Escalating APT Attacks on Eastern European Critical Infrastructure

Executive Summary

Advanced Persistent Threat (APT) groups are increasingly targeting critical infrastructure in Eastern Europe, with a notable focus on power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks pose significant risks to national security and public safety.

Recent Incidents

• Poland's Power Grid Attack (December 2025): In late December 2025, the Polish power grid was targeted by a cyberattack attributed to the Russian APT group Sandworm. The attack involved the deployment of a new wiper malware, DynoWiper, which aimed to disrupt operations without causing immediate outages. While the attack did not result in power disruptions, it highlighted the persistent threat to critical energy infrastructure in the region. (securityweek.com)

• Ukraine's Power Grid Attacks (2015 and 2016): Ukraine has been a focal point for APT attacks targeting its power grid. In December 2015, the BlackEnergy malware was used to compromise three energy distribution companies, leading to power outages affecting approximately 230,000 consumers. A year later, in December 2016, the Industroyer malware was deployed, causing a significant outage in Kyiv and demonstrating the capability to disrupt industrial control systems. (en.wikipedia.org)

• Ibar-Lepenac Canal Attack (November 2024): In November 2024, an explosive device was detonated at the Ibar-Lepenac water canal in Kosovo, severely damaging critical infrastructure that supplies water to multiple municipalities and supports the main coal-fired power station of Kosovo. The attack was attributed to Serbia, highlighting the geopolitical tensions and the use of cyber and physical means to target critical infrastructure. (en.wikipedia.org)

Threat Actor Analysis

Sandworm, also known as APT28, is a Russian state-sponsored group associated with the GRU military intelligence agency. Active since at least 2009, Sandworm has been implicated in several high-profile cyberattacks, including the 2015 and 2016 attacks on Ukraine's power grid. Their operations often involve sophisticated malware designed to disrupt critical infrastructure. (securityweek.com)

Implications for Critical Infrastructure

The targeting of critical infrastructure by APT groups underscores the vulnerabilities within essential services. The use of wiper malware, such as DynoWiper and Industroyer, demonstrates the potential for long-term disruptions and the need for robust cybersecurity measures. The Ibar-Lepenac canal attack also highlights the convergence of cyber and physical threats to critical infrastructure.

Recommendations

• Enhanced Cybersecurity Measures: Organizations managing critical infrastructure should implement comprehensive cybersecurity protocols, including regular system updates, intrusion detection systems, and employee training to recognize phishing attempts.

• Incident Response Planning: Develop and regularly update incident response plans to ensure rapid and coordinated responses to cyberattacks.

• International Collaboration: Strengthen cooperation among Eastern European nations to share threat intelligence and coordinate defense strategies against APT groups.

Conclusion

The increasing frequency and sophistication of APT attacks on critical infrastructure in Eastern Europe necessitate a proactive and collaborative approach to cybersecurity. By understanding the tactics, techniques, and procedures of these threat actors, organizations can better prepare and defend against potential cyber threats.

Highlights:

• Russian Sandworm Hackers Blamed for Cyberattack on Polish Power Grid - SecurityWeek, Published on Sunday, January 25
• Ibar-Lepenac canal attack
• 2025 cyberattack on Polish power grid