Persistent Cyber Espionage Threats in Western Europe: A 2026 Assessment

Executive Summary

As of March 2026, Western Europe continues to face significant cyber espionage threats from state-sponsored Advanced Persistent Threat (APT) groups. These actors employ sophisticated tactics to infiltrate networks, maintain long-term access, and extract sensitive information. Notably, there has been an increase in supply chain compromises, targeted intrusions linked to signals intelligence (SIGINT), and attacks on diplomatic entities.

Supply Chain Compromise for Intelligence Collection

APT groups have increasingly targeted supply chains to gain access to a wide range of organizations. In the second quarter of 2025, Kaspersky ICS CERT reported that Russian-speaking groups, including Sandworm (also known as APT44), exploited vulnerabilities in network devices and public-facing applications to intercept traffic and deploy wiper malware. These attacks primarily targeted Ukrainian entities but also affected Western European organizations with interconnected supply chains. (ics-cert.kaspersky.com)

SIGINT-Linked Intrusions

The exploitation of SIGINT capabilities has been a hallmark of recent cyber espionage activities. In February 2026, CERT-EU reported a sophisticated phishing campaign impersonating Signal's support bot, targeting high-profile figures across Europe, including politicians, military personnel, and journalists. The attackers aimed to harvest sensitive communications, indicating a strategic use of SIGINT-linked intrusions to gather intelligence. (cert.europa.eu)

Diplomatic Targeting

Diplomatic entities remain prime targets for cyber espionage. In February 2026, French authorities placed four individuals under formal investigation on suspicion of spying for China. The accused were allegedly attempting to capture and transmit sensitive data, including satellite and military information, to China. This case underscores the persistent threat to diplomatic and governmental institutions in Western Europe. (cert.europa.eu)

Notable Threat Actors

Several APT groups have been identified as active in these operations:

• APT28 (Fancy Bear): A Russian state-sponsored group known for targeting Western logistics and technology companies. In May 2025, CISA reported that APT28 conducted a cyber-espionage campaign against entities involved in the coordination and delivery of foreign assistance to Ukraine. (cisa.gov)

• Sandworm (APT44): Another Russian-aligned group, Sandworm has been active in deploying wiper malware and exploiting vulnerabilities in network devices. Their activities have affected both Ukrainian and Western European organizations. (ics-cert.kaspersky.com)

• APT15: Believed to be operating out of China, APT15 has demonstrated persistent and evolving threat capabilities since 2010. Their operations have included targeting European Ministries of Foreign Affairs and surveillance activities against various entities. (picussecurity.com)

Conclusion

The cyber espionage landscape in Western Europe remains dynamic and complex. State-sponsored APT groups continue to refine their tactics, focusing on supply chain compromises, SIGINT-linked intrusions, and diplomatic targeting. Organizations must remain vigilant, implement robust cybersecurity measures, and stay informed about emerging threats to mitigate potential risks.

Highlights:

• CERT-EU - Cyber Brief 26-03 - February 2026, Published on Sunday, March 01
• Russian GRU Targeting Western Logistics Entities and Technology Companies | CISA, Published on Tuesday, May 20
• APT15 Cyber Espionage: Campaigns and TTPs Analysis, Published on Tuesday, January 06