Russian State-Sponsored Cyber Attacks Target Western Europe's Critical Infrastructure

Executive Summary

Since early 2025, Russian state-sponsored cyber actors have escalated their operations targeting critical infrastructure across Western Europe. These attacks have primarily focused on power grids, water systems, industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, healthcare facilities, and the financial sector. The sophistication and scale of these operations underscore a critical threat to national security and economic stability.

Key Findings

1. Power Grids: In May 2025, the Czech Republic accused China of conducting a malicious cyber campaign against the Foreign Ministry. (ersj.eu)

2. Water Systems: In 2024, Denmark's Defence Intelligence Service attributed a destructive cyberattack on a water utility to the pro-Russian group Z-Pentest. (securityaffairs.com)

3. Industrial Control Systems (ICS) and SCADA: In May 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, EPA, and Department of Energy, issued an urgent advisory warning that cyber actors were actively targeting ICS and SCADA systems within the U.S. oil and natural gas sector. (cybersecuritynews.com)

4. Healthcare Sector: In 2024, Russian hacking groups such as KAMACITE and ELECTRUM launched advanced attacks on Ukraine's critical infrastructure, including the healthcare sector. (ersj.eu)

5. Financial Sector: In December 2025, Amazon disclosed a years-long Russian state-backed cyber campaign targeting Western critical infrastructure from 2021 to 2025, with a significant focus on the energy sector. (securityaffairs.com)

Analysis

The attribution of these attacks to Russian state-sponsored actors is supported by multiple intelligence agencies and cybersecurity firms. The use of sophisticated malware, such as Industroyer in the 2016 Kyiv cyberattack, and the targeting of critical infrastructure sectors indicate a strategic approach aimed at causing widespread disruption and economic damage. (en.wikipedia.org)

The pro-Russian group Z-Pentest's involvement in the 2024 attack on Denmark's water utility highlights the use of proxy groups to achieve strategic objectives while maintaining plausible deniability. Similarly, the 2024 attacks on Ukraine's healthcare sector by Russian hacking groups KAMACITE and ELECTRUM demonstrate a pattern of targeting essential services to undermine societal stability. (ersj.eu)

Recommendations

1. Enhanced Cyber Defense Measures: Critical infrastructure operators should implement robust cybersecurity protocols, including regular system updates, intrusion detection systems, and employee training programs.

2. International Collaboration: Governments and private sectors must collaborate to share threat intelligence and coordinate responses to cyber threats targeting critical infrastructure.

3. Public Awareness Campaigns: Raising public awareness about the potential impacts of cyberattacks on essential services can foster resilience and preparedness among citizens.

Conclusion

The escalation of Russian state-sponsored cyberattacks on Western Europe's critical infrastructure represents a significant and growing threat. Proactive measures, international cooperation, and public engagement are essential to mitigate these risks and safeguard national security and economic interests.

Highlights:

• Russia was behind a destructive cyber attack on a water utility in 2024, Denmark says, Published on Friday, December 19
• Latvia’s SAB warns of Russian ICS cyber threat to European and Western critical infrastructure - Industrial Cyber, Published on Monday, January 26
• Russian state hackers targeted Western critical infrastructure for years, Amazon says, Published on Tuesday, December 16