Emerging Ransomware Groups Targeting Western European Critical Infrastructure

Overview

In early 2026, Western Europe has witnessed a surge in ransomware attacks targeting critical infrastructure sectors, including energy, telecommunications, and transportation. These attacks are attributed to emerging ransomware groups that employ advanced tactics to infiltrate and disrupt operations.

Notable Ransomware Groups

• Mercenary Akula: This group has been observed deploying court-themed lures to target financial institutions across Europe. Their campaigns involve phishing and malware payloads designed to steal sensitive financial data. (malwarepatrol.net)

• LeakNet: LeakNet has expanded its capabilities by introducing new initial access and execution techniques, notably leveraging ClickFix lures delivered via compromised legitimate websites and a previously unreported Deno-based in-memory loader. This strategic shift allows the group to scale operations and broaden its victim pool through opportunistic delivery. (cds.thalesgroup.com)

Tactics and Techniques

These ransomware groups employ sophisticated methods to gain access to critical infrastructure systems:

• Phishing Campaigns: Utilizing social engineering tactics, such as court-themed lures, to deceive employees into executing malicious payloads.

• Exploitation of Vulnerabilities: Targeting known vulnerabilities in widely used software and hardware to gain unauthorized access.

• Supply Chain Attacks: Compromising legitimate websites to distribute malware, thereby increasing the reach and effectiveness of their attacks.

Impact on Critical Infrastructure

The attacks have led to significant disruptions in critical infrastructure sectors:

• Energy Sector: Operational disruptions affecting power generation and distribution, leading to service outages.

• Telecommunications: Service interruptions impacting communication networks and emergency response systems.

• Transportation: Disruptions in logistics and transportation management systems, affecting supply chains and public transit.

Recommendations

Organizations within critical infrastructure sectors should implement the following measures to mitigate the risk of ransomware attacks:

• Regular Software Updates: Ensure all systems are up-to-date with the latest security patches to close known vulnerabilities.

• Employee Training: Conduct regular training sessions to raise awareness about phishing tactics and safe handling of suspicious communications.

• Network Segmentation: Implement network segmentation to limit the spread of malware within organizational networks.

• Incident Response Planning: Develop and regularly update incident response plans to ensure a swift and coordinated response to potential attacks.

By adopting these proactive measures, organizations can enhance their resilience against the evolving threat landscape posed by sophisticated ransomware groups targeting critical infrastructure in Western Europe.

Highlights:

• Security Signals (2/24/26-3/10/26) - Malware Patrol - Intelligent Threat Data, Published on Thursday, March 12
• Weekly Summary Cyberattack – 12 to 18 march | Cyber Solutions By Thales, Published on Thursday, March 19