The Threat Landscape for Defence Technology
Defence technology companies occupy an unusual position in the threat landscape: they are high-value intelligence targets for nation-state actors, they handle intellectual property with direct military and economic significance, and they typically operate with the security posture of a commercial technology company rather than a defence establishment. That gap — between the threat level they face and the security maturity they have — is precisely what makes them attractive to adversaries.
The primary threat to Ukrainian and NATO-adjacent defence contractors is persistent, well-resourced, and deeply experienced. Gamaredon, operated by the FSB's Centre 18 in Crimea, has run continuous campaigns against Ukrainian defence entities since at least 2014. Its tradecraft has matured significantly: where early-stage Gamaredon operations relied on commodity remote access tools and obvious command-and-control infrastructure, current campaigns use custom loaders with anti-analysis capabilities, rotate infrastructure on timelines designed to outpace threat-intelligence update cycles, and rely heavily on living-off-the-land binaries — legitimate Windows tools repurposed as attack components — specifically to blend into normal activity and evade EDR detection.
APT28 (GRU Unit 26165) brings a different operational profile. Its campaigns against defence tech are typically more targeted and more patient: long-duration credential-harvesting operations using spear-phishing lures crafted with detailed knowledge of the target organisation's internal vocabulary, projects, and personnel. The goal is usually specific intelligence acquisition — technical specifications, procurement data, personnel information — rather than broad access. APT28 is also responsible for some of the most sophisticated credential-theft infrastructure observed in the region, including custom Responder variants and adversary-in-the-middle frameworks designed to capture hashes from development and engineering workstations.
Sandworm (GRU Unit 74455) represents the highest-severity end of the threat spectrum for defence tech. Known primarily for destructive operations — Industroyer, NotPetya, the 2022 Industroyer2 attack on Ukrainian power infrastructure — Sandworm targets defence contractors not only for intelligence collection but for operational disruption: destroying development environments, wiping engineering workstations, and sabotaging production systems at moments calculated to degrade defence capability when it is most needed. Their tooling includes multiple custom implants with destructive payloads that can be triggered remotely after a pre-positioning phase lasting months.
Supply chain compromise is the entry vector that cuts across all three actor profiles. Defence contractors typically work with dozens of software vendors, hardware suppliers, and managed-service providers. Each represents a potential trusted conduit into the target organisation. AmonSul's incident response data shows that in over 60% of confirmed nation-state intrusions at defence-sector clients, the initial access was via a trusted third party — a compromised update server, a trojanised firmware package, or lateral movement from a managed-service provider that had already been breached.
Regulatory and Compliance Context
Defence technology companies operating in Ukraine or supplying Ukrainian defence programmes face a layered regulatory environment that has evolved rapidly since 2022.
The National Cyber Coordination Centre (NCCC), established under the National Security and Defence Council, mandates incident reporting for organisations classified as critical infrastructure or defence-critical. The reporting timeline is tight — initial notification within four hours of confirmed incident detection, full report within 72 hours — and the documentation standard requires forensic-grade chain-of-custody evidence. Organisations that miss reporting windows or file inadequate reports face significant penalties and, more practically, exclusion from future defence procurement processes.
Brave1, Ukraine's defence-tech cluster, applies cybersecurity requirements aligned with these NCCC standards for participating companies and their supply chains. Brave1 requirements are broadly consistent with NATO's Cybersecurity Maturity Model Certification (CMMC) framework: they mandate asset inventory, access control, continuous monitoring, incident response planning, and regular penetration testing. Companies seeking Brave1 accreditation or wishing to supply into Brave1-registered programmes must demonstrate these controls are operational, not merely documented.
For defence contractors with EU clients or operations, the NIS2 Directive (effective October 2024) adds another compliance layer. NIS2 expands the scope of covered entities to include many mid-market technology companies that were outside the original NIS Directive's scope, mandates 24-hour initial incident reporting to national authorities, and introduces personal liability for senior management in the event of a significant incident where due-care obligations were not met. The interaction between NCCC obligations and NIS2 reporting requirements creates a dual-track compliance challenge for companies operating in both jurisdictions — one that requires a security programme designed to produce the documentation both frameworks require in the timescales both frameworks mandate.
Export control is a frequently underestimated compliance dimension. Many defence technology companies hold or handle information subject to ITAR (US International Traffic in Arms Regulations) or the EU's Dual-Use Regulation. A successful cyber intrusion that results in exfiltration of ITAR-controlled technical data is not merely a security incident — it is a potential export control violation with criminal penalties. Demonstrating that reasonable cybersecurity controls were in place, and that the organisation detected and contained the breach promptly, is central to any post-incident regulatory defence.
Why AmonSul for Defence Technology
AmonSul's specific advantage in the defence-tech vertical is not methodological — it is intelligence. Understanding that a penetration test should cover Active Directory, web applications, and physical access vectors is table stakes for any competent security provider. What distinguishes an AmonSul engagement is that the test is designed around the actual techniques, tools, and objectives of the specific actors that target your sector, using a playbook informed by VATRA's live actor database and AmonSul's own incident response casework with defence-tech clients.
When AmonSul's SOC receives a detection alert from a defence-contractor client, the analyst investigating it has immediate access to VATRA's current infrastructure database, active campaign indicators, and TTP library for every major actor in the Eastern European threat domain. An unusual PowerShell execution that might be dismissed as a developer workflow anomaly by a generic MDR provider is evaluated against the current Gamaredon C2 signature set and APT28's known lateral movement patterns before a determination is made. This is the operational difference between broad-coverage security monitoring and security monitoring designed for the specific threat environment you operate in.
The fourth year of the conflict has also produced hard operational knowledge that cannot be replicated from secondary analysis. AmonSul analysts have responded to intrusions by Sandworm, Gamaredon, and APT28 in live environments — some while under active attack — and have developed containment techniques, persistence-hunting methodologies, and malware-analysis workflows specifically adapted to the tooling these actors deploy today. That operational heritage is embedded in AmonSul's detection engineering, IR playbooks, and client advisory work.
Finally: AmonSul is based in Kyiv, operates under Ukrainian law, and works directly within the Ukrainian regulatory and security environment. For defence contractors navigating Ukrainian government cybersecurity requirements, engaging a provider that understands not just the technical but the institutional and legal context — from the inside — is a material operational advantage.