State-Sponsored Cyber Operations in Eastern Europe: A 2026 Assessment

Introduction

As of March 2026, Eastern Europe remains a focal point for state-sponsored cyber operations, with various nation-states leveraging cyber capabilities to advance geopolitical objectives. This briefing provides an overview of the current landscape, highlighting key actors, operations, and the evolving role of military cyber units in the region.

Key Actors and Operations

Russian Federation

Russia continues to employ cyber operations as a strategic tool to influence regional dynamics. Notably, the pro-Ukraine hacktivist group BlackJack has developed malware strains such as Fuxnet, designed to target industrial control systems within Russian infrastructure. Fuxnet was used to disable thousands of sensors and destroy sensor gateway devices in Moscow's communication system for gas, water, and sewage networks. (dragos.com)

Ukraine

In response to ongoing cyber threats, Ukraine has bolstered its cyber defense capabilities. The IT Army of Ukraine, a volunteer cyberwarfare organization established in February 2022, has been instrumental in defending critical infrastructure and conducting offensive cyber operations against Russian targets. The group has coordinated attacks on Russian power grids and railways, demonstrating a proactive approach to cyber defense. (en.wikipedia.org)

Poland

Poland has enhanced its cyber defense posture by establishing the Cyberspace Defense Forces (CDF) on February 8, 2022. The CDF is tasked with safeguarding Poland's military and civilian cyber infrastructure, operating under the Ministry of National Defense. The unit's creation underscores Poland's commitment to strengthening its cyber capabilities amid regional tensions. (en.wikipedia.org)

Lithuania

Lithuania launched the Lithuanian Cyber Command (LTCYBERCOM) in January 2025 to coordinate and execute cyber operations. The command structure includes a headquarters for centralized cyber operations, a communications and information systems battalion, and a cyber defense command focused on information technology services. LTCYBERCOM complements the existing National Cyber Security Center, enhancing Lithuania's resilience against cyber threats. (thedefensepost.com)

Military Cyber Units and Exercises

The integration of cyber capabilities into military structures has become a strategic priority for several Eastern European nations:

• Estonia: The Estonian Defence Forces Cyber Command, established in August 2018, is responsible for conducting defensive and offensive cyber operations. The command comprises units such as the Information and Communication Technology Centre and the Cyber and Information Operations Center, reflecting Estonia's proactive stance in cyber defense. (en.wikipedia.org)

• Romania: In June 2025, cyber operators from the Maryland Air National Guard partnered with Romanian Cyber Command counterparts to conduct a cyber warfare exercise under the umbrella of Saber Guardian 25. This collaboration aimed to enhance coordination and interoperability in responding to large-scale digital attacks, emphasizing joint planning and rapid response capabilities. (news.maryland.gov)

Geopolitical Implications

The escalation of state-sponsored cyber operations in Eastern Europe has significant geopolitical implications:

• Regional Security: Cyber operations have become a critical component of national defense strategies, with countries like Ukraine and Poland investing in cyber capabilities to deter adversaries and protect critical infrastructure.

• International Collaboration: The complexity of cyber threats has led to increased cooperation among Eastern European nations and international partners. Exercises such as Saber Guardian 25 exemplify joint efforts to bolster cyber defense and response mechanisms.

• Norms and Policies: The growing prevalence of cyber operations is prompting discussions on international norms and policies governing state behavior in cyberspace, with a focus on establishing frameworks for responsible conduct and conflict prevention.

Conclusion

As of March 2026, state-sponsored cyber operations in Eastern Europe are characterized by active engagement from multiple nation-states, each leveraging cyber capabilities to achieve strategic objectives. The establishment and enhancement of military cyber units underscore the importance of cyber defense in national security strategies. Ongoing international collaboration and dialogue are essential to address the evolving challenges posed by cyber threats in the region.

Sources

• IT Army of Ukraine
• Cyberspace Defense Forces
• Lithuania Launches New Cyber Command Amid Growing Threats
• Maryland Air National Guard cyber operators exercise with Romanian counterparts
• Cyber Command (Estonia)
• Dragos Reports OT/ICS Cyber Threats Escalate Amid Geopolitical Conflicts and Increasing Ransomware Attacks

Highlights:

• Lithuania Launches New Cyber Command Amid Growing Threats, Published on Monday, January 06
• Maryland Air National Guard cyber operators exercise with Romanian counterparts, Published on Wednesday, June 25
• Ukraine Military Opens New Cyber Defense Training Facility, Published on Monday, October 09