Pro-Russian Hacktivist Groups Intensify Cyberattacks on Western European Critical Infrastructure

Executive Summary

In early 2026, pro-Russian hacktivist groups, particularly Z-Pentest and Dark Engine, have significantly intensified cyberattacks on critical infrastructure across Western Europe. These operations have targeted sectors such as energy, water utilities, and industrial control systems (ICS), posing substantial risks to national security and economic stability.

Operational Overview

Z-Pentest, a pro-Russian hacktivist group, has emerged as a leading threat actor in targeting ICS environments. In the second quarter of 2025, the group was responsible for 38 ICS-targeted incidents, marking a 150% increase from the 15 incidents attributed to them in the first quarter. Their operations have predominantly focused on energy infrastructure across multiple European countries, with the group often releasing videos demonstrating tampering with ICS controls to amplify the psychological impact of their attacks. (cyble.com)

Dark Engine, another pro-Russian hacktivist group, has also been active in targeting ICS systems. In the second quarter of 2025, Dark Engine accounted for 26 ICS-targeted incidents, with a significant operational surge in June. Their attacks have spanned various sectors, including energy, food and beverages, and manufacturing, demonstrating both strategic breadth and technical depth. (cyble.com)

Targeted Sectors and Impact

• Energy Sector: Both Z-Pentest and Dark Engine have targeted energy infrastructure, including power grids and hydroelectric facilities. In France, Z-Pentest claimed to have breached a hydroelectric power plant's SCADA system, releasing screenshots showing turbine control settings and power output data. (cybernews.com)

• Water Utilities: The groups have also targeted water utilities. In the United States, CyberArmyofRussia_Reborn (CARR) claimed responsibility for manipulating human-machine interfaces (HMIs) at water storage facilities, leading to the overflow of water storage tanks in Abernathy and Muleshoe, Texas. (levelblue.com)

• Industrial Control Systems (ICS): The groups have demonstrated the ability to adapt access-based intrusions, data exfiltration, and psychological operations to ongoing regional disputes, further blurring the lines between hacktivism and state-aligned cyber operations. (cyberpress.org)

Tactics, Techniques, and Procedures (TTPs)

The pro-Russian hacktivist groups employ a range of TTPs, including:

• Distributed Denial of Service (DDoS) Attacks: Flooding targeted systems with excessive traffic to disrupt services.

• Phishing Campaigns: Deploying deceptive emails to gain unauthorized access to systems.

• Exploitation of Vulnerabilities: Targeting known vulnerabilities in ICS and SCADA systems to gain control.

• Data Exfiltration: Stealing sensitive data to use as leverage or for further attacks.

Recommendations

Organizations operating critical infrastructure in Western Europe should consider the following measures to mitigate the risks posed by these cyberattacks:

• Enhanced Monitoring: Implement continuous monitoring of ICS and SCADA systems to detect and respond to unauthorized access attempts promptly.

• Regular Vulnerability Assessments: Conduct frequent assessments to identify and remediate vulnerabilities in critical systems.

• Employee Training: Provide regular training to staff on recognizing phishing attempts and other social engineering tactics.

• Incident Response Planning: Develop and regularly update incident response plans to ensure a swift and coordinated response to cyber incidents.

Conclusion

The escalation of cyberattacks by pro-Russian hacktivist groups on critical infrastructure in Western Europe underscores the evolving nature of cyber threats. Organizations must adopt a proactive and comprehensive approach to cybersecurity to safeguard essential services and maintain public trust.

Pro-Russian Hacktivist Groups Intensify Cyberattacks on Western European Critical Infrastructure:

• Hackers flood France with attacks over war support​ | Cybernews, Published on Thursday, March 27
• Hacktivists Attacks On Critical Infrastructure Surge In 2025, Published on Thursday, July 10
• The Russia-Ukraine Cyber War Part 3: Attacks on Telecom and Critical Infrastructure, Published on Tuesday, March 04