No single hand

Lithuania, and cyber power as a network rather than an actor

A small state on NATO’s eastern edge appears in the cyber story in one of two roles: as a victim, on the receiving end of Russian denial-of-service raids, or as a dutiful member ticking the alliance’s boxes. Lithuania has been both. In June 2022 pro-Russian hacktivists knocked its state networks offline in retaliation for its enforcement of the sanctions blockade to Kaliningrad. It runs a national cyber-security centre, a national response team, the usual furniture.

But the striking thing about Lithuanian cyber power is that there is no Lithuanian equivalent of Lazarus or Sandworm to name, and the absence is itself the signature. A small, exposed state with no strategic depth does not build an autonomous offensive apparatus. It does the opposite: it disperses its cyber capability across institutions and alliances, and pushes it outward. The unit of analysis is not an actor. It is a mesh.

Exposure without depth

The substrate is exposure without depth. Lithuania is small, borders Russian Kaliningrad and Belarus, and remembers occupation; it also picked a quarrel with China over Taiwan and paid for it in trade. A state in that position cannot hold a large independent capability and cannot afford to be caught short. What it can do is make itself useful to a much larger security system, and become, on the frontline, the part of that system that notices first.

The coupling: distribute, and push outward

So the coupling runs the other way from the offensive cases. Where a larger state concentrates capability, Lithuania distributes and exports it. It leads the EU’s cyber rapid-response teams, a multinational unit it has sent to help Ukraine and Moldova. It hosts a regional cyber-defence centre built with the United States, designed so that non-member partners such as Ukraine and Georgia can plug in. When its national centre took apart a batch of Chinese handsets in 2021 and found a Xiaomi device quietly able to censor phrases like “Free Tibet,” the government told people to get rid of their Chinese phones, and larger states cited the finding. A small state acts as the alliance’s canary because it is small enough to move fast and exposed enough to care. In 2025 it stood up a cyber command of its own, its mandate framed around fitting into NATO rather than operating alone.

Nobody to name

Look at who actually carries out a Lithuanian cyber action and the single actor dissolves. A national exercise team is assembled from the defence ministry, the cyber-security centre, the armed forces, the criminal police, energy and telecoms operators, the volunteer Riflemen’s Union and the universities, and fielded jointly with the Netherlands. The rapid-response team is European. The regional centre is bilateral with the United States and open to partners. There is no core to point at, because the capability is constituted as a network spanning national, military, EU, bilateral, commercial and volunteer bodies. The thing doing the work is a coalition, and calling it “Lithuania” is a convenience.

Lithuanian cyber power drawn as a mesh with no centre. Seven national nodes, the defence ministry, the cyber-security centre, cyber command, the criminal police, utilities, volunteer riflemen and universities, are joined to one another by thin grey links into a web with no hub. Two bold arrows leave the web toward the right, to Ukraine and Moldova and into the alliance, showing capability pushed outward to the frontline rather than hoarded behind it. There is no single actor to name; the acting entity is the network itself.

Where the tidy version breaks

Two honest limits. The first is that all of this is defensive and resilience-shaped; there is no sourceable Lithuanian offensive operation, and it would be dishonest to invent one to match the other chapters. The signature here is a posture, not an offensive capability, and the asymmetry is real. The second is that a small state leading an alliance project can be written up as a brochure, and the distinctiveness collapses the moment the mesh and the distribute-not-hoard inversion are dropped. What keeps the case substantive is precisely that the acting entity is not a state actor in the sense the other cases are.

What stays open

Whether the dispersal is a chosen strategy or simply the only shape available to a state too small to hoard is not something the record settles, and the two are hard to separate from outside. A larger exposed state might concentrate what Lithuania distributes. Exposure plus alliance-embedding appears to produce a distributed, outward-facing capability, but exposure and smallness arrive together here and cannot be pulled cleanly apart.

What survives is a single dispersal. The signature of this substrate is a network, not a group: cyber power constituted across institutions and alliances and pushed toward the frontline rather than hoarded behind it. And the same question follows for the others. If the thing doing the work here only looks like an actor once it is named, how much of Lazarus, or Sandworm, or the contractor market, was ever a single hand either, and how much was the convenience of naming, seen from the offensive side.