Critical Surge in Hacktivist Cyber Attacks Across Eastern Europe Amid Geopolitical Tensions

Executive Summary

Between February 28 and March 2, 2026, a coordinated surge in hacktivist cyber attacks targeted critical infrastructure and government entities across Eastern Europe. This escalation aligns with heightened geopolitical tensions in the region, particularly following recent military operations in the Middle East.

Incident Overview

During the specified period, over 150 hacktivist-claimed incidents were documented, primarily consisting of Distributed Denial of Service (DDoS) attacks, website defacements, and data exfiltration operations. These activities predominantly targeted government portals, financial institutions, and critical infrastructure sectors within Eastern European countries. Notably, the majority of these attacks were concentrated in Poland, Ukraine, and the Baltic states.

Attribution and Actor Analysis

The surge in cyber activities has been attributed to several hacktivist groups with varying geopolitical motivations:

• DieNet Network: A pro-Iranian hacktivist collective, DieNet Network has been linked to large-scale DDoS campaigns targeting government portals, telecom providers, airports, and financial institutions across Eastern Europe. (cloudsek.com)

• Handala Hack: Associated with Iran's Ministry of Intelligence and Security (MOIS), Handala Hack has claimed responsibility for cyberattacks on Israeli energy firms, Jordanian fuel systems, and healthcare targets. (unit42.paloaltonetworks.com)

• NoName057(16): A Russian-aligned hacktivist group, NoName057(16) has been active since 2022, targeting organizations across NATO member states and other European countries. (itpro.com)

Technical Details

The attacks employed a range of tactics, including:

• DDoS Attacks: Volumetric floods targeting government portals and financial exchanges, with peaks exceeding 1.2 Tbps in isolated cases. (objectwire.org)

• Website Defacements: Replacement of homepages with political messaging on regional airline, bank, and ministry sites. (objectwire.org)

• Data Exfiltration Claims: Public releases of alleged stolen documents from energy and telecom firms; authenticity remains unverified in most instances. (objectwire.org)

Impact Assessment

The cyber operations have contributed to psychological pressure on the targeted governments and temporarily disrupted critical services. However, the overall impact has been mitigated by robust cybersecurity measures and rapid response protocols. No confirmed intrusions into critical operational technology systems have been publicly disclosed as of March 2, 2026. (objectwire.org)

Recommendations

Organizations within Eastern Europe are advised to:

• Enhance Cyber Defenses: Implement advanced DDoS mitigation strategies and conduct regular security audits.

• Monitor Threat Actors: Stay informed about the activities of identified hacktivist groups and their evolving tactics.

• Collaborate Regionally: Engage in information sharing and joint defense initiatives with neighboring countries to strengthen collective cybersecurity posture.

By adopting these measures, organizations can better prepare for and mitigate the risks associated with hacktivist cyber activities in the current geopolitical climate.