In the digital shadows, Belarusian cyber partisans unnerve Lukashenka

Photo from the web portal of the Belarusian Cyber Partisans.

Much of today’s warfare unfolds in digital silence. Resistance nowadays often takes place in lines of code, through the exploitation of software vulnerabilities and the quiet extraction of sensitive information. When classified data is stolen, it can be passed to military commanders to inform real-world operations, including precision strikes. These actions can have significant impact – even shaping the course of a battle such as in Ukraine – yet the public may never know that they occurred. This shadowy form of warfare mirrors the work of the Belarusian “Cyber Partisans”, who have been waging a digital insurgency against the authoritarian regime of Alyaksandr Lukashenka.

The Belarusian Cyber Partisans emerged in 2020 in the wake of mass protests against President Alyaksandr Lukashenka’s widely disputed re-election. Formed by a group of anonymous tech specialists, the collective set out to expose government repression, disrupt state surveillance systems, and undermine the security apparatus propping up the regime, among other activities. Initially focused on leaking internal police documents and hacking government databases, their operations quickly evolved into one of the most sophisticated digital resistance efforts in Eastern Europe.

The Cyber Partisans have carried out several high-profile cyber-attacks aimed at undermining the Lukashenka regime and its support for Russia’s war in Ukraine. Notable operations include the 2022 hack of Belarusian Railways to disrupt Russian troop movements, a major data breach exposing KGB informants, and the sabotage of a Russian A-50 surveillance aircraft at Machulishchy air base.

Often their work overlaps with the Ukrainian resistance as well. Formed in March 2022, the Kastuś Kalinoŭski Regiment is a unit within Ukraine’s armed forces made up of Belarusian volunteers. For its members, the fight against Russia is not only about defending Ukraine – it is also a path toward the eventual liberation of Belarus. They view the collapse of the Putin regime as key to ending Lukashenka’s grip on power, framing their mission as the “liberation of Belarus through the liberation of Ukraine”. The Belarusian dictator deeply fears the Belarusian soldiers fighting in Ukraine and is doing everything he can to hunt them down and punish them.

Their digital counterpart, the IT Army of Ukraine, is also waging a cyber war against Russia. Ted, the spokesperson for the IT Army commented that “We’re actually pretty keen on the idea of linking up with the partisans down the line.” He added, “If there’s a chance our paths can converge – like them having a target ripe for a DDoS or if we can bulk up their ops with our DDoS muscle, and it meshes with our goals – we’re all ears.”

While the Belarusian Cyber Partisans and Ukraine’s IT Army share a common adversary in Russia, their missions and scope differ significantly. The Cyber Partisans operate as a digital resistance movement focused primarily on undermining the authoritarian regime of Lukashenka through targeted hacks and data leaks. In contrast, Ukraine’s IT Army is a broader coalition, comprising thousands of volunteers from around the world engaged in an all-out war against the Russian state. However, both sides in separate interviews indicated their willingness to work closely together if the right opportunity presented itself.

But why is the work of the Cyber Partisans so important? Because without continued resistance, Belarus risks being fully absorbed into the Russian state – its sovereignty erased, and its people gradually Russified.

The partisan perspective

Yuliana Shemetovets, spokesperson for the Belarusian Cyber Partisans, emphasized the secrecy surrounding their most impactful work. “Unfortunately, our most significant and successful hacks cannot be disclosed publicly,” she said. “For security reasons, we must protect our ongoing access to enemy networks.”

Among the few publicly acknowledged operations, one stands out for its scale and consequence. “One of the most notable was the leak of 40,000 appeals submitted through the Belarusian KGB’s website over the past nine years,” she said. “That exposure affected dozens of recruited foreign agents connected to the KGB.”

Another major breach targeted critical state infrastructure. “We disrupted Grodno Azot, Belarus’s largest state-run fertilizer manufacturer. We gained access to internal cameras, documents and emails – and even infiltrated heating systems that weren’t connected to the internet.”

Despite the high-profile nature of these attacks, the Cyber Partisans’ broader mission remains consistent. “Our focus in 2025 remains the same: weakening the systems of the Belarusian and Russian regimes, and assisting investigators worldwide by providing critical data that exposes their crimes.”

Shemetovets acknowledged that the Lukashenka regime has made some efforts to improve its cyber security, but fundamental weaknesses remain. “The Belarusian regime has improved slightly in cyber security, but they still lack the capacity to defend themselves effectively. They suffer from a shortage of skilled professionals and face difficulties acquiring and operating the necessary technology to secure their infrastructure.”

