Ukraine and its allies, including Estonia and Canada, Denmark, France, Germany, the Netherlands, Poland, Sweden, the UK and the US, announced the launch of a new system called the Tallinn Mechanism designed to amplify the cyber support of donors to Ukraine in the civilian domain.

“Unfortunately, it is likely that Russia’s cyberattacks will continue for the foreseeable future. This is why with the Mechanism we are offering a chance to reinforce Ukraine’s systematic preparedness and resilience to cyberattacks in the long term,” reads the statement on the Estonian Ministry of Foreign Affairs’ website.

The Tallinn Mechanism was named after the Estonian capital, where the plan was formulated in May 2023.

With the mechanism, Ukraine's needs will be responded to in a systemized manner and matched to the possibilities of donors in such a way that support from various countries forms a coherent whole and Ukraine is able to defend itself in the cyber sphere.

“[The mechanism] aims to coordinate and facilitate civilian cyber capacity building to help Ukraine uphold its fundamental right to self-defence in cyber space, and address longer-term cyber resilience needs,” the UK authorities said.

The mechanism has an Estonian front office in Kyiv, a Polish back office in Warsaw and a coordination group that unites representatives of Ukraine and all donors.

The announcement comes a week after Ukraine’s largest mobile operator Kyivstar was hit with a cyberattack described as “the biggest cyberattack on telco infrastructure in the world” that led to internet and network outages and caused issues with air raid alerts.

Two hacker groups claimed responsibility for the hack - Killmilk and Solntsepyok (in the English language it can be roughly translated as ‘sun-scorch’). Solntsepyok is believed to be a front for a well-known Russian hacking group dubbed “Sandworm” associated with Russia’s GRU military intelligence agency, which has been relentlessly targeting Ukraine, including its energy sector, since the beginning of the Russian invasion with multiple data-wiping malware.