State-Aligned Cyber Threats Targeting Western Europe's Critical Infrastructure

Executive Summary

State-sponsored cyber actors are intensifying their efforts to compromise critical infrastructure across Western Europe. Sectors including energy, water, healthcare, and finance are particularly vulnerable, with recent incidents highlighting the evolving tactics and motivations of these adversaries.

Current Threat Landscape

Between July 2024 and June 2025, the European Union Agency for Cybersecurity (ENISA) analyzed 4,875 cyber incidents, with public institutions being the most targeted category, accounting for 38% of all incidents. The transport sector followed with 7.5%, digital infrastructure and services at 4.8%, finance at 4.5%, and manufacturing at 2.9%. (computing.co.uk)

Notable Incidents

• Energy Sector: In May 2023, Denmark experienced a significant cyberattack on its energy sector. SektorCERT reported that 22 energy companies were targeted in a two-wave operation. The first wave exploited a zero-day vulnerability in Zyxel firewalls, while the second wave employed more sophisticated techniques consistent with Russian state-sponsored group Sandworm's tradecraft. Eleven companies were directly compromised. (geopoliticalmatters.com)

• Water Sector: The Aliquippa Municipal Water Authority in Pennsylvania, USA, was targeted by the Iranian-backed Cyber Avengers group in 2023. This incident underscores the vulnerabilities within the water sector, echoing previous attacks such as the 2011 Springfield, Illinois hack. (jacobs.com)

Adversary Tactics and Techniques

State-sponsored actors are increasingly employing sophisticated methods to infiltrate critical infrastructure:

• Exploitation of Vulnerabilities: Adversaries have shifted from exploiting known vulnerabilities to abusing misconfigured network edge devices, enabling credential theft and lateral movement with lower risk. This evolution in tactics has been observed in campaigns attributed to Russian state-sponsored group GRU/Sandworm. (securityaffairs.com)

• Living off the Land: Attackers are utilizing legitimate tools already present within operational technology (OT) environments to avoid detection, making attribution and response significantly more challenging. (geopoliticalmatters.com)

Implications for Western Europe

The escalation of state-aligned cyber threats poses several risks to Western European nations:

• Operational Disruption: Cyberattacks can lead to significant operational disruptions, as seen in the Danish energy sector attack, where multiple companies were compromised.

• Economic Impact: The financial sector is particularly susceptible, with potential for data breaches and financial losses. The European Central Bank has highlighted the threat to financial stability arising from state-sponsored cyberattacks. (ecb.europa.eu)

• Public Confidence: Attacks on critical infrastructure can erode public trust in essential services, leading to broader societal impacts.

Recommendations

To mitigate these threats, it is recommended that organizations:

• Enhance Cyber Hygiene: Regularly update and patch systems to address known vulnerabilities.

• Implement Network Segmentation: Isolate critical systems to limit the potential impact of a breach.

• Conduct Regular Security Audits: Identify and rectify misconfigurations and other security weaknesses.

• Collaborate with Authorities: Engage with national and international cybersecurity agencies to share threat intelligence and best practices.

Conclusion

State-sponsored cyber threats targeting critical infrastructure in Western Europe are on the rise, with significant implications for national security and public safety. Proactive measures, including improved cybersecurity practices and enhanced collaboration, are essential to bolster resilience against these evolving threats.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18