Originally published 2022-01-26.
In late January 2022, a Belarusian hacktivist group called the Cyber Partisans said it had broken into the computer systems of Belarusian Railways and encrypted key internal databases. Its stated goal was to slow the movement of Russian troops and equipment then massing in Belarus near the Ukrainian border, and to pressure the government of Alexander Lukashenko into freeing political prisoners. The railway itself blamed delays on unspecified “technical reasons” and never publicly confirmed a cyberattack.
A month later Russia invaded Ukraine, partly from Belarusian territory. Looking back, the railway hack became one of the best-known examples of a small civilian group trying to interfere with a military build-up through computers.
Who the Cyber Partisans are
The group formed in September 2020, in the weeks after Belarus’s disputed presidential election and the mass street protests that followed. Lukashenko claimed a landslide victory; opposition candidates, independent observers and many Western governments rejected the result. Security forces arrested tens of thousands of people over the following months.
The Cyber Partisans describe themselves as Belarusian IT professionals, mostly living abroad, who stay anonymous even to one another. By their own account the core team was small: around 15 people in mid-2021 and roughly 30 by early 2022. Their first actions were symbolic, such as hijacking state media sites to show footage of police violence and putting the opposition’s white-red-white flag on government web pages.
Their operations grew more serious in 2021, when the group said it had taken large databases from the interior ministry, including recordings of phone calls and lists of informants. Some of that data was shared with journalists.
What happened to the railway systems
According to the group, its members had been inside the railway network since late 2021. In January 2022 they encrypted servers and databases used to manage freight and ticketing, using a modified form of ransomware, the kind of malicious software criminals normally use to lock a victim’s files and demand payment.
Here the aim was political, not financial. The Cyber Partisans said they would supply the key to unlock the systems only if the authorities met their conditions. They also said they had deliberately avoided anything that could endanger passengers or safety systems, and that they focused on freight logistics.
Independent confirmation was limited. The railway’s website and ticket services showed problems for a time, and travellers were told about delays, but officials did not describe the cause. Some outside security analysts reportedly found the claims plausible, while noting that the real effect on Russian troop movements was impossible to measure from outside.
The group’s demands
The Cyber Partisans set out two main conditions. First, the release of political prisoners, starting with about 50 people they said urgently needed medical care. Second, an end to the Russian military presence in Belarus.
A spokesperson explained the second demand to The Guardian in direct terms:
“We don’t want Russian soldiers in Belarus since it compromises the sovereignty of the country and puts it in danger of occupation.”
The group added that Belarusian soldiers could be dragged into a war with Ukraine that ordinary Belarusians did not want. More broadly, they made no secret of their wish to see Lukashenko removed from power, and they presented hacking as one of the few tools left to opponents inside a country where street protest had become extremely dangerous.
The prisoner numbers were not exaggerated. By early 2022 the Belarusian human rights centre Viasna counted around 1,000 people as political prisoners, most of them detained in connection with the 2020 election protests.
The wider context in January 2022
At the time of the hack, Russia and Belarus were preparing large joint military exercises on Belarusian soil, officially named “Allied Resolve.” Western intelligence services warned that the troops could be used to attack Ukraine from the north, the shortest route to Kyiv. Moscow repeatedly denied any plan to invade, and diplomats were still holding talks to calm the situation.
Those warnings proved accurate. On 24 February 2022, Russian forces crossed into Ukraine from several directions, including from Belarus towards Kyiv. Belarus did not send its own army into Ukraine, but it allowed its territory, roads, railways and airfields to be used.
After the invasion began, disruption of the Belarusian rail network continued in other forms. Ukrainian officials and Belarusian opposition figures reported that some Belarusian railway workers and activists physically sabotaged signalling equipment to slow Russian supply trains. Belarusian authorities responded with arrests and long prison sentences.
Hacktivism, ransomware and the limits of a cyber protest
The railway operation raised questions that go beyond Belarus. Ransomware attacks on infrastructure can have unpredictable side effects; a locked database can delay medicine, food or fuel as easily as tanks. The Cyber Partisans argued that their careful targeting reduced that risk, but outsiders had no way to check.
The episode also showed how blurred the line between activism and conflict has become. A group of volunteers with no state backing claimed to have affected the logistics of one of the world’s largest militaries, at least briefly. Whether it truly slowed anything, the attack drew global attention to Belarus’s political prisoners at a moment when the world was focused on Ukraine.
In later years the group claimed further operations, including a breach of Russia’s internet regulator Roskomnadzor in 2023 and attacks on Belarusian security service networks. As with the railway hack, many of these claims are difficult to verify independently.
Key points at a glance
- Who: the Cyber Partisans, an anonymous Belarusian opposition hacking group formed in 2020.
- What: a claimed ransomware-style encryption of Belarusian Railways systems in January 2022.
- Why: to hinder Russian troop movements and demand the release of political prisoners.
- Confirmed? Service disruption was visible; the government did not acknowledge a hack, and the military impact is unknown.
- What followed: Russia’s full-scale invasion of Ukraine on 24 February 2022, partly launched from Belarus.
Sources: The Guardian (January 2022); Futurism; Wikipedia: Cyber Partisans.
COMMENTS