State-Sponsored Cyber Operations in Eastern Europe: A 2026 Assessment

Introduction

As of March 2026, Eastern Europe remains a focal point for state-sponsored cyber operations. Advanced Persistent Threat (APT) groups, often linked to national intelligence agencies, continue to target critical infrastructure, government entities, and private sectors in the region. This briefing provides an overview of recent activities, methodologies, and the broader geopolitical context.

Notable APT Groups and Their Activities

APT28 (Fancy Bear)

APT28, also known as Fancy Bear, is a Russian state-sponsored group attributed to Unit 74455 of the GRU. Recent activities include:

• Operation Neusploit: In February 2026, APT28 exploited vulnerabilities in Microsoft Office (CVE-2026-21509) to deliver email-stealing and backdoor malware to targets in Ukraine, Slovakia, and Romania. (cert.europa.eu)

• Operation MacroMaze: Between September 2025 and January 2026, the group conducted spear-phishing campaigns targeting organizations in Western and Central Europe, utilizing malicious Microsoft Word documents to deploy multi-stage malware. (techradar.com)

Sandworm

Attributed to the Russian GRU, Sandworm is known for disruptive and destructive cyber operations. Notable activities include:

• Energy Sector Attacks: In December 2025, Sandworm attempted to destroy operational technology (OT) and information technology (IT) equipment using DynoWiper malware, targeting at least 30 energy facilities, including wind and solar power plants in Poland. (asec.ahnlab.com)

Silver Dragon

Silver Dragon is a Chinese state-sponsored group, possibly linked to APT41. Their activities encompass:

• Malware Deployment: Since mid-2024, Silver Dragon has targeted government entities in Southeast Asia and Europe, including Russia, Poland, Hungary, and Italy. They employ sophisticated tactics, such as using Google Drive for command-and-control infrastructure to exfiltrate data unnoticed. (techradar.com)

Tactics, Techniques, and Procedures (TTPs)

State-sponsored APT groups in Eastern Europe employ a range of sophisticated TTPs:

• Exploitation of Zero-Day Vulnerabilities: Rapid adoption of newly disclosed vulnerabilities, as seen with APT28's exploitation of CVE-2026-21509. (cert.europa.eu)

• Spear-Phishing Campaigns: Highly personalized emails, often themed around diplomatic content, to deceive victims into activating malicious macros. (techradar.com)

• Use of Legitimate Services for C2: Leveraging platforms like Google Drive to disguise command-and-control communications and exfiltrate data. (techradar.com)

Geopolitical Implications

The persistence of state-sponsored cyber operations in Eastern Europe underscores several geopolitical dynamics:

• Escalation of Cyber Warfare: The integration of cyber operations into traditional military strategies reflects a new dimension of conflict, complicating diplomatic relations and defense postures. (bdo.com.sg)

• Targeting of Critical Infrastructure: Attacks on energy and government sectors aim to disrupt national stability and can have cascading effects on regional security. (asec.ahnlab.com)

• Attribution Challenges: The use of sophisticated techniques and third-party services complicates the attribution process, making it difficult to hold state actors accountable.

Conclusion

State-sponsored cyber operations in Eastern Europe have intensified, with APT groups employing increasingly sophisticated methods to achieve strategic objectives. The evolving nature of these threats necessitates enhanced cybersecurity measures, international cooperation, and a nuanced understanding of the geopolitical landscape to effectively mitigate risks.

Highlights:

• Russian hackers target European firms with new spear-phishing cyberattacks, Published on Tuesday, February 24
• Chinese hackers hide malware within Windows and Google Drive to hit government targets, Published on Thursday, March 05