Ukraine has previously targeted Russian election infrastructure with cyberattacks, including systems used for electronic voting. As Russia holds its 2026 State Duma election, new claims allege a broader Ukrainian and Western operation, but the evidence supports some parts of that account far more strongly than others.
INR Report: Based on reporting by UkrLeaks for UkrLeaks Eng HERE
Russia is holding elections for its 450-seat State Duma from September 18 to 20, 2026, against the background of the continuing war in Ukraine and an increasingly active cyber conflict between Moscow and Kyiv.
A new report from UkrLeaks argues that Ukraine has developed significant offensive cyber capabilities capable of targeting Russian government institutions and election infrastructure. It goes further, alleging that European governments and Western specialists are involved in preparations to interfere with Russia's 2026 election.
There is substantial evidence for the first proposition.
The evidence for the second is considerably less clear.
Ukraine Has Already Targeted Russian Elections
Ukraine's military intelligence service, commonly known as HUR or GUR, claimed responsibility for a large-scale cyberattack against Russian election infrastructure during regional elections in September 2025.
According to reporting by Interfax-Ukraine, Ukrainian intelligence said the attack targeted servers belonging to Russia's Central Election Commission, the remote electronic voting platform, backbone routers operated by Rostelecom and servers supporting the Gosuslugi state services portal.
The stated purpose was to disrupt online voting, particularly voting being conducted in Russian-controlled areas of Ukraine.
Statement reproduced by UkrLeaks regarding the cyberattack on Russian Central Election Commission servers. Source: UkrLeaks Eng.
The attack was not simply a Russian allegation.
Ukrainian intelligence sources themselves claimed responsibility.
Independent cyber-security publication The Record reported that HUR said it had attacked the Central Election Commission and other Russian government services. Russian officials also acknowledged disruption to election-related infrastructure, although they disputed the extent to which voting itself had been affected.
That distinction matters.
The existence of the attack is well supported. Claims about precisely how much it altered or prevented voting are harder to establish independently.
The Cyber Conflict Is Much Larger Than Elections
The 2025 election operation was part of a much wider cyber conflict accompanying the physical war.
Ukraine's intelligence and security agencies have publicly developed cyber capabilities since Russia's full-scale invasion in February 2022.
UkrLeaks points to material describing the creation of what Ukrainian sources called a form of cyber territorial defence, involving information-security specialists and hackers.
SBU material reproduced by UkrLeaks concerning the development of a Ukrainian “cyber front”. Source: UkrLeaks Eng.
Ukraine's Security Service, the SBU, has itself acknowledged that cyber operations have become part of the war.
SBU chief Vasyl Maliuk has previously described cybersecurity personnel operating in frontline areas and acknowledged assistance from foreign partners involving equipment and intelligence.
That establishes international assistance to Ukraine's cyber capabilities.
It does not, by itself, establish that foreign personnel are directly conducting attacks against Russian election systems.
Indeed, Maliuk has previously said that there were no foreign cyber units operating inside Ukraine, while acknowledging significant support from international partners.
Ukraine Has Been Building Offensive Capability
The UkrLeaks material also points to specialist training within the National Academy of the SBU, including cybersecurity and protection of critical infrastructure.
Material reproduced by UkrLeaks describing fields of study at the National Academy of the SBU. Source: UkrLeaks Eng.
UkrLeaks claims that selected cadets were subsequently involved in OSINT and phishing activities alongside the SBU department responsible for counter-intelligence protection of state interests in information security.
The report describes an OSINT group tasked with identifying Russian FSB educational institutions and collecting information about cadets, including addresses, personal interests and social connections.
A separate phishing group is alleged to have developed targeted operations intended to obtain credentials, telephone numbers and other confidential information.
Diagram published by UkrLeaks describing the alleged structure of an SBU-linked phishing group. Source: UkrLeaks Eng.
These documents provide useful insight into the alleged organisation of Ukrainian cyber activity.
They should nevertheless be treated carefully.
