Ukraine VPNs are probably still up - in which case, another way you could serve is by doing analysis and writing documentation on Russia's cyberattack methods, where they come from, patterns in their design, but most importantly, how they may best be prevented or reduced in their effectiveness.
Documenting the behavior and collecting intelligence is a difficult skill and intensely valuable even if it is not direct retaliation.
I have a limited understanding of large scale networking. Can you explain how using a vpn to an endpoint in the Ukraine allows someone to observe behaviour?
I imagine if you are on an isp or IX backbone you could observe flows of packets. But how do you do that from a vpn?
Or should they break in to target systems first, shore up the defences, and then document who else tries to break in?
Documenting the behavior and collecting intelligence is a difficult skill and intensely valuable even if it is not direct retaliation.