Critical Infrastructure Under Siege: APT Attacks Escalate in Western Europe

Executive Summary

Advanced Persistent Threats (APTs) have intensified their operations against critical infrastructure in Western Europe, focusing on sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. Notably, Russian state-sponsored groups, including APT28 and APT31, have been implicated in these attacks, leveraging sophisticated malware and tactics to infiltrate and disrupt essential services.

Threat Actor Overview

• APT28 (Fancy Bear): A Russian cyber espionage group with close ties to the Kremlin, APT28 has a history of targeting governmental and critical infrastructure entities. In May 2024, the European Union and NATO condemned APT28 for cyberattacks against Germany and the Czech Republic, highlighting the group's persistent threat to European stability. (euronews.com)

• APT31 (Zirconium): Another Russian-linked group, APT31 has been active since at least 2012, focusing on cyber espionage against government and critical infrastructure targets. In May 2025, the Czech government publicly attributed a years-long intrusion into its foreign ministry's networks to APT31, underscoring the group's capabilities and intent. (securityweek.com)

Recent Incidents and Tactics

• Power Grids: In December 2015, the Ukrainian power grid was successfully attacked by the Russian APT group known as "Sandworm," resulting in power outages for approximately 230,000 consumers. This incident marked the first publicly acknowledged cyberattack on a power grid. (en.wikipedia.org)

• Industrial Control Systems (ICS): The malware framework Industroyer, also known as Crashoverride, was used in a cyberattack on Ukraine's power grid in December 2016. Industroyer is the first known malware specifically designed to attack electrical grids. (en.wikipedia.org)

• Healthcare Sector: In early 2025, Kaspersky ICS CERT reported that the biometrics sector was the most targeted operational technology sector, with malicious objects blocked on 28.1% of ICS computers. This indicates a growing interest in healthcare-related infrastructure by cyber adversaries. (me-en.kaspersky.com)

Emerging Threats and Malware

• Fuxnet: Attributed to the pro-Ukraine hacktivist group BlackJack, Fuxnet is designed to target industrial sensor networks, particularly those used in municipal gas, water, and sewage systems. The malware aims to disable sensors and destroy gateway devices, rendering them inoperable. (dragos.com)

• FrostyGoop: First identified in early 2024, FrostyGoop is a destructive malware designed to manipulate Modbus TCP/502 communications within ICS environments. It can alter or spoof normal industrial process commands, enabling it to evade antivirus software and cause physical damage to infrastructure. Its documented attack on the energy supply for district heating systems in Ukraine highlights its potential impact. (dragos.com)

Recommendations

• Enhanced Monitoring and Detection: Implement advanced intrusion detection systems capable of identifying sophisticated malware and anomalous activities within ICS networks.

• Regular Security Audits: Conduct comprehensive security assessments of critical infrastructure components to identify and mitigate vulnerabilities.

• Incident Response Planning: Develop and regularly update incident response plans to ensure rapid and effective responses to cyber incidents.

• International Collaboration: Engage in information sharing and collaborative defense initiatives with international partners to strengthen collective cybersecurity posture.

Conclusion

The escalation of APT activities targeting critical infrastructure in Western Europe necessitates a proactive and coordinated response. By understanding the tactics, techniques, and procedures of these threat actors, organizations can bolster their defenses and ensure the resilience of essential services against cyber threats.

Recent Cyberattacks on European Critical Infrastructure:

• Hacktivist group responsible for cyberattacks on critical infrastructure in Europe taken down | Eurojust | European Union Agency for Criminal Justice Cooperation, Published on Tuesday, July 15
• Czech Government Condemns Chinese Hack on Critical Infrastructure - SecurityWeek, Published on Tuesday, May 27
• EU and NATO condemn 'malicious' Russian cyber attacks against Germany and Czechia | Euronews, Published on Thursday, May 02