Ransomware Threats to Eastern European Critical Infrastructure Intensify

Executive Summary

In early 2026, ransomware groups have escalated their attacks on critical infrastructure across Eastern Europe, focusing on sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These attacks have led to operational disruptions, data breaches, and heightened security concerns.

Current Threat Landscape

Recent reports indicate a surge in ransomware incidents targeting critical industries globally, with a 34% increase observed between January and September 2025. Notably, 50% of these attacks affected sectors vital to national resilience, including manufacturing, healthcare, energy, transportation, and finance. (prnewswire.com)

In Eastern Europe, the threat is particularly pronounced. A report from Kaspersky's Industrial Control Systems Cyber Emergency Response Team (ICS CERT) highlights a high risk of targeted attacks in the region, with ICS computers experiencing a 1.3 times higher rate of email threats compared to the global average. Phishing emails with malicious attachments are commonly used to gain initial access, followed by the deployment of malware such as Trickbot, Cobalt Strike, and PowerShell Empire for lateral movement and persistence. (ics-cert.kaspersky.com)

Notable Threat Actors and Operations

Several ransomware groups have been identified as active in Eastern Europe:

• LockBit: A prolific ransomware group responsible for approximately 25% of global ransomware attacks, including those targeting critical infrastructure. (axios.com)

• Conti: Previously active in the region, Conti has been linked to attacks on healthcare and financial institutions, causing significant operational disruptions.

• REvil: Known for high-profile attacks, REvil has targeted various sectors, including energy and manufacturing, leading to substantial data exfiltration and system outages.

Impact on Critical Infrastructure

The escalation of ransomware attacks poses significant risks to Eastern Europe's critical infrastructure:

• Power Grids: Attacks can lead to widespread outages, affecting millions and disrupting essential services.

• Water Systems: Compromise of water treatment facilities can result in contamination, posing public health threats.

• Industrial Control Systems (ICS): Malware targeting ICS can disrupt manufacturing processes, leading to financial losses and supply chain interruptions.

• Healthcare Sector: Attacks on healthcare institutions can delay medical procedures, compromise patient data, and hinder emergency response capabilities.

• Financial Sector: Ransomware attacks can disrupt banking operations, leading to financial losses and eroding public trust in financial institutions.

Recommendations

To mitigate the risks associated with ransomware attacks on critical infrastructure, the following measures are recommended:

1. Enhanced Cyber Hygiene: Regularly update and patch systems, employ robust authentication mechanisms, and conduct regular security audits.

2. Employee Training: Implement comprehensive training programs to recognize phishing attempts and other social engineering tactics.

3. Incident Response Planning: Develop and regularly update incident response plans to ensure swift and coordinated responses to cyber incidents.

4. Collaboration and Information Sharing: Engage in information sharing with industry peers and governmental agencies to stay informed about emerging threats and best practices.

5. Investment in Security Technologies: Deploy advanced security solutions, including intrusion detection systems, endpoint protection, and network monitoring tools.

Conclusion

The increasing frequency and sophistication of ransomware attacks targeting critical infrastructure in Eastern Europe underscore the need for proactive and coordinated cybersecurity efforts. By implementing the recommended measures, organizations can enhance their resilience against these evolving threats and ensure the continued operation of essential services.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18
• 'It's destructive, not ransomware': Security experts weigh in on motivation behind Stryker cyber attack, Published on Thursday, March 12