APT Groups Target Eastern European Critical Infrastructure

Overview

In recent years, Advanced Persistent Threat (APT) groups have intensified their operations against critical infrastructure in Eastern Europe. These state-sponsored actors employ sophisticated tactics to infiltrate and disrupt essential services, posing significant risks to national security and economic stability.

Targeted Sectors

• Energy Sector: APT groups have exploited vulnerabilities in industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices to gain unauthorized access to energy facilities. For instance, in April 2022, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) issued a joint advisory warning of APT actors developing custom tools to target ICS/SCADA devices, compromising operational technology (OT) networks. (techtarget.com)

• Water Systems: Hacktivist groups have increasingly targeted water and wastewater systems. In December 2025, CISA, the FBI, and the National Security Agency (NSA) highlighted attacks by Russian-speaking hacktivist groups exploiting minimally secured, internet-facing Virtual Network Computing (VNC) connections to infiltrate OT control devices within critical infrastructure systems. (ics-cert.kaspersky.com)

• Healthcare Sector: APT groups have targeted healthcare organizations to steal sensitive data and disrupt services. In Q2 2025, Kaspersky ICS CERT reported on attacks against industrial organizations, including healthcare, where APT groups exploited vulnerabilities to gain unauthorized access. (ics-cert.kaspersky.com)

• Financial Sector: APT groups have targeted financial institutions to steal sensitive data and disrupt services. In Q2 2025, Kaspersky ICS CERT reported on attacks against industrial organizations, including financial institutions, where APT groups exploited vulnerabilities to gain unauthorized access. (ics-cert.kaspersky.com)

Notable Threat Actors

• Curly COMrades: In August 2025, Bitdefender identified a new Russian-aligned APT group named Curly COMrades, targeting government bodies and energy sectors in Eastern Europe. This group deployed a custom backdoor malware called MucorAgent, utilizing previously unseen methods to maintain access to compromised systems. (techdigest.tv)

• APT31: In August 2023, Kaspersky attributed a series of attacks against industrial organizations in Eastern Europe to APT31, a Chinese state-sponsored group. The attacks involved sophisticated modular malware aimed at profiling removable drives and contaminating them with a worm to exfiltrate data from isolated, or air-gapped, networks. (thehackernews.com)

Tactics and Techniques

APT groups employ a range of sophisticated tactics to infiltrate critical infrastructure:

• Exploitation of Vulnerabilities: Targeting known vulnerabilities in ICS/SCADA devices and network appliances to gain unauthorized access. For example, in Q4 2025, Kaspersky ICS CERT observed APT groups exploiting misconfigurations in network-edge devices, such as enterprise routers and VPN gateways, to target energy companies and critical infrastructure providers. (ics-cert.kaspersky.com)

• Phishing Campaigns: Deploying spear-phishing emails to deliver malware or steal credentials. In Q2 2025, Kaspersky ICS CERT reported on APT groups using spear-phishing emails exploiting zero-day vulnerabilities to gain access to industrial organizations. (ics-cert.kaspersky.com)

• Exploitation of Misconfigurations: Leveraging misconfigured devices and systems to establish footholds within networks. In December 2025, CISA, the FBI, and the NSA highlighted attacks by Russian-speaking hacktivist groups exploiting minimally secured, internet-facing VNC connections to infiltrate OT control devices within critical infrastructure systems. (ics-cert.kaspersky.com)

Implications and Recommendations

The targeting of critical infrastructure by APT groups in Eastern Europe underscores the need for robust cybersecurity measures. Organizations should:

• Implement Defense-in-Depth Strategies: Employ multiple layers of security controls to protect critical systems.

• Regularly Update and Patch Systems: Ensure all devices and software are up-to-date to mitigate known vulnerabilities.

• Conduct Regular Security Audits: Identify and rectify misconfigurations and vulnerabilities within networks and devices.

• Enhance Incident Response Plans: Develop and regularly update incident response protocols to quickly address and mitigate cyber threats.

By adopting these measures, organizations can strengthen their defenses against APT groups targeting critical infrastructure in Eastern Europe.

Highlights:

• Hackers use new malware to breach air-gapped devices in Eastern Europe, Published on Monday, July 31