The Russian Federation and its proxies have conducted numerous cyber operations
against Ukraine and states supporting its right to self-determination. These and earlier
operations have resulted in serious damage and upheaval in Ukraine and elsewhere since
2014. However, many observers feared even more effective Russian attacks against
critical infrastructure or integrated conventional-cyber military operations in the wake of
the Russian invasion in February 2022. A year into the conflict, a protracted debate
continues as to why Russian cyber operations did not meet these expectations, focusing
on whether most operations had been successfully thwarted by Ukrainian cyber defences
and assisting actors or whether Russian state and non-state actors have been unable or
unwilling to widely deploy cyber operations. In contrast, this spotlight article provides
nine observations on cyber conflict patterns during the first year of hostilities, focusing
on state-non-state interactions and operational patterns while drawing on EuRepoC data
and third-party analyses. The cyber-attacker ecosystem is expected to further diversify
in the years to come, likely shaping the upcoming cyber threat landscape, as recently
echoed by ENISA`s cyber security threat report for 2030. However, states as cyber
defenders should also ramp up their response options towards those multifaceted
threats, as discussed in this piece.