Critical Cyber Espionage Threats Targeting Eastern Europe in Early 2026

Executive Summary

In early 2026, Eastern Europe has witnessed a significant escalation in cyber espionage activities. State-sponsored threat actors have employed advanced malware and exploited zero-day vulnerabilities to infiltrate government and corporate networks, posing critical risks to national security and economic stability.

Key Threat Actors and Campaigns

• APT28 (Fancy Bear): This Russian state-sponsored group has been active since at least 2004. In February 2026, APT28 launched "Operation Neusploit," exploiting CVE-2026-21509 in malicious RTF files to target Ukraine, Slovakia, and Romania. The campaign delivered email-stealing and backdoor malware, enabling data theft and remote access. This activity underscores APT28's continued focus on Central and Eastern Europe and its rapid adoption of newly disclosed Microsoft Office vulnerabilities. (cert.europa.eu)

• Angry Likho: A mid-tier Advanced Persistent Threat (APT) group, Angry Likho has been identified as a persistent and strategically significant threat across Eastern Europe. The group employs adaptive and opportunistic cyber tactics, utilizing a modular malware ecosystem based on components from other cyber threat actors in the region. Angry Likho has consistently targeted government and military-focused organizations, engaging in espionage, credential theft, and covert information gathering. (brandefense.io)

Notable Malware and Exploits

• Coruna Exploit Kit: Disclosed in March 2026, Coruna is a sophisticated iOS exploit kit containing five complete exploit chains and 23 individual exploits targeting Apple iPhone models running iOS versions 13.0 through 17.2.1. The kit has been observed in at least three distinct campaigns:
  • An unnamed customer of a surveillance company.
  • Watering-hole attacks against Ukrainian targets attributed to UNC6353, a suspected Russian espionage group.
  • Broad-scale cryptocurrency theft operations by UNC6691, a financially motivated threat actor based in China. The proliferation of Coruna highlights the increasing sophistication and accessibility of nation-state-grade exploit frameworks. (en.wikipedia.org)

Implications and Recommendations

The intensification of cyber espionage in Eastern Europe necessitates a comprehensive and coordinated response:

• Enhanced Cyber Defense Measures: Organizations should implement robust cybersecurity protocols, including regular patching of vulnerabilities, network segmentation, and continuous monitoring for anomalous activities.

• Information Sharing and Collaboration: Establishing information-sharing agreements among governmental and private entities can facilitate timely dissemination of threat intelligence and coordinated defense strategies.

• Public Awareness and Training: Educating personnel on recognizing phishing attempts and other social engineering tactics is crucial in mitigating the risk of initial access vectors.

Conclusion

The cyber threat landscape in Eastern Europe is evolving rapidly, with state-sponsored actors deploying increasingly sophisticated tools and tactics. Proactive measures, including enhanced defense mechanisms, collaborative efforts, and continuous vigilance, are essential to mitigate the risks posed by these advanced cyber espionage campaigns.

Highlights:

• Russian military hackers revive advanced malware to spy on Ukraine, researchers say | The Record from Recorded Future News, Published on Monday, March 09
• Angry Likho: Inside A Rapidly Growing Espionage Threat Targeting Eastern Europe - Brandefense, Published on Tuesday, December 16
• Coruna (exploit kit)