State-Sponsored Cyber Espionage Intensifies in Eastern Europe Amid Geopolitical Tensions

Executive Summary

In early 2026, Eastern Europe has witnessed a significant uptick in cyber espionage activities attributed to state-sponsored actors. These campaigns have primarily targeted critical infrastructure, defense sectors, and government entities, underscoring the region's strategic importance amid ongoing geopolitical tensions.

Key Developments

1. APT28's Operation Neusploit

   In February 2026, the Russian-affiliated Advanced Persistent Threat (APT) group APT28, also known as Fancy Bear, initiated "Operation Neusploit." This campaign exploited the CVE-2026-21509 vulnerability in Microsoft Office to deliver email-stealing and backdoor malware. Targets included Ukraine, Slovakia, and Romania, highlighting APT28's focus on Central and Eastern Europe and its rapid adoption of newly disclosed vulnerabilities. (cert.europa.eu)

2. Chinese Cyber Espionage on Italian Government Ministry

   Between 2024 and 2025, a suspected China-linked cyber espionage campaign targeted an Italian government ministry, compromising sensitive data on approximately 5,000 law enforcement agents. The breach aimed to gather information on individuals investigating Chinese dissidents and organized crime, indicating a strategic interest in European law enforcement operations. (cert.europa.eu)

3. Russian Cyber Espionage on Norwegian Maritime Infrastructure

   Norwegian security agencies have reported increased Russian intelligence operations targeting maritime infrastructure. The Norwegian Police Security Service (PST) highlighted that Russia has enhanced its cyber capabilities to conduct intelligence operations within Norway, with maritime assets being a primary focus. (maritime-executive.com)

Analytical Insights

The escalation in cyber espionage activities in Eastern Europe reflects a broader trend of state-sponsored actors leveraging cyber capabilities to advance geopolitical objectives. The region's critical infrastructure and governmental bodies are increasingly vulnerable to sophisticated cyber operations, necessitating enhanced defensive measures and international cooperation.

Recommendations

• Enhanced Cyber Defense Posture: Organizations should implement robust cybersecurity frameworks, conduct regular vulnerability assessments, and ensure timely patching of known exploits.

• Intelligence Sharing: Establish and participate in information-sharing initiatives to disseminate threat intelligence and coordinate responses to cyber threats.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and effective reactions to cyber incidents.

Conclusion

The recent surge in cyber espionage activities in Eastern Europe underscores the critical need for heightened vigilance and preparedness. By adopting comprehensive cybersecurity strategies and fostering international collaboration, entities can better safeguard against the evolving cyber threat landscape.

Highlights:

• State-sponsored hackers targeting defence sector employees, Google says | Espionage | The Guardian, Published on Monday, February 09
• Norway Flags Russian Cyber Espionage Campaign on Maritime Infrastructure, Published on Sunday, February 08
• CERT-EU - Cyber Brief 26-03 - February 2026, Published on Sunday, March 01