APT Groups Target Critical Infrastructure in Western Europe Amid Rising Cyber Threats

Executive Summary

In early 2026, Advanced Persistent Threat (APT) groups have escalated cyberattacks targeting critical infrastructure across Western Europe. These operations have primarily focused on sectors such as energy, water utilities, and transportation, leveraging sophisticated tactics to exploit vulnerabilities in Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems.

Key Developments

• Energy Sector Attacks: In December 2025, the Electrum group, associated with Russian state-sponsored activities, launched a coordinated cyberattack against Poland's energy infrastructure. The assault targeted approximately 30 wind farms, solar installations, and a combined heat and power plant, exploiting internet-facing Fortinet devices with default credentials and lacking multi-factor authentication. The attackers deployed wiper malware, resulting in data destruction on Human-Machine Interfaces (HMIs) and firmware corruption on Operational Technology (OT) devices, thereby disrupting operational visibility and control. (csoonline.com)

• Water Utility Breach: In 2024, Denmark's Defence Intelligence Service attributed a destructive cyberattack on a water utility to the pro-Russian group Z-Pentest. This incident was part of a broader hybrid campaign targeting Western critical infrastructure, aiming to create insecurity and penalize nations supporting Ukraine. (securityaffairs.com)

• Transportation Network Disruptions: On October 8, 2022, a significant disruption occurred in Germany's railway communication system due to the severing of two fiber-optic cables near Herne and Berlin-Karow. This sabotage led to a three-hour halt of rail services in regions including Lower Saxony, Bremen, Hamburg, and Schleswig-Holstein, affecting thousands of travelers. (en.wikipedia.org)

Threat Actor Profiles

• Electrum: This group has been linked to Russian state-sponsored activities and is known for targeting critical infrastructure. Their recent operations have demonstrated a shift towards more destructive tactics, including the deployment of wiper malware to disrupt OT systems. (csoonline.com)

• Z-Pentest: Attributed to pro-Russian elements, Z-Pentest has been involved in cyberattacks against critical infrastructure, aiming to destabilize nations supporting Ukraine. (securityaffairs.com)

Implications for Critical Infrastructure

The increasing sophistication and frequency of APT attacks on critical infrastructure in Western Europe underscore the necessity for enhanced cybersecurity measures. Organizations must prioritize the protection of ICS and SCADA systems, implement robust access controls, and ensure regular security audits to identify and mitigate vulnerabilities. Collaboration between public and private sectors is essential to develop comprehensive defense strategies against these evolving cyber threats.

Recommendations

1. Strengthen ICS/SCADA Security: Conduct thorough assessments of ICS and SCADA systems to identify and address security weaknesses.

2. Implement Access Controls: Enforce strict access controls, including multi-factor authentication, to prevent unauthorized access to critical systems.

3. Regular Security Audits: Schedule periodic security audits to detect and remediate vulnerabilities proactively.

4. Enhance Incident Response Plans: Develop and regularly update incident response plans to ensure swift and effective reactions to cyber incidents.

5. Foster Public-Private Collaboration: Engage in information sharing and joint exercises between government agencies and private sector entities to bolster collective defense capabilities.

By adopting these measures, organizations can better safeguard critical infrastructure against the evolving threat landscape posed by APT groups.

Highlights:

• Hacktivist group responsible for cyberattacks on critical infrastructure in Europe taken down | Eurojust | European Union Agency for Criminal Justice Cooperation, Published on Tuesday, July 15
• Czech Government Condemns Chinese Hack on Critical Infrastructure - SecurityWeek, Published on Tuesday, May 27
• EU and NATO condemn 'malicious' Russian cyber attacks against Germany and Czechia | Euronews, Published on Thursday, May 02