Escalating State-Sponsored Cyber Operations in Eastern Europe

Executive Summary

Recent developments in Eastern Europe have seen a significant escalation in state-sponsored cyber operations. Notably, Russian Advanced Persistent Threat (APT) groups have intensified attacks on critical infrastructure, while Chinese entities have been implicated in providing hacking services to compromise devices within the region.

Russian APT Groups Targeting Critical Infrastructure

Russian APT groups, particularly APT28 (also known as Fancy Bear), have been actively targeting critical infrastructure in Eastern Europe. In December 2025, APT28 exploited vulnerabilities in FortiGate devices, specifically CVE-2026-21509, to deploy the DynoWiper malware. This operation aimed to destroy operational technology (OT) and information technology (IT) equipment, impacting at least 30 energy facilities, including wind and solar power plants in Poland. The attack led to the direct damage of remote terminal units (RTUs), intelligent electronic devices (IEDs), and serial devices, causing significant disruptions to the European power grid. (asec.ahnlab.com)

Chinese Entities Providing Hacking Services

Chinese entities have also been implicated in cyber activities targeting Eastern Europe. In March 2026, the European Union imposed sanctions on Integrity Technology Group and Anxun Information Technology, both China-based companies. These entities were found to have provided products and services used to compromise and access devices in EU member states. Between 2022 and 2023, their support led to the hacking of over 65,000 devices across six member states. (consilium.europa.eu)

Implications and Recommendations

The escalation of state-sponsored cyber operations in Eastern Europe underscores the need for enhanced cybersecurity measures. Organizations should prioritize the following actions:

• Vulnerability Management: Regularly update and patch systems to mitigate known vulnerabilities, particularly those identified in widely used devices and software.

• Network Segmentation: Implement network segmentation to limit the lateral movement of attackers within critical infrastructure systems.

• Incident Response Planning: Develop and regularly update incident response plans to ensure a swift and coordinated response to cyber incidents.

• Threat Intelligence Sharing: Engage in information sharing with industry peers and governmental bodies to stay informed about emerging threats and effective mitigation strategies.

By adopting these measures, organizations can bolster their defenses against the evolving landscape of state-sponsored cyber threats in Eastern Europe.

Highlights:

• Cyber-attacks against the EU and its member states: Council sanctions three entities and two individuals - Consilium, Published on Sunday, March 15
• January 2026 APT Group Trends Report - ASEC, Published on Thursday, February 12
• Extortion and ransomware drive over half of cyberattacks - Microsoft News Centre Europe, Published on Wednesday, October 15