Critical Cyber Espionage Threats in Eastern Europe: APT Operations and SIGINT Intrusions

Executive Summary

In early 2026, Eastern Europe has witnessed a significant escalation in cyber espionage activities. Advanced Persistent Threat (APT) groups have been observed deploying long-term implants, compromising supply chains for intelligence collection, and conducting SIGINT-linked intrusions targeting diplomatic communications. These operations underscore a critical threat landscape, necessitating heightened vigilance and robust countermeasures.

Long-Term Espionage Implants

APT groups, notably Russia-aligned entities such as Sandworm (also known as APT44, Seashell Blizzard, BlackEnergy, PHANTOM, Blue Echidna), have been actively deploying data-wiping malware against Ukrainian entities in sectors including government, energy, logistics, and grain. Between April and September 2025, Sandworm utilized the Group Policy feature of Active Directory to execute wipers like ZEROLOT and Sting, demonstrating a persistent focus on destabilizing critical infrastructure. (ics-cert.kaspersky.com)

Supply Chain Compromise for Intelligence Collection

Supply chain attacks have emerged as a significant vector for intelligence gathering. In September 2025, the RomCom threat actor (also known as Void Rabisu, Storm-0978, Tropical Scorpius, or UNC2596) targeted a U.S. engineering company via the SocGholish malware delivery framework. This attack exploited compromised websites to deliver FAKEUPDATE payloads, facilitating remote access and data exfiltration. The operation highlights the strategic use of supply chain vulnerabilities to infiltrate high-value targets. (ics-cert.kaspersky.com)

SIGINT-Linked Intrusions and Diplomatic Targeting

SIGINT operations have been a focal point for cyber espionage activities. In February 2026, reports emerged of Russian spacecraft, specifically Luch-1 and Luch-2, conducting close-proximity maneuvers near European satellites. These activities suggest efforts to intercept unencrypted command links, potentially enabling future electronic warfare and jamming operations. (cert.europa.eu)

Additionally, a covert Russian wiretapping network was exposed in Vienna, involving satellite dishes installed above diplomatic buildings. This infrastructure is suspected to be part of a SIGINT collection platform targeting NATO and EU communications, underscoring the strategic importance of Vienna in Russian intelligence operations. (indeksonline.net)

Conclusion

The cyber espionage landscape in Eastern Europe is increasingly complex and aggressive. APT groups are leveraging sophisticated techniques to maintain long-term access, compromise supply chains, and conduct SIGINT operations against diplomatic targets. These developments pose a critical threat to regional security and international relations, necessitating enhanced cybersecurity measures and international cooperation to mitigate potential impacts.

Highlights:

• CERT-EU - Cyber Brief 26-03 - February 2026, Published on Sunday, March 01
• Winter Vivern (TAG-70 / UAC-0114 / TA473): A Persistent Eastern European Cyber-Espionage Threat Targeting NATO And EU Governments - Brandefense, Published on Thursday, February 19
• Secret Russian wiretapping network exposed in Vienna, Published on Monday, March 16