Recruiting talent has been a persistent challenge for the Cyber Partisans themselves. “We continue to receive interest from volunteers, but the challenge lies in finding individuals with the right expertise who are willing to commit to the often monotonous and high-risk work. Many do not stay long.” While the group is open to collaboration, Shemetovets said they typically operate alone. “We collaborate with various groups when possible, but we primarily operate independently.”

Their activities have not gone unnoticed. “We are one of the top organizations the regime is actively trying to counter and undermine – and we take that very seriously.” In December 2021, the Belarusian Supreme Court designated Supraciu – a network including the Cyber Partisans – as a terrorist movement after the group exposed questionable ties between an oligarch and the Lukashenka regime.

The Cyber Partisans leaked data revealing that the businessman Aliaksei Aleksin donated nine luxury vehicles, including two Maybachs, to the regime in 2018, shortly after gaining control of the country’s tobacco industry. The declaration of terrorism followed the report’s publication by OCCRP and reflects the regime’s growing attempts to criminalize digital dissent and suppress pro-democracy activism.

Looking ahead, Shemetovets stressed the importance of international strategy and support in the region. “The geopolitical landscape remains uncertain. Unless Europe stops relying solely on the US for security and develops a real strategy for the region, bringing change to Belarus and Russia will remain difficult. Regardless, we will continue our work.”

How effective is the group?

According to Pascal Geenens, Director of Threat Intelligence at Radware, the Belarusian Cyber Partisans have evolved into one of the most sophisticated and focused hacktivist collectives in Eastern Europe. Formed in 2020 to challenge the Lukashenka regime, the group expanded its operations following Russia’s invasion of Ukraine, turning their digital firepower against Russian military infrastructure and support networks.

Geenens pointed out that unlike the broad, volunteer-based IT Army of Ukraine, the Cyber Partisans are a tightly knit and anonymous group, reportedly consisting of around 30 members in 2022. “Only a handful perform the hacks, the others deal with analysis of data. The members are anonymous, even to each other, with the exception of their spokesperson, Yuliana Semetovets,” said Geenens.

He highlighted that their operations have included disrupting Belarusian Railways to impede Russian troop movements, exposing over 40,000 KGB informants, and launching tools like a Telegram bot to identify police officers from photos. As Geenens notes, their work highlights how digital resistance is now a vital component of modern warfare. “The contributions of allies like the Belarusian Cyber Partisans underscore the importance of unity and innovation in the face of shared adversities,” he said.

“The actions of the Belarusian Cyber Partisans highlight the multifaceted nature of modern resistance movements. Their cyber operations serve as a reminder that in today’s interconnected world, digital frontlines are as critical as physical ones.”

According to Vasileios Karagiannopoulos, an Associate Professor in cyber crime and security at the University of Portsmouth, the Belarusian Cyber Partisans represent a modern evolution of hacktivism – merging national resistance with international relevance. “They are a very interesting modern manifestation of hacktivism,” he said, noting that their strategic media presence, coordinated operations, and use of a named spokesperson help amplify their impact despite the clandestine nature of their membership.

He highlights that the group’s main conceptual achievement has been placing the political crisis in Belarus on the international agenda. Their high-profile hacks, including the exposure of Belarusian secret service informants and attacks on state infrastructure, have drawn global attention to their goal of regime change. “They’ve also aided Ukraine,” he added, “first by disrupting Russian troop logistics through railway hacks and later by breaching Russian drone developer Orlan to provide intelligence to Ukrainian services.”

Over time, their operations have expanded beyond Belarus’s borders. “The collaboration between Belarus and Russia has pushed the Cyber Partisans to consider targets outside the Belarusian cyberspace,” Karagiannopoulos explained. This internationalization of their mission has elevated their visibility and relevance in the global sphere of cyber resistance.

While he stops short of comparing them to decentralized groups like Anonymous, he sees them as a structured, nation-focused collective with strong ethical roots and evolving capabilities. “They show a model of organization and tactical development that will be an example for future groups,” he said. In an era where hacktivism is often disjointed, the Cyber Partisans offer “a combination of traditional principles and modernized tactical choices” that may define the next generation of digital resistance.

David Kirichenko is an Associate Research Fellow at the Henry Jackson Society, a London-based think tank. His work on warfare has been featured in the Atlantic Council, Center for European Policy Analysis, and The Economist, among many others. He can be found on X @DVKirichenko.

Please support New Eastern Europe's crowdfunding campaign. Donate by clicking on the button below.

belarus, Belarus protests, Belarusian emigration, cyber war, cyberoperations, online