Editing Russia out of the U.S. cyber playbook
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Shoshana Gordon/Axios
Under Trump 2.0, everything the cybersecurity industry knew about D.C. is up for debate — even who is considered an adversarial nation.
Why it matters: For decades, U.S. presidents of both parties have viewed China, Russia, Iran and North Korea as the biggest cyber threats. But that list is now in question.
The big picture: President Trump's push to reset diplomatic ties with Russia is likely to upend long-standing cybersecurity norms, with consequences that could play out for years.
Driving the news: The U.S. Cyber Command was recently ordered to pause planning offensive cyber operations against Russia, multiple outlets reported over the weekend.
- A senior DoD official declined to confirm the order but told Axios, "There is no greater priority to Secretary Hegseth than the safety of the Warfighter in all operations, including the cyber domain."
- Meanwhile, Trump is reportedly drafting a plan to ease sanctions on Russia and has sent back Russian cybercriminals in prisoner swaps.
- The administration has also reportedly reassigned dozens of FBI officials investigating foreign election interference — which Russia has repeatedly been accused of.
- The Kremlin has celebrated these actions, saying yesterday that the new American foreign policy "largely coincides" with its own.
Yes, but: The Cybersecurity and Infrastructure Security Agency said Sunday it is still prioritizing cyber threats from Russia, despite news reports suggesting otherwise.
- "There has been no change in our posture," the agency wrote on X. "Any reporting to the contrary is fake and undermines our national security."
Between the lines: Russia has long been a top cyber threat, hosting ransomware gangs, crypto money launderers, disinformation operations, and elite government hackers.
- Cyber Command has been a key tool in disrupting Russian cyber operations, from botnet takedowns to supporting Ukraine against Russian cyberattacks.
Threat level: A pause in offensive operations — even briefly — could take months to recover from, Jake Williams, a former NSA hacker and faculty member at IANS Research, told Axios.
- Planning a cyber offense requires months of lurking and learning about a target's networks to understand their weak points.
- Russian cyber operatives could decide to completely re-wire their networks while Cyber Command has its pause in effect — and cyber adversaries from other countries could obfuscate their own activities by disguising them through known Russian tactics.
- The downtime in activity could out any United States hackers who Russia was already suspicious of and monitoring closely, Williams added.
Zoom in: The order applies only to Cyber Command, not to the National Security Agency's intelligence collection, according to the reports.
- Also, separating intelligence-gathering from operations planning is near impossible in the cyber realm. Analysts often need to collect tips and open-source information before they can confidently link particular hackers to specific countries.
- "I'm not sure how to split those hairs," Williams said. "Every intelligence asset is a potential jumping off point for an offensive cyber operation."
What we're watching: Trump has made it clear that, among the four major cyber adversaries, China is his top priority.
- Many of his administration's new cyber officials are pushing for more aggressive operations against China.
- But Russian hackers were responsible for some of the cyberattacks in recent years that were most disruptive to civilian life.
