Cybercriminals Intensify Attacks on Eastern Europe's Critical Infrastructure

Executive Summary

In early 2026, Eastern Europe has witnessed a surge in cybercriminal activities targeting critical infrastructure sectors, including power grids, water systems, and industrial control systems (ICS). These attacks have led to significant disruptions, highlighting the pressing need for enhanced cybersecurity measures across the region.

Recent Incidents

• Poland's Power Grid Attack (December 2025): Between December 29 and 30, 2025, Poland's energy sector faced a coordinated cyberattack targeting combined heat and power plants and renewable energy systems. The attackers aimed to disrupt operational control systems, potentially affecting energy distribution and grid stability during winter. Polish cybersecurity teams successfully repelled the attacks, preventing blackouts and significant service interruptions. (icsstrive.com)

• Romania's Water Management Authority Breach (January 2026): In January 2026, Romania's water management authority experienced a ransomware attack that took approximately 1,000 computers offline across 10 regional offices. The attack utilized Microsoft's BitLocker encryption tool, disrupting critical management systems, including email, databases, and GIS tools. Despite the digital disruption, water services remained unaffected, with normal operations maintained through alternative communication methods. (tomshardware.com)

Attribution and Threat Actors

The cyberattacks have been attributed to various cybercriminal groups:

• NoName057(16): A pro-Russian cybercrime group known for conducting distributed denial-of-service (DDoS) attacks across Europe. Europol, in collaboration with law enforcement agencies from 12 countries, disrupted this group through Operation Eastwood, resulting in arrests and the dismantling of their infrastructure. (techradar.com)

• Z-Pentest and Dark Engine: Hacktivist groups that have intensified attacks on industrial control systems, targeting sectors such as energy, water, and manufacturing. These groups exploit vulnerabilities in ICS/SCADA systems, often using brute-force password spraying tools to gain unauthorized access. (ics-cert.kaspersky.com)

Technical Analysis

The attacks have exploited several vulnerabilities:

• Weak Authentication Mechanisms: The use of default passwords and the absence of multi-factor authentication (MFA) have been common entry points for attackers. For instance, the Polish power grid attack involved exploiting poor security practices, including default credentials. (itpro.com)

• Lack of Network Segmentation: Inadequate segmentation between IT and operational technology (OT) networks has facilitated lateral movement within targeted systems.

• Insufficient Monitoring and Anomaly Detection: The absence of real-time monitoring and anomaly detection systems has delayed the identification and mitigation of attacks.

Recommendations

To mitigate the risks associated with cybercriminal activities targeting critical infrastructure, the following measures are recommended:

• Strengthen Authentication Protocols: Implement strong, unique passwords and enforce multi-factor authentication across all systems.

• Enhance Network Segmentation: Establish clear boundaries between IT and OT networks to limit the impact of potential breaches.

• Deploy Advanced Monitoring Tools: Utilize real-time monitoring and anomaly detection systems to identify and respond to threats promptly.

• Conduct Regular Security Audits: Perform periodic security assessments to identify and remediate vulnerabilities within critical infrastructure systems.

Conclusion

The escalation of cybercriminal attacks on Eastern Europe's critical infrastructure underscores the urgent need for robust cybersecurity measures. By addressing identified vulnerabilities and implementing recommended practices, organizations can enhance their resilience against future cyber threats.

Highlights:

• 1,000 computers taken offline in Romanian water management authority hack - ransomware takes Bitlocker-encrypted systems down, Published on Monday, December 22
• Europol says it disrupted a major pro-Russian DDoS crime gang, Published on Thursday, July 17
• CISA shares lessons learned from Polish power grid hack - and how to prevent disaster striking again, Published on Thursday, February 12