APT Groups Target Eastern European Critical Infrastructure Amid Rising Cyber Threats

Overview

In early 2026, Advanced Persistent Threat (APT) groups have intensified cyber operations against critical infrastructure in Eastern Europe. These attacks encompass sectors such as energy, water systems, healthcare, and financial services, highlighting a strategic shift towards disrupting essential services.

Targeted Sectors and Attack Vectors

• Energy Sector: APT groups have exploited vulnerabilities in Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems to gain unauthorized access. For instance, the exploitation of CVE-2021-26829 in ScadaBR, an open-source SCADA system, was added to CISA's Known Exploited Vulnerabilities catalog following a hacktivist attack on ICS environments. (radar.offseq.com)

• Water Systems: Cyber actors have targeted water and wastewater systems by exploiting misconfigured network devices. Hacktivist groups have used minimally secured, internet-facing VNC connections to infiltrate Operational Technology (OT) control devices within critical infrastructure systems, causing varying degrees of damage. (ics-cert.kaspersky.com)

• Healthcare Sector: APT groups have conducted spear-phishing campaigns targeting healthcare organizations, leading to the deployment of malware such as Cobalt Strike and custom backdoors. These attacks aim to steal sensitive data and disrupt healthcare services. (ics-cert.kaspersky.com)

• Financial Sector: APT groups have targeted financial institutions by exploiting vulnerabilities in network appliances and software supply chains. These attacks aim to exfiltrate sensitive financial data and disrupt services. (rhisac.org)

Notable Threat Actors

• APT28 (Fancy Bear): A Russian state-sponsored group known for targeting government entities and critical infrastructure. In February 2026, APT28 conducted Operation Neusploit, exploiting CVE-2026-21509 in malicious RTF files to target Ukraine, Slovakia, and Romania, delivering email-stealing and backdoor malware. (cert.europa.eu)

• SideWinder: An APT group that has recently shifted focus towards nuclear power facilities in South Asia, indicating a potential expansion of their targeting scope. (kaspersky.com)

Implications and Recommendations

The escalation of APT activities against critical infrastructure in Eastern Europe underscores the need for enhanced cybersecurity measures. Organizations should prioritize securing ICS/SCADA systems, implement robust network segmentation, and conduct regular vulnerability assessments. Additionally, fostering collaboration between public and private sectors is crucial to develop effective defense strategies against these evolving cyber threats.

The evolving cyber threat landscape necessitates continuous vigilance and proactive measures to safeguard critical infrastructure from APT activities.