Soesanto traces Cyber Corps ties to Ukraine GUR and the IT Army split

Stefan Soesanto of Lucerne University of Applied Sciences and Arts examined links among Ukraine's Cyber Corps, GUR, and the IT Army. GUR publicly acknowledged a Cyber Corps operation for the first time in August 2026.

Source

QiAnxin compiled an analysis by Stefan Soesanto, a lecturer in the Department of Computer Science and Information Technology at Lucerne University of Applied Sciences and Arts, on Ukraine's Cyber Corps (Kiberkorpus), the Main Directorate of Intelligence of Ukraine's Ministry of Defense (GUR), and the volunteer IT Army.

Appearance of Cyber Corps

In July 2024 a Telegram channel named Cyber Corps claimed it had been created by GUR officers. It claimed network operations that overlapped with GUR activity, posted evidence marked with GUR watermarks, and later overlapped with the IT Army on targets and people. GUR did not formally comment for a long period. In August 2026 GUR publicly acknowledged a Cyber Corps operation for the first time.

Soesanto wrote that several indirect indicators point to an organizational link. GUR has not confirmed that its officers created the group and has not systematically claimed all of the group's operations.

Claimed operations and GUR overlap

On 14 July 2024 Cyber Corps said it had accessed servers tied to then Russian deputy defense minister Timur Ivanov and the defense ministry electronic document system, and that it had used distributed denial-of-service (DDoS) traffic as cover. It posted documents and screenshots with a GUR watermark that GUR had used about six months earlier on its own site for a self-attributed operation against the defense ministry special communications bureau.

On 17 July 2024 it claimed a DDoS against servers used to install software and control DJI drones. That matched an 8 February 2024 GUR notice of a large failure in Russian DJI combat configuration software and an IT Army post the same day on DJI controller firmware-update servers. Screenshots pointed at COS Project and its SOLAR software. Cyber Corps added what appeared to be a COS Project customer database and a less-cropped copy of a global reachability test image from the GUR February notice.

On 18 July 2024 it claimed the February 2024 DDoS against the special communications bureau.

From September to November 2024 it claimed further DDoS operations that Ukrainian outlets attributed to GUR through unnamed intelligence sources, while GUR's website and Telegram channel did not acknowledge them:

• 4 September 2024: a 72-hour DDoS in early May against Tattelecom that disrupted internet in Tatarstan's Alabuga special economic zone. Suspilne had cited security sources on GUR action against Tatarstan ISPs and mobile operators.
• 23 September 2024: Moscow Credit Bank and Russian Agricultural Bank. The Kyiv Post cited a GUR source the same day. The next day Cyber Corps claimed Russia's Faster Payments System (SBP). Ukrainska Pravda cited GUR sources.
• 18 October 2024: satellite operator Morsvyazsputnik. Babel cited Ukrainian intelligence sources the same day.

Crimea 2025 and Wildberries 2026

On 26 July 2025 Cyber Corps described a multi-layer operation against government services and telecoms in occupied Crimea, including DDoS and access to Crimea health ministry systems, and posted screenshots, video, and a 1.3 GB archive. Four days later GUR said its specialists had entered servers of the so-called Crimea government and that files on forced removal of Ukrainian children had been sent to law enforcement. Spokesman Andriy Yusov was quoted on thousands of documents. After the GUR post, Cyber Corps claimed the operation, forwarded GUR's Telegram message, and reshared GUR's four screenshots. On 28 September 2025 it claimed further data on transferred minors, including a list said to cover moves from Donbas to Alushta kindergartens from 2022 to 2025.

On 15 August 2026 GUR reported that on 10 to 11 August 2026 members of the Cyber Corps community had attacked Wildberries digital infrastructure and that the operation amplified a Ukrainian Defense Forces strike on Wildberries warehouses. Cyber Corps then used the GUR statement in volunteer recruitment.

IT Army overlap and 2026 split

On 24 July 2024 Cyber Corps claimed DDoS against Alfa-Bank, VTB, Raiffeisen, Rossiya Bank, and Russian Agricultural Bank. Three days later the IT Army said it was joining a GUR bank campaign, naming Post Bank and Zenit. In September 2024 Cyber Corps claimed ISPs in Moscow and St. Petersburg: Smile, Rostelecom, CityLink, Lifelink, Gelicon, and Nevalink. On 10 September the IT Army said that with GUR it had taken those six providers offline for days. GUR's official channels did not mention those operations.

From spring 2026 an IT Army dispute over tool audits, target legality, and infrastructure security led several DDoS contributors and tool developers to move to Cyber Corps. IT Army DDoS volume then fell. On 26 June 2026 Cyber Corps launched a website describing itself as a volunteer group of engineers, analysts, and security researchers, and presented CyberOwl, a DDoS tool by OleksandrBlack, a long-time IT Army contributor who had identified himself in a 2023 BBC interview. CyberOwl was based on an older IT Army toolkit and included traffic tracking and a leaderboard.

By July the Cyber Corps top three DDoS contributors were John11, littlest_giant, and Badger&Beaver, all formerly among IT Army top contributors. On 24 May a former IT Army top-10 user renamed an account to urge leaving ITUA for the Cyber Corps Telegram. The IT Army later removed its public leaderboard.

Remaining records of a late-April 2026 crisis include an admin notice of a possible infrastructure compromise and a request to pause devices and servers. Developers sought a full audit. Access was first refused over user-data exposure and possible arrests in Ukraine. On 25 April an official admin account said the crisis began after a refusal to allow even minimal target audits, that the community had been paused, and that operations resumed after uninterrupted audit access. On 11 May OleksandrBlack released CyberOwl. The IT Army later released a community DDoS framework called BaseTool.

A 25 May IT Army admin post said unclear or possibly illegal targets prompted an audit demand, and that the group around OleksandrBlack took tools, halted work, and recruited volunteers while impersonating an intelligence service. The post asked why any Ukrainian intelligence service would want to shut down the IT Army, which was created under then Defense Minister Mykhailo Fedorov, and warned of possible criminal exposure in Europe if volunteers had hit unlawful targets.

A Cyber Corps GitHub file named Claude.md described the site as a static volunteer community site supporting GUR, hosted on GitHub Pages. The account hosted CyberOwl and the website source.

Soesanto's caveats

Soesanto noted that Cyber Corps was selective in which GUR operations it claimed and did not claim operations by BO Team, including a July 2025 disruptive operation against drone maker Gaskar that involved BO Team, the Ukrainian Cyber Alliance, and GUR. Ukrainian media sometimes misattributed BO Team work to Cyber Corps. He wrote that GUR's role and intent remain unsettled.