Announcement of the creation of a trilateral cybersecurity coalition between Romania, the Republic of Moldova, and Ukraine, recently formalized in Chernivtsi, is a pragmatic and necessary step in an increasingly complex regional geopolitical context. Beyond the diplomatic rhetoric about "shared democratic values" and "increasing interoperability," the real stakes for Bucharest and Chisinau are enormous: the opportunity to learn, directly from the source, how to survive a total hybrid war.
In almost four years of war, Ukraine has not offered theories, but rather a manual of resilience written under bombardment, a lesson that Romania and Moldova must quickly understand, beyond mere declarations of intent.
The initiative, described by Romania's National Cyber Security Directorate (DNSC) as "timely and pragmatic," aims, in theory, to develop advanced capabilities. However, the value of the partnership lies not in future AI-based solutions, but in the experience Ukraine has already accumulated.
While we are debating strategies in Romania, Ukraine has thwarted a digital blitzkrieg, resisted coordinated missile attacks, and is now resisting a more subtle phase of Russian aggression, namely that carried out in the information space.
This is where the fundamental lessons that Romania and Moldova must urgently internalize take shape.
From blitzkrieg to war of attrition: Resilience in the face of an enemy that adapts
A recent report by Ukraine's State Service for Special Communications (SSSCIP) confirms a major change in Moscow's tactics. The initial phase of the 2022 invasion was marked by a failed digital "blitzkrieg": destructive attack operations (CNA) designed to paralyze critical infrastructure with "wiper" viruses (such as HermeticWiper or Industroyer2) and generate chaos through disinformation.
Now, the strategy has fundamentally changed. Although the total number of incidents has skyrocketed, from 2,194 in 2022 to 4,315 in 2024, the number of critical attacks has fallen from 1,048 to just 59. This does not mean that the threat has diminished. On the contrary, it has become more dangerous.
Russia has moved from "noisy attacks" to cyber espionage operations (CNE) – a methodical, long-term campaign focused on extracting information to support conventional military operations.
For Romania and Moldova, this means that the enemy is no longer just trying to break down the door, but to discreetly install themselves in the house. Attackers now predominantly target government and local authorities (58% of incidents in 2024) to gain a foothold for future campaigns. The lesson is no longer just about withstanding a shock, but about waging a digital war of attrition.
Therefore, the concept of "Hunt Forward," the proactive hunting of threats that are already present but latent in networks, becomes essential. In cyberspace, it is not enough to have walls; you must assume that the enemy is already inside and actively hunt them down.
The state cannot fight cyber attackers alone
Russian aggression is carried out by advanced persistent threat (APT) groups such as Sandworm (GRU) and Gamaredon (FSB), the latter being responsible for over 800 documented incidents. Combating such sophisticated entities exceeds the capabilities of many state agencies. Collaboration with the private sector, where niche expertise is often found, is vital.
The Baltic model, where private sector experts voluntarily join cyber units in the National Guard, is more relevant than ever. The coalition with Ukraine must become a hub for creating flexible mechanisms through which talent from the Romanian and Moldovan IT sectors can be mobilized in the event of a crisis and participate in joint exercises, testing their response speed to new tactics employed by Russian hackers.
The message for Bucharest and Chișinău is twofold. On the one hand, there is a need to develop sovereign capabilities. On the other hand, it is crucial to strengthen a network of trusted partners. The SSSCIP report recommends that international partners intensify the exchange of threat data. Effective defense is not an isolated act. When Ukraine shares information about the Sandworm group's tactics, it provides an early warning for the energy and telecommunications sectors across Europe.
In conclusion, the cyber coalition is a historic opportunity. The threat has not disappeared, but has entered a quieter and more methodical phase.
The success of this partnership will not consist of press releases, but rather in Romania and Moldova's ability to adopt the Ukrainian mindset: to understand that the enemy adapts, to proactively hunt them down in their own networks, and to build a defense based on public-private expertise and a solid network of allies. Otherwise, we risk remaining mere spectators in a digital war of attrition that is already being waged on our borders.
—
By , Cristian Soare, military analyst and expert Digital Forensic Team
