Hacktivist Attacks on Eastern European Critical Infrastructure Escalate

Executive Summary

In early 2026, Eastern Europe has witnessed a significant escalation in cyberattacks targeting critical infrastructure, particularly from pro-Russian hacktivist groups. These groups, including Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), and Sector16, have intensified their operations, focusing on sectors such as energy, water, healthcare, and finance. Their activities range from Distributed Denial of Service (DDoS) attacks to exploiting vulnerabilities in Industrial Control Systems (ICS) and Supervisory Control and Data Acquisition (SCADA) systems.

Recent Developments

In December 2025, the National Security Agency (NSA), Federal Bureau of Investigation (FBI), and other agencies issued a joint advisory highlighting the growing threat from pro-Russian hacktivist groups targeting critical infrastructure. These groups have been observed exploiting inadequately secured Virtual Network Computing (VNC) connections to infiltrate operational technology (OT) control devices within critical infrastructure systems. (nsa.gov)

Between February 28 and March 2, 2026, a coordinated wave of 149 DDoS attacks targeted 110 organizations across 16 countries, following the U.S.-Israel military campaign against Iran. The majority of attacks were concentrated in the Middle East, with Kuwait, Israel, and Jordan accounting for over 76% of incidents. Nearly half of the targeted organizations were in the government sector, with finance and telecommunications also significantly affected. The attacks were orchestrated by at least 12 hacktivist groups, with Keymous+ and DieNet responsible for nearly 70% of activity. (rescana.com)

Technical Analysis

The primary attack vectors employed by these hacktivist groups include:

• DDoS Attacks: Flooding targeted systems with excessive traffic to disrupt services.

• Exploitation of ICS/SCADA Vulnerabilities: Gaining unauthorized access to critical infrastructure systems through exposed VNC connections and default credentials.

• Ransomware Deployment: Encrypting critical data and demanding payment for its release.

The use of default or weak passwords in ICS/SCADA systems has been a significant vulnerability, allowing attackers to gain access using relatively simple techniques. (ibm.com)

Impact Assessment

The consequences of these cyberattacks are multifaceted:

• Operational Disruptions: Interruptions in power grids, water systems, and healthcare services, leading to public safety concerns.

• Financial Losses: Costs associated with system recovery, legal liabilities, and potential regulatory fines.

• Reputational Damage: Loss of public trust in the security and reliability of critical infrastructure.

Recommendations

To mitigate the risks posed by these cyber threats, organizations should consider the following measures:

• Strengthen Authentication Mechanisms: Implement robust password policies and multi-factor authentication to secure ICS/SCADA systems.

• Network Segmentation: Isolate critical infrastructure networks from general IT networks to limit the spread of attacks.

• Regular Vulnerability Assessments: Conduct periodic security audits to identify and remediate potential weaknesses.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and effective responses to cyber incidents.

Conclusion

The increasing frequency and sophistication of hacktivist attacks on critical infrastructure in Eastern Europe underscore the urgent need for enhanced cybersecurity measures. Pro-Russian hacktivist groups are leveraging both technical vulnerabilities and geopolitical tensions to disrupt essential services. A proactive and coordinated approach is essential to safeguard national security and public welfare.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18
• Russian DDoS: what's the threat to businesses?, Published on Tuesday, March 03