State-Sponsored Cyber Attacks in Western Europe: A Critical Threat Assessment

Executive Summary

Recent state-sponsored cyber operations in Western Europe have escalated, targeting critical infrastructure and defense sectors, posing significant geopolitical and security risks. Notably, Chinese and Russian Advanced Persistent Threat (APT) groups have intensified their activities, leveraging sophisticated tactics and tools to infiltrate and disrupt European entities.

Chinese APT Groups: Integrity Technology Group and Anxun Information Technology

In March 2026, the European Union imposed sanctions on two Chinese entities: Integrity Technology Group and Anxun Information Technology. Integrity Technology Group was implicated in providing products that compromised over 65,000 devices across six EU member states between 2022 and 2023. Anxun Information Technology offered hacking services targeting critical infrastructure and functions within EU member states and third countries. These actions underscore China's strategic focus on cyber operations to advance its geopolitical interests. (consilium.europa.eu)

Russian APT Groups: APT28 and Sandworm

Russian state-sponsored groups, notably APT28 and Sandworm, have been active in Western Europe. APT28 exploited vulnerabilities in Microsoft Office (CVE-2026-21509) to conduct large-scale attacks against European military, government, and transportation agencies, as well as Ukrainian organizations. These attacks demonstrate Russia's capability to rapidly exploit newly disclosed vulnerabilities for cyber espionage and disruption. (asec.ahnlab.com)

Sandworm, another Russian APT group, targeted at least 30 energy facilities in Poland by deploying the DynoWiper malware. This operation aimed to destroy operational technology and information technology equipment, causing significant disruption to the European power grid. The attack highlights the potential for cyber operations to impact critical infrastructure and energy security. (asec.ahnlab.com)

Iranian Cyber Operations

The geopolitical tensions following the 2026 Iran war have led to increased cyber activities attributed to Iranian state-sponsored actors. These operations have targeted European entities, including critical infrastructure and defense sectors, reflecting Iran's intent to leverage cyber capabilities in response to regional conflicts. (en.wikipedia.org)

Impact on the Defense Sector

State-sponsored cyber espionage campaigns have increasingly targeted defense industry employees across Western Europe. These campaigns involve sophisticated spear-phishing attacks and social engineering tactics to infiltrate defense contractors and extract sensitive information. The integration of generative AI by threat actors has enhanced the scale and sophistication of these attacks, posing significant risks to national security. (theguardian.com)

Conclusion

The escalation of state-sponsored cyber attacks in Western Europe presents a critical threat to national security and economic stability. The involvement of Chinese, Russian, and Iranian APT groups underscores the need for enhanced cybersecurity measures, international cooperation, and proactive defense strategies to mitigate these evolving threats.

Highlights:

• 'The total industrialization of cyber threats': Cloudflare report outlines how hackers are 'weaponizing the Internet', Published on Wednesday, March 04
• Record number of UK businesses hit by nation state attacks as attackers weaponize AI, Published on Wednesday, March 18