INR has not independently authenticated the underlying leaked documents, and the documents do not by themselves prove every operational conclusion drawn from them by UkrLeaks.
The Claim of Western Direction
The most consequential allegation in the UkrLeaks report concerns Western involvement.
The article cites Russia's Foreign Intelligence Service, the SVR, as claiming that the European Union and major European governments intend to destabilise Russia's domestic political environment around the September 2026 election.
According to that allegation, Ukrainian hackers could conduct operations themselves or claim responsibility for activities undertaken by Western specialists.
That would represent something substantially different from Western governments supplying Ukraine with cyber-defence technology, intelligence or training.
It would mean direct foreign involvement in operations against another country's election infrastructure.
At present, publicly available evidence does not establish that claim.
Western assistance to Ukraine's cyber capabilities is well documented. Ukrainian attacks against Russian state and election infrastructure are also documented.
But those two facts do not automatically prove that Western specialists conducted the attacks themselves.
The distinction is important.
Russia’s Election Has Its Own Democratic Questions
Cyber interference is also not the only issue surrounding Russia's parliamentary election.
Russia's current vote is being held in a political system in which meaningful opposition has been sharply restricted. Reuters reports that most prominent anti-war candidates have been excluded, while the liberal Yabloko party has been barred from the party-list contest.
Russia is also conducting voting in Ukrainian territories it controls, something Ukraine and European governments reject as illegal.
These circumstances do not make cyberattacks against election infrastructure imaginary.
Nor does evidence of Ukrainian cyberattacks resolve questions about the openness or legitimacy of Russia's domestic electoral system.
Both can be true simultaneously: Russia can operate a highly controlled political system while Ukraine conducts offensive cyber operations against Russian electoral infrastructure.
The Bigger Story Is Cyber Sovereignty
The deeper significance of the episode is therefore larger than Russia or Ukraine.
Modern elections increasingly depend on digital identity systems, government portals, telecommunications networks, electronic voting infrastructure and interconnected databases.
That creates efficiency.
It also creates attack surfaces.
A foreign government no longer needs to physically enter another country to interfere with infrastructure associated with an election. Cyber units thousands of kilometres away can potentially disrupt communications, disable public services, steal credentials or compromise systems during voting.
The Russia-Ukraine conflict is demonstrating how rapidly those capabilities are becoming integrated into conventional warfare.
Does This Affect New Zealand?
Yes, because New Zealand is also becoming progressively more dependent on interconnected government and identity infrastructure.
The immediate lesson is not that New Zealand faces the same threat environment as Russia. It does not.
The lesson is that cyber capability has become an instrument of state power.
New Zealand therefore has an interest in maintaining clear distinctions between defensive cyber assistance, intelligence cooperation and offensive operations conducted against another state's civilian or electoral infrastructure.
The same principle applies domestically.
As government services become increasingly digital, resilience requires more than cybersecurity software. It requires redundant systems, independent auditing, clear chains of responsibility and the ability to continue essential democratic and government functions when digital infrastructure fails.
Russia's experience also demonstrates another problem: attribution.
A cyberattack may be obvious while responsibility for it remains contested. Governments can claim attacks were conducted by foreign states, intelligence agencies, proxies, activist hackers or allied specialists, while outsiders may have little ability to independently determine who actually pressed the button.
That makes evidence particularly important.
Ukraine's previous attack on Russian election infrastructure is supported by Ukrainian claims of responsibility and Russian acknowledgement of disruption.
The allegation that Western specialists are directly conducting or preparing election attacks is much more serious, but currently rests largely on Russian intelligence claims and the interpretation presented by UkrLeaks.
Until stronger evidence emerges, those two propositions should not be treated as equivalent.
For New Zealand, that distinction is precisely the point. In an era when cyber operations can cross borders almost instantaneously, governments and media need to distinguish demonstrated operations from intelligence allegations before either becomes accepted as established fact.
Independent reporting. Original context. Credited sources.
Sources