Russian APT Groups Intensify Zero-Day Exploitation in Eastern Europe

Executive Summary

Russian state-sponsored cyber actors have escalated their exploitation of zero-day vulnerabilities to target critical infrastructure and governmental entities in Eastern Europe. This trend underscores a critical threat to regional cybersecurity, necessitating immediate and comprehensive defensive measures.

Introduction

Zero-day vulnerabilities—previously unknown flaws in software or hardware—have become a focal point for cyber actors aiming to infiltrate systems without detection. In Eastern Europe, Russian advanced persistent threat (APT) groups have intensified their campaigns, utilizing these vulnerabilities to execute sophisticated attacks against high-value targets.

Recent Exploitation Activities

In late 2024, ESET Research documented increased cyber activity by Russian APT groups, notably Sednit and Gamaredon, against Ukraine and European Union countries. These groups exploited zero-day vulnerabilities and deployed wiper malware, indicating a shift towards more destructive cyber operations. (eset.com)

In February 2026, the U.S. Department of the Treasury sanctioned Sergey Sergeyevich Zelenyuk and his company, Matrix LLC (operating as "Operation Zero"), for acquiring and distributing cyber tools harmful to U.S. national security. Operation Zero has been actively seeking zero-day exploits, including those targeting U.S.-built software, highlighting the global reach and impact of such vulnerabilities. (home.treasury.gov)

Notable Zero-Day Vulnerabilities and Exploits

• Mozilla Firefox Vulnerability (CVE-2024-9680): In October 2024, ESET researchers discovered a critical use-after-free vulnerability in Firefox's animation timeline feature. Exploited by the Russia-aligned RomCom APT group, this flaw allowed for remote code execution without user interaction, leading to the installation of backdoors on victim systems. (eset.com)

• Windows Privilege Escalation (CVE-2024-49039): Alongside the Firefox vulnerability, a privilege escalation bug in Windows was identified, enabling code execution outside of Firefox's sandbox. This vulnerability was also exploited by RomCom, facilitating further system compromise. (eset.com)

• 7-Zip File Compression Utility Vulnerability (CVE-2025-0411): In February 2025, a zero-day vulnerability in 7-Zip was exploited in espionage operations against Ukrainian targets. Russian-linked actors embedded malicious payloads into archive files, leading to the installation of SmokeLoader malware upon extraction. (astrill.com)

Exploit Broker Transactions

The increasing demand for zero-day exploits has led to the emergence of exploit brokers like Operation Zero. In March 2025, Operation Zero publicly offered up to $4 million for zero-day vulnerabilities targeting the Telegram messaging app. This substantial bounty underscores the strategic value placed on such exploits by state-sponsored actors. (techcrunch.com)

Implications for Eastern Europe

The exploitation of zero-day vulnerabilities by Russian APT groups poses significant risks to Eastern European nations. Critical infrastructure sectors, including energy, telecommunications, and government services, are particularly vulnerable to these sophisticated attacks. The use of zero-day exploits allows adversaries to bypass traditional security measures, making detection and mitigation challenging.

Recommendations

To bolster defenses against such advanced threats, Eastern European nations should consider the following measures:

• Enhanced Vulnerability Management: Implement robust systems for the rapid identification, assessment, and patching of vulnerabilities, with a focus on zero-day threats.

• Collaboration with International Partners: Engage in information sharing and joint defense initiatives with international cybersecurity organizations to stay abreast of emerging threats and mitigation strategies.

• Investment in Cybersecurity Research: Allocate resources to research and development efforts aimed at detecting and neutralizing zero-day exploits, including the establishment of dedicated teams for threat hunting and analysis.

Conclusion

The increasing use of zero-day vulnerabilities by Russian state-sponsored cyber actors represents a critical threat to Eastern European cybersecurity. A proactive and collaborative approach is essential to mitigate these risks and safeguard national interests.

Russian APT Groups Intensify Cyber Attacks in Eastern Europe:

• Russian APT Groups Intensify Attacks in Europe with Zero-Day Exploits - Infosecurity Magazine, Published on Monday, May 19
• ESET Research APT Report: Russian cyberattacks in Ukraine intensify; Sandworm unleashes new destructive wiper | | ESET, Published on Sunday, May 18