Hegseth Orders Pentagon to Stop Offensive Cyberoperations Against Russia

U.S. Defense Secretary Pete Hegseth has directed Cyber Command to suspend offensive cyber operations against Russia, according to a current official and two former officials briefed on the classified directive. This decision appears to be part of a broader strategy aimed at drawing Russian President Vladimir V. Putin into negotiations over Ukraine and redefining relations between the two nations.

Hegseth’s directive, which is part of a comprehensive reassessment of U.S. actions targeting Russia, has not been publicly explained. However, it was issued prior to President Trump’s heated exchange with Ukrainian President Volodymyr Zelensky in the Oval Office last Friday.

The exact scope and duration of the Pentagon’s order remain unclear, as the distinction between offensive and defensive cyber operations is often ambiguous.

Nonetheless, maintaining access to key Russian networks for intelligence gathering is crucial to understanding Putin’s negotiating position, as well as monitoring internal Russian debates on which demands to uphold and which compromises may be considered.

Former officials noted that civilian leadership often pauses military operations during sensitive diplomatic talks to prevent disruptions. However, Trump and Hegseth’s decision to pull back from cyber offensives against Russia represents a significant risk.

The approach essentially relies on Putin responding in kind by easing Russia’s ongoing “shadow war” against the U.S. and its European allies. While major European nations insist their support for Ukraine remains steadfast, Trump—who has positioned himself as a neutral mediator in efforts to end the war—has, at times, openly aligned with Putin.

Despite U.S. efforts to shift tactics, officials report that Russia has continued attempts to infiltrate American networks, including in the early weeks of the Trump administration. However, cyber intrusions are only one aspect of a broader Russian campaign.

Over the past year, ransomware attacks originating from Russia have intensified, targeting U.S. hospitals, infrastructure, and municipalities. Intelligence officials believe these attacks are primarily criminal in nature but are either condoned or ignored by Russian intelligence agencies.

Meanwhile, acts of sabotage in Europe—such as suspected Russian attempts to sever communication cables, unexplained explosions, and targeted assassination plots—including one against the CEO of Germany’s largest arms manufacturer—have become more frequent. Previously, the U.S. played a pivotal role in assisting European allies in countering these threats, often through covert cyber operations. However, this level of cooperation may now be at risk.

Many of these cyber efforts have been led by Britain’s Government Communications Headquarters, the intelligence agency famous for breaking the Enigma code during World War II, as well as Canada. While these allies may continue their efforts, the U.S. is likely shifting its primary cyber focus to China, which is considered its most advanced adversary in cyberspace.

Russia also conducted an aggressive disinformation campaign in the last U.S. presidential election, as documented by intelligence reports during the Biden administration. In response, U.S. Cyber Command has discreetly worked to disrupt or counteract Russian influence operations in more recent election cycles.

However, the Trump administration has already started dismantling initiatives by the FBI and other agencies that aimed to alert the public to Russian propaganda. With the Pentagon’s latest directive, Cyber Command’s efforts to disrupt future Russian interference campaigns will also be put on hold—at least for now.

Speaking on Sunday, Secretary of State Marco Rubio emphasized the urgency of bringing Russia to the negotiating table over Ukraine but acknowledged uncertainty over whether Putin was ready to engage in meaningful discussions.

“You’re not going to bring them to the table if you’re calling them names or being antagonistic,” Rubio said on ABC’s “This Week.” “That’s just the president’s instincts from years of dealmaking in the business world.”

Rubio was not directly questioned about the decision to halt offensive cyber operations but became defensive when pressed on why the U.S. was easing pressure on Moscow—especially after the Trump administration removed language from a United Nations resolution that identified Russia as the aggressor in the Ukraine conflict. Nearly all of America’s traditional allies opposed the resolution, leaving the U.S. aligned with Russia, North Korea, Iran, Belarus, and other authoritarian states.

“If a Democrat were doing this, people would be saying he’s on his way to winning a Nobel Peace Prize,” Rubio argued. “This is absurd. We’re trying to end a war. You can’t end a war unless both sides come to the table—starting with Russia—and that’s exactly what the president is working toward. We have to do everything possible to get them there.”

The first report on Hegseth’s order appeared in The Record, a cybersecurity publication by Recorded Future that monitors cyber operations. The Pentagon and U.S. Cyber Command declined to comment on the record. However, a senior defense official—who requested anonymity—stated that Hegseth’s top priority remained the safety of U.S. military personnel, including those involved in cyber operations.

Following the release of this information, Senator Chuck Schumer, the Democratic minority leader from New York, issued a statement criticizing Trump’s decision, arguing that it effectively granted Putin a “free pass” while Russia continued to launch cyberattacks and ransomware operations against critical American infrastructure. Schumer called the administration’s move “a major strategic misstep.”

As the Trump administration prepared to take office, outgoing Biden officials had urged the incoming team to maintain strong pressure on Russia—including continuing military aid to Ukraine and countering cyber threats from Russia’s intelligence agencies, particularly the GRU and SVR, both of which have been responsible for some of the most aggressive cyberattacks and espionage campaigns.

Biden’s national security team had specifically briefed Trump officials on suspected Russian efforts to cut undersea communication cables and the prior U.S. warning to Putin regarding the consequences of an operation involving explosives on cargo planes—an effort American intelligence concluded was meant to deliver those devices to the U.S.

During Trump’s first term, U.S. cyber operations against Russia actually intensified. In response to Russian interference in the 2017 election, the National Security Agency established a specialized “Russia Small Group.”

Trump also expanded Cyber Command’s authority, granting it more freedom to conduct offensive operations without direct presidential approval through a classified directive known as National Security Presidential Memorandum 13.

One of the operations conducted under this expanded authority involved deeper penetration of Russia’s electrical grid—an effort first reported by The New York Times. It was likely intended as a warning against Russian interference in U.S. infrastructure. Trump later denounced the reporting as “a virtual act of treason,” though former aides suggested he was more concerned about its impact on his relationship with Putin.