 23 separate information-manipulation incidents on February 24, its highest single-day total for the month.
Early March
On March 1, 2022, the report logs a cyberattack on Ukrainian television companies, striking the same day a missile hit Kyiv’s TV tower. The report does not name the malware or the unit behind that intrusion; whatever tool was used there is identified only as the work of Russian hackers. On March 2, Ukraine’s embassy in London was reportedly hacked, coinciding with the announcement of a new UK sanctions package. Both entries carry dates and short descriptions. Neither names the unit or group responsible.
What the Report Concludes
The SSSCIP authors read this recurring overlap, cyber action, missile strike, and propaganda push often landing on the same day, as evidence of a deliberate approach they call “multidimensional aggression,” which they say Russia tested earlier against Georgia. Their argument is that existing international law and military doctrine have no category built for this kind of combined operation. It’s worth being precise about what the report is and isn’t claiming here: it doesn’t flag any single incident in this stretch as unresolved in cause. The conclusion is about the pattern across months, not about any one event being mysterious.
What the Report Doesn’t Have
What the authors don’t supply is any intercepted order, communications intercept, or internal directive tying a specific cyber unit to a specific missile-targeting decision. The case is built on timing: events landing on the same day or within hours of each other. The excerpt available breaks off in the middle of the March entries. The April-through-November chronology and the full “Typology of Correlations” section, both referenced in the document’s own table of contents, simply aren’t in what’s been read.
Said Afterward
Pablo Breuer, formerly with US Special Operations Command, later said the loss of satellite connectivity could have complicated Ukraine’s ability to run networked, combined-arms operations in the war’s opening hours. Oliver Pinson-Roxburgh, CEO of Bulletproof, said the London embassy hack showed Western companies needed to prepare for cyber threats that don’t respect borders. Separately, outside the incident log itself, the report’s authors warn that without a strong international response, similar combined tactics are likely to be used against other countries. These are three separate statements, made by three separate people, about three separate pieces of the record. None of them is the report’s own finding, and none should be read as one.
What’s left, in the section available to read, is a dated chronology and a pattern the authors argue is deliberate. The chronology cuts off before it reaches the months the report’s own table of contents promises. The fuller record, and whatever the missing months contain, simply isn’t part of what was read.