Eastern European Ransomware Groups Expand Cyber Espionage Operations in 2026

Executive Summary

In early 2026, Eastern European ransomware groups have significantly expanded their operations beyond traditional financial extortion, delving into cyber espionage activities. These groups are now targeting supply chains, conducting SIGINT-linked intrusions, and compromising diplomatic entities, thereby elevating the threat landscape in the region.

Operational Overview

Historically, ransomware groups like Royal (also known as BlackSuit) have focused primarily on financial extortion. Formed in 2022, Royal has targeted various industries, including healthcare, finance, and critical infrastructure, with ransom demands ranging from $1 million to $10 million in Bitcoin. (en.wikipedia.org)

However, recent intelligence indicates a strategic shift towards cyber espionage. Royal has been observed leveraging sophisticated malware frameworks, such as CommonMagic and CloudWizard, to infiltrate government, agricultural, and transportation sectors in Eastern Europe. These tools facilitate long-term implants, enabling persistent access to sensitive information. (ics-cert.kaspersky.com)

In addition to Royal, other Eastern European ransomware groups are adopting similar tactics. For instance, Clop (also known as Cl0p), a Russian-speaking group, has been implicated in high-profile attacks targeting critical infrastructure and sensitive data. Clop employs complex extortion techniques, including double extortion, where both data encryption and exfiltration are used to pressure victims. (en.wikipedia.org)

Supply Chain Compromise for Intelligence Collection

Supply chain attacks have become a prominent vector for cyber espionage. In 2024, the European Union sanctioned individuals associated with the 'Callisto group,' a Russian intelligence unit conducting cyber operations against EU member states through sustained phishing campaigns aimed at stealing sensitive data in critical state functions. (consilium.europa.eu)

Similarly, in 2025, the Chinese cyber-espionage group Silk Typhoon shifted its focus to supply chain attacks, targeting remote management tools and cloud services to access downstream customer networks. (acronis.com)

These incidents underscore the growing trend of ransomware groups exploiting supply chain vulnerabilities to gain access to high-value targets, facilitating long-term intelligence collection.

SIGINT-Linked Intrusions

The integration of SIGINT capabilities into ransomware operations has been observed, enhancing the intelligence-gathering potential of these groups. In 2025, a China-linked hacking group exploited a Windows zero-day vulnerability to spy on European diplomats in Hungary, Belgium, and other nations. The attack chain involved spear-phishing emails leading to the deployment of the PlugX remote access trojan (RAT), allowing the actors to monitor diplomatic communications and steal sensitive data. (bleepingcomputer.com)

While this incident was attributed to a state-backed actor, it highlights the potential for ransomware groups to incorporate SIGINT capabilities into their operations, thereby enhancing their espionage activities.

Diplomatic Targeting

Ransomware groups are increasingly targeting diplomatic entities to gain access to sensitive governmental communications. In January 2026, reports emerged that the China-linked Salt Typhoon group infiltrated UK telecom networks, compromising phones of senior Downing Street aides since 2021. This intrusion exposed sensitive communications and metadata involving figures around former prime ministers, with breaches discovered in 2024. (cert.europa.eu)

Although Salt Typhoon is a state-backed actor, the tactics employed are similar to those observed in ransomware groups, indicating a convergence of methods in cyber espionage activities.

Conclusion

The evolving tactics of Eastern European ransomware groups, including the adoption of cyber espionage techniques, pose a significant and escalating threat. Their focus on supply chain compromises, integration of SIGINT capabilities, and targeting of diplomatic entities necessitate enhanced cybersecurity measures and international cooperation to mitigate potential risks.

Highlights:

• APT and financial attacks on industrial organizations in H1 2023 | Kaspersky ICS CERT, Published on Sunday, September 24
• Windows zero-day actively exploited to spy on European diplomats, Published on Thursday, October 30
• CERT-EU - Cyber Brief 26-02 - January 2026, Published on Sunday, February 01