Hacktivist Groups Intensify Cyber Operations in Eastern Europe Amid Geopolitical Tensions

In recent months, Eastern Europe has witnessed a surge in cyber operations attributed to hacktivist groups, reflecting a complex interplay between cyber activism and geopolitical tensions. These groups, often operating with varying degrees of state support, have escalated their activities, targeting critical infrastructure and sensitive data across the region.

Key Actors and Activities

One prominent group, NoName057(16), has been linked to multiple distributed denial-of-service (DDoS) attacks against critical infrastructure in Europe. Notably, in July 2025, a coordinated effort involving twelve countries, Eurojust, and Europol led to the takedown of this group, which had been responsible for DDoS attacks targeting power suppliers and public transport systems during significant political events. (eurojust.europa.eu)

Another group, Keymous+, has been active in the region, conducting numerous DDoS attacks between February and September 2025. Their targets included nations such as India, Sudan, Saudi Arabia, France, and Morocco, indicating a broad operational scope. (advanced-television.com)

Exploitation of Vulnerabilities

Hacktivist groups have demonstrated a keen ability to exploit existing vulnerabilities within critical infrastructure. For instance, the UK's National Cyber Security Centre (NCSC) issued an alert regarding campaigns by the Russian-linked APT28 group, also known as Fancy Bear or Forest Blizzard. These campaigns targeted small office/home office (SOHO) routers, exploiting vulnerabilities to conduct DNS hijacking and facilitate adversary-in-the-middle attacks, leading to the theft of web and email credentials. (itpro.com)

Implications for Eastern Europe

The activities of these hacktivist groups underscore the evolving threat landscape in Eastern Europe. The region's critical infrastructure remains a prime target, with cyber operations serving as both a tool for political expression and a means to advance geopolitical objectives. The intersection of cyber activism and state-sponsored operations complicates attribution and response efforts, necessitating a nuanced approach to cybersecurity.

Recommendations

To mitigate the risks posed by these cyber operations, it is imperative for Eastern European nations to enhance their cybersecurity frameworks. This includes regular vulnerability assessments, prompt patching of identified weaknesses, and fostering international cooperation to share threat intelligence. Additionally, public awareness campaigns can play a crucial role in educating citizens and organizations about potential cyber threats and best practices for defense.

In conclusion, the rise of hacktivist cyber operations in Eastern Europe reflects a broader trend of cyber activities intersecting with geopolitical dynamics. A proactive and collaborative approach is essential to safeguard the region's digital infrastructure and maintain national security.