State-Sponsored Cyber Operations in Eastern Europe: A 2026 Assessment

Introduction

As of March 2026, state-sponsored cyber operations in Eastern Europe have escalated, with Russian and Chinese threat actors targeting critical infