How Electronic Warfare Shapes the Russia-Ukraine War

"On Ukraine's battlefields, the simple act of powering up a cellphone can beckon a rain of deathly skyfall," reports the Associated Press. "Artillery radar and remote controls for unmanned aerial vehicles may also invite fiery shrapnel showers."

And the same technology can also be used to target navigation, guidance, and communications systems "to blind and deceive the enemy."

This is electronic warfare, a critical but largely invisible aspect of Russia's war against Ukraine. Military commanders largely shun discussing it, fearing they'll jeopardize operations by revealing secrets.... It is used against artillery, fighter jets, cruise missiles, drones and more. Militaries also use it to protect their forces.

It's an area where Russia was thought to have a clear advantage going into the war. Yet, for reasons not entirely clear, its much-touted electronic warfare prowess was barely seen in the war's early stages in the chaotic failure to seize the Ukrainian capital of Kyiv. [A former U.S. Army commander tells the AP "What we're learning now is that the Russians eventually turned it off because it was interfering with their own communications so much."] It has become far more of a factor in fierce fighting in eastern Ukraine, where shorter, easier-to-defend supply lines let Russia move electronic warfare gear closer to the battlefield.

"They are jamming everything their systems can reach," said an official of Aerorozvidka, a reconnaissance team of Ukrainian unmanned aerial vehicle tinkerers, who spoke on the condition of anonymity because of safety concerns. "We can't say they dominate, but they hinder us greatly." A Ukrainian intelligence official called the Russian threat "pretty severe" when it comes to disrupting reconnaissance efforts and commanders' communications with troops. Russian jamming of GPS receivers on drones that Ukraine uses to locate the enemy and direct artillery fire is particularly intense "on the line of contact," he said.

Later the article says Ukraine's Aerorozvidka has also modified camera-equipped drones "to pinpoint enemy positions and drop mortars and grenades. Hacking is also used to poison or disable enemy electronics and collect intelligence."

So far Ukraine has captured "captured important pieces of hardware — a significant intelligence coup — and destroyed at least two multi-vehicle mobile electronic warfare units." They've been aided by technology and intelligence from NATO members (including from satellites and surveillance aircraft). But the article also calls Elon Musk's Starlink "a proven asset."

Its more than 2,200 low-orbiting satellites provide broadband internet to more than 150,000 Ukrainian ground stations. Severing those connections is a challenge for Russia. It is far more difficult to jam low-earth orbiting satellites than geostationary ones.
Musk has won plaudits from the Pentagon for at least temporarily defeating Russian jamming of Ukrainian satellite uplinks with a quick software fix. But he has warned Ukrainians to keep those terminals powered down when possible — they are vulnerable to geolocation — and recently worried on Twitter about redoubled Russian interference efforts.
The article points out that to "stay nimble," Ukraine is also using cutting-edge technologies including software-defined radio and 3D printing.

Read more of this story at Slashdot.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - How Electronic Warfare Shapes the Russia-Ukraine War
id: c33bf13b-9d0c-4107-b273-5379aab9d9fe
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "How Electronic Warfare Shapes " ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("How Electronic Warfare Shapes the Russia")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*How Electronic Warfare Shapes the Russia*"

CommonSecurityLog
| where Message has "How Electronic Warfare Shapes the Russia"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc