Escalating Cyber Threats to Critical Infrastructure in Western Europe

Executive Summary

In early 2026, cybercriminal activities targeting critical infrastructure in Western Europe have intensified, posing substantial risks to sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. Notably, pro-Russian hacktivist groups, including Z-Pentest and NoName057(16), have been implicated in several high-profile attacks.

Key Incidents

• Power Grids: On January 3, 2026, an arson attack on the Berlin power grid resulted in power outages affecting over 40,000 households and 2,000 businesses across southwest Berlin. The attack, which involved setting fire to a cable bridge, led to the longest-lasting power outage in the city since 1945. (en.wikipedia.org)

• Water Systems: In April 2025, Norwegian authorities attributed a cyberattack on a dam to pro-Russian hackers. The attack remotely opened a valve via the digital control system, briefly increasing water flow. Although the incident did not endanger nearby areas, it marked a significant escalation in cyber campaigns against European infrastructure. (apnews.com)

• Healthcare: On January 13, 2026, the AZ Monica hospital in Antwerp, Belgium, experienced a significant cyberattack that disrupted computer systems, leading to the cancellation of at least 70 surgeries and the transfer of seven critical patients to other facilities. The attack affected patient registration and emergency services, highlighting vulnerabilities in healthcare infrastructure. (en.wikipedia.org)

Attribution and Threat Actors

Pro-Russian hacktivist groups have been identified as primary perpetrators of these attacks. Z-Pentest and NoName057(16) have been linked to multiple cyber incidents targeting critical infrastructure across Europe. For instance, in 2024 and 2025, Danish authorities accused Russia of conducting cyberattacks on national infrastructure, including a disruptive attack on the Tureby Alkestrup Waterworks near Copenhagen. (apnews.com)

Tactics, Techniques, and Procedures (TTPs)

These threat actors employ a range of TTPs, including:

• Distributed Denial-of-Service (DDoS) Attacks: In 2025, DDoS attacks became a constant threat, with a 75% increase in documented attacks compared to the previous year. These attacks often target critical infrastructures, causing service disruptions and financial losses. (prnewswire.com)

• Ransomware and Data Exfiltration: Hacktivist groups have increasingly targeted industrial control systems and operational technology, employing ransomware to disrupt operations and exfiltrate sensitive data. In Spain, there was a 43% rise in cyberattacks against essential infrastructure in 2024, with the energy sector being a primary target. (prosegur.com)

Implications

The escalation of cyberattacks on critical infrastructure in Western Europe underscores the need for enhanced cybersecurity measures. The involvement of pro-Russian hacktivist groups indicates a geopolitical dimension to these threats, potentially aiming to destabilize European nations and undermine public trust in essential services.

Recommendations

• Strengthen Cybersecurity Protocols: Organizations should implement robust cybersecurity frameworks, conduct regular vulnerability assessments, and ensure timely patching of systems.

• Enhance Incident Response Capabilities: Develop and regularly update incident response plans to ensure swift and coordinated responses to cyber incidents.

• Foster International Collaboration: Engage in information sharing and collaborative defense initiatives with international partners to effectively counteract cyber threats.

By adopting these measures, organizations can bolster their defenses against the evolving cyber threat landscape targeting critical infrastructure in Western Europe.

Highlights:

• Norwegian police say pro-Russian hackers were likely behind suspected sabotage at a dam, Published on Wednesday, August 13
• Denmark blames Russia for cyberattacks on water utility that left houses without water, Published on Friday, December 19
• 1,000 computers taken offline in Romanian water management authority hack - ransomware takes Bitlocker-encrypted systems down, Published on Monday, December 22