Full Report
Zelensky said that Ukrainian intelligence obtained documents revealing that Russian President Vladimir Putin issued a "new doctrine" allowing Russian forces to launch broader strikes against Ukrainian civilian targets this upcoming winter.
Analysis Summary
# Incident Report: Russian "New Doctrine" Targeting Civilian Infrastructure
## Executive Summary
Ukrainian intelligence has uncovered a strategic shift in Russian military policy, termed a "new doctrine," which explicitly authorizes broader strikes against civilian infrastructure, including schools, hospitals, and logistics, to force city evacuations this winter. In response, Ukraine has initiated a counter-offensive strategy targeting Russian energy infrastructure and oil refineries using domestically produced long-range ballistic missiles.
## Incident Details
- **Discovery Date:** October 3, 2026 (Public disclosure)
- **Incident Date:** Late September to Early October 2026 (Policy adoption and initial implementation)
- **Affected Organization:** Government of Ukraine / Civilian Population
- **Sector:** Critical Infrastructure (Energy, Transportation, Education, Healthcare)
- **Geography:** Ukraine (National scope)
## Timeline of Events
### Initial Access
- **Date/Time:** September 2026
- **Vector:** Intelligence Gathering / Espionage
- **Details:** Ukrainian intelligence services successfully obtained classified Russian documents revealing the "new doctrine" issued by Vladimir Putin.
### Lateral Movement
- **Details:** Russian forces began shifting operational focus from traditional frontline engagements to coordinated strikes against rear-area civilian hubs and logistics networks.
### Data Exfiltration/Impact
- **Details:** Destruction of key bridges in Kyiv; multiple fires across city centers; disruption of power supplies near the Zaporizhzhia Nuclear Plant; targeted strikes on medical and educational facilities.
### Detection & Response
- **Discovery:** Documents retrieved by Ukrainian intelligence; observed increase in drone and missile strikes on non-military targets.
- **Response Actions:** Deployment of the domestic FP-7 ballistic missile; accelerated development of the longer-range FP-9 missile; retaliatory strikes on Russian oil refineries.
## Attack Methodology
- **Initial Access:** Tactical intelligence operations (Ukrainian side) / Physical airstrikes (Russian side).
- **Persistence:** Sustained drone and missile barrages across multiple weeks.
- **Privilege Escalation:** Not applicable (Kinetic warfare context).
- **Defense Evasion:** Use of diverse strike platforms (drones, glide bombs, ballistic missiles) to saturate air defenses.
- **Credential Access:** N/A.
- **Discovery:** Russian reconnaissance drones identifying civilian infrastructure vulnerabilities.
- **Lateral Movement:** Shifting strike zones from the frontline (Lyman sector) to the capital (Kyiv).
- **Collection:** Russian intelligence identifying high-value civilian logistical hubs.
- **Exfiltration:** N/A.
- **Impact:** Intentional destruction of civilian life-support systems (heat, power, logistics) to induce mass displacement.
## Impact Assessment
- **Financial:** Billions in infrastructure damage; $5.6 billion in "voluntary" contributions from Russian billionaires to fund the Russian state budget.
- **Data Breach:** Exposure of Russian strategic military doctrine.
- **Operational:** Severe disruption of Ukrainian civilian logistics; damage to Kyiv bridges requiring pontoon crossings.
- **Reputational:** Increased international condemnation of Russia for targeting non-military objects.
## Indicators of Compromise
- **Physical:** Remains of FP-7 ballistic missiles at strike sites.
- **Behavioral:** Shift in strike patterns from military targets to schools, hospitals, and roads.
- **Network:** Increased drone activity near Zaporizhzhia Nuclear Plant.
## Response Actions
- **Containment:** Activation of mobile air defense units and emergency repair crews for bridges.
- **Eradication:** Counter-battery fire and drone strikes against Russian refinery "money sources."
- **Recovery:** Implementation of pontoon crossings to restore mobility in Kyiv; domestic missile production ramp-up.
## Lessons Learned
- **Key Takeaways:** Russia is leveraging winter as a tactical tool by weaponizing civilian hardship. Early intelligence acquisition was critical in preparing the public for upcoming strikes.
- **What could have been done better:** Enhanced protection for key bridges and energy nodes prior to the winter season shift.
## Recommendations
- **Prevention:** Rapid deployment of additional air defense systems around civilian "soft targets."
- **Resilience:** Decentralization of the energy grid to mitigate the impact of refinery and power plant strikes.
- **Offense:** Continued investment in the "Fire Point" domestic missile program (FP-9) to maintain a credible deterrent against infrastructure targeting.