Hacktivist Attacks on Eastern European Critical Infrastructure Escalate

Executive Summary

In early 2026, Eastern Europe has witnessed a surge in cyberattacks targeting critical infrastructure, including power grids, water systems, and industrial control systems (ICS). These attacks, attributed to various hacktivist groups, have escalated the threat landscape, necessitating immediate attention and enhanced cybersecurity measures.

Recent Incidents

• Poland's Power Grid Attack (December 2025): On December 29, 2025, Poland's power grid was compromised, leading to widespread outages. The attack targeted both IT and physical industrial devices, affecting renewable energy plants, a combined heat and power plant, and a manufacturing company. CERT Polska attributed the attack to the hacktivist group Berserk Bear, while ESET linked it to Sandworm, a Russian state-sponsored actor. (en.wikipedia.org)

• Latvia's ICS Threats (January 2026): In January 2026, Latvia's Constitution Protection Bureau (SAB) reported increased cyber threats targeting ICS in Latvia and other Western countries. These threats aim to spread uncertainty, undermine services, and deter support for Ukraine. (industrialcyber.co)

Attribution and Analysis

Hacktivist groups have been identified as primary perpetrators of these attacks. For instance, the group NoName057(16) has been linked to multiple DDoS attacks on critical infrastructure across Europe. In July 2025, a coordinated effort by twelve countries, along with Eurojust and Europol, led to the takedown of this group, which had been targeting power suppliers and public transport systems. (eurojust.europa.eu)

The increasing sophistication of these attacks is evident in the use of advanced malware strains. For example, the malware FrostyGoop manipulates Modbus TCP/502 communications within ICS environments, enabling attackers to alter or spoof industrial process commands, evade antivirus software, and cause physical damage to infrastructure. (dragos.com)

Implications for Critical Infrastructure

The escalation of cyberattacks on critical infrastructure poses significant risks to Eastern European countries. Disruptions to power grids can lead to widespread outages, affecting both residential and industrial sectors. Compromise of water systems can result in contamination or loss of access, impacting public health and safety. Intrusions into ICS can lead to manipulation of industrial processes, causing physical damage and economic losses.

Recommendations

• Enhanced Cybersecurity Measures: Organizations managing critical infrastructure should implement robust cybersecurity protocols, including regular system updates, intrusion detection systems, and employee training on cyber threats.

• Collaboration and Information Sharing: Governments and private sectors should collaborate to share threat intelligence and best practices, strengthening collective defense against cyber threats.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and coordinated actions in the event of a cyberattack.

Conclusion

The rise in cyberattacks targeting critical infrastructure in Eastern Europe underscores the evolving nature of hacktivist operations. Proactive measures, collaboration, and continuous vigilance are essential to mitigate these threats and safeguard regional stability.

Recent Cyberattacks on Eastern European Infrastructure:

• 2025 cyberattack on Polish power grid
• Latvia’s SAB warns of Russian ICS cyber threat to European and Western critical infrastructure - Industrial Cyber, Published on Monday, January 26
• Hacktivist group responsible for cyberattacks on critical infrastructure in Europe taken down | Eurojust | European Union Agency for Criminal Justice Cooperation, Published on Tuesday, July 15