The clearest signs are selective effects, mixed tradecraft, and activity that tracks military or political objectives rather than standalone digital disruption. When attacks center on disruption, disinformation, wipers, and pre positioning, but do not consistently change battlefield outcomes, they are usually supporting other campaign goals. That pattern suggests cyber is being used to shape timing, confusion, and access, not to replace conventional operations.
How to tell when cyber is supporting the war rather than driving it
Wartime cyber activity is usually support, not the main instrument of conflict, when it produces bounded effects that help another campaign objective instead of independently deciding outcomes. Look for operations that create confusion, delay, denial, or access, but only alongside kinetic, political, or psychological action. The pattern matters more than the headline impact of any one intrusion.
Support activity often shows up as selective targeting, limited duration, and outcomes that are useful because they align with another line of effort. A disruptive action may disable communications, expose information, or pre-position access, yet still leave battlefield control, territorial gains, or coercive pressure to non-cyber means.
By contrast, when cyber is the main instrument, the activity tends to be the primary source of leverage: the attack itself is the event that changes decision-making, service continuity, or command and control. If the cyber effects consistently matter only when paired with artillery, information operations, sanctions pressure, or physical sabotage, cyber is more likely playing a supporting role.
What the tradecraft pattern reveals
Mixed tradecraft is one of the strongest indicators that cyber is being used as part of a broader campaign. Disruption, disinformation, wipers, credential theft, reconnaissance, and pre-positioning may appear together, but their sequencing often tells you the real objective. Cyber is frequently used to shape timing, mask preparation, or widen the attack surface rather than to carry the campaign alone.
The same is true when the activity is heavily oriented toward access and preparation. If operators are building persistence, harvesting credentials, or probing networks while the decisive effects come elsewhere, the cyber piece is functioning like enabling maneuver. That is still serious, but it is analytically different from cyber being the central instrument of coercion.
Independent analysis of adversary infrastructure and campaign behavior often helps separate these roles. Sources such as MITRE ATT&CK Enterprise Matrix are useful because they help map the attack chain, while CISA’s cyber threat advisories help place observed activity into a broader threat context.
What should change your judgment
The key question is whether the cyber activity is producing standalone strategic effect or only amplifying another line of effort. If attacks are periodic, geographically or functionally narrow, and timed to coincide with physical operations or political messaging, that usually points to support rather than primacy. The more cyber effects depend on external events to become meaningful, the less likely cyber is the main instrument.
It is also important not to overread visibility gaps. Many wartime campaigns include limited or delayed attribution, so analysts should judge by effect pattern, target selection, and timing rather than by the sophistication of the malware alone. A quiet intrusion can still be strategically important if it enables later action, but enabling action is still different from decisive action.
For defenders and analysts, active exploitation and staged access should be treated as warning signs that the cyber component may be setting conditions for something larger. CISA’s Known Exploited Vulnerabilities Catalog is helpful here because it reinforces the difference between opportunistic compromise and campaign-level exploitation that supports broader objectives.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | Wartime support cyber often uses access paths that enable later campaign activity. |
| T1110 — Brute Force | Credential harvesting and access-building are common support behaviors in campaign preparation. | |
| T1485 — Data Destruction | Wipers and destructive activity are common wartime effects, but not always the central campaign instrument. | |
| Recommendation — Map observed intrusion paths to ATT&CK techniques and distinguish enabling access from decisive effect. Track credential-access activity as preparation that may support broader conflict operations. Classify destructive actions by their campaign role, not just by their immediate impact. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Correlating timing and effect across systems depends on retained, usable logs. |
| Recommendation — Centralize and retain logs so you can correlate cyber effects with kinetic or informational events. | ||
| NIST CSF 2.0 | DE.AE-01 — Anomalies and events are analyzed to ensure they are understood | Determining whether cyber is primary or supporting depends on interpreting observed events in context. |
| Recommendation — Analyze event patterns in context to determine whether cyber is driving outcomes or supporting them. | ||
Practitioner Guidance
What to verify: Focus on whether the cyber activity changed battlefield tempo, command decisions, or political leverage on its own, or whether its main value was preparation, confusion, or access for another phase. If the answer depends on a later kinetic or informational move, treat cyber as supporting activity.
What to prioritize: Correlate intrusion timing, target class, and observable effect with non-cyber events. The most useful indicator is not volume of activity, but whether the cyber component has independent strategic consequences.
Common mistake: Assuming that destructive malware automatically means cyber is the primary instrument. In wartime, wipers and disruption often serve as enablers, diversions, or synchronization tools inside a larger campaign design.
Practitioner takeaway: The decisive test is whether cyber is creating the main strategic effect, or merely making another instrument of conflict more effective, better timed, or harder to defend against.
Related resources from NHI Mgmt Group
- What are the signs that crypto activity in a conflict zone is being used for malicious support operations rather than humanitarian relief?
- What are the signs that automated traffic is being used for fraud rather than normal browsing activity?
- What are the signs that an open AI chatbot is being used to support malicious activity?
- What are the signs that illicit crypto activity is being used to launder or recycle proceeds rather than just receive payments?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
