Ukrainian hackers have reportedly breached Glaz/Groza, a Russian combat control platform linked to battlefield coordination, exposing internal materials and causing visible disruption inside the system.
The operational impact remains unclear. Claims about the breach, the material obtained, and any battlefield disruption have not been independently verified, but the episode has drawn attention because the platform is described as part of a software stack used to coordinate reconnaissance, targeting, and battlefield communications between military units.
The reported compromise also points to a more basic security concern: parts of the platform’s support and software distribution process were allegedly handled through Telegram groups used by administrators and military personnel.
Telegram support model comes under scrutiny
Glaz/Groza is described as a command-and-control application that helps connect drone operators, field commanders, and artillery units during military operations. The software is also said to be designed to reduce the time between identifying a potential target and directing fire against it, though that description has not been independently verified.
The hack reportedly exposed a Telegram-based support network connected to the system. Those channels were allegedly used to distribute application updates and help users resolve operational problems, a setup that would raise obvious security questions for software tied to sensitive battlefield activity.
Combat management platforms can involve highly sensitive information, including unit locations, mapping data, and operational status. In this case, the reported reliance on Telegram for administration has not been independently verified, but the allegation is notable because consumer messaging tools can become a weak point when they are used around military workflows.
Maps integrated into the platform reportedly allow users to record the locations of friendly and opposing forces, helping personnel maintain battlefield awareness. Following the breach, attackers allegedly altered portions of the mapping data and inserted images of the Ukrainian flag alongside other messages.
Users were also said to have experienced persistent problems accessing or restoring the application, including complaints that they could not connect and could not remove images that kept reappearing. Those disruption claims remain unverified, and there is no confirmed assessment of how widely the reported issues affected operations.
Internal documents were reportedly exposed
Beyond the visible interference, the attackers reportedly obtained a collection of internal materials connected to Glaz/Groza. The materials were said to include instructions, patents, videos, user documentation, and training resources, though the full scope and authenticity of the collection have not been independently confirmed.
The disclosed files allegedly included hundreds of pages of user guides explaining how the application works and how its functions are used. A training video was also reportedly part of the recovered material and was said to show the system operating in real time.
A patent connected to Groza was reportedly among the exposed files. That patent documentation is said to describe aspects of the platform’s architecture, intended users, and integration with related military systems, but those details should be treated cautiously without independent verification.
Even if the direct battlefield effect is uncertain, the reported breach highlights the risk created when sensitive software depends on informal support channels and widely used communication platforms. For systems tied to reconnaissance, targeting, and artillery coordination, administrative access, update distribution, and user support can become part of the attack surface.
For now, the known picture is limited: Ukrainian hackers say they breached a Russian combat control system, internal materials were allegedly exposed, and users reportedly saw disruption inside the platform. The extent of the compromise, the authenticity of all recovered files, and any operational consequences remain uncertain.