State-Sponsored Cyber Attacks Targeting Western Europe's Critical Infrastructure

Executive Summary

In early 2026, Western Europe has witnessed a notable escalation in state-sponsored cyber attacks targeting critical infrastructure sectors such as power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector. These operations have been characterized by sophisticated tactics, posing medium-level threats to national security and economic stability.

Key Findings

1. Targeted Sectors and Attack Vectors

   • Power Grids and Water Systems: Advanced Persistent Threat (APT) groups have exploited vulnerabilities in ICS and Supervisory Control and Data Acquisition (SCADA) systems to disrupt energy and water supply chains. Notably, in April 2025, a Norwegian hydropower dam was hacked, leading to the release of 500 liters of water per second for four hours, described as a deliberate act of sabotage. (weforum.org)

   • Healthcare Sector: In 2024, European hospitals faced nearly 300 cybersecurity incidents, making healthcare the most targeted essential sector. These attacks have been widely attributed to Russian-linked groups, with major incidents costing around EUR 300,000 each. (eesc.europa.eu)

   • Financial Sector: State-sponsored actors have employed financial cybercrime tactics, including ransomware attacks, to infiltrate financial institutions. For instance, the Void Rabisu Group has been linked to such activities, demonstrating a convergence of financial and intelligence-gathering objectives. (ics-cert.kaspersky.com)

2. Attribution and Threat Actors

   • China: The European Union has sanctioned Chinese entities such as Integrity Technology Group and Anxun Information Technology for their involvement in cyber-attacks against EU member states. These companies have provided products and services used to compromise devices and critical infrastructure. (consilium.europa.eu)

   • Russia: Latvia's Constitution Protection Bureau (SAB) has identified Russian activities targeting ICS in Latvia and other Western countries, aiming to spread uncertainty and undermine services. (industrialcyber.co)

3. Emerging Threats and Trends

   • Hacktivist Activities: Hacktivist groups have increasingly targeted critical infrastructure, moving beyond traditional DDoS attacks to exploit ICS vulnerabilities. Between December 2024 and December 2025, groups like Z-Pentest and NoName057(16) have targeted SCADA networks using basic methods, including brute-force password spraying. (ics-cert.kaspersky.com)

   • DDoS Attacks: Distributed Denial of Service (DDoS) attacks have become a persistent threat, with a 75% increase in documented attacks in 2025. These attacks have targeted various sectors, including critical infrastructure, highlighting the need for robust defense mechanisms. (prnewswire.com)

Recommendations

• Enhanced Cyber Resilience: Organizations should implement comprehensive cybersecurity measures, including regular vulnerability assessments, incident response planning, and staff training to mitigate risks.

• International Collaboration: Strengthening cooperation among European nations and international partners is crucial to share threat intelligence and develop coordinated responses to cyber threats.

• Policy and Regulatory Measures: Governments should enforce stricter regulations and sanctions against state-sponsored cyber actors to deter future attacks.

Conclusion

The medium-level threat posed by state-sponsored cyber attacks on Western Europe's critical infrastructure underscores the necessity for heightened vigilance and proactive measures. By adopting a multi-faceted approach that includes technological defenses, policy enforcement, and international collaboration, the resilience of critical infrastructure can be significantly improved.

Highlights:

• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• European Commission confirms hackers breached mobile management platform, Published on Tuesday, February 10
• The EU wants to overhaul cybersecurity to shut out 'high-risk' foreign entities, Published on Wednesday, January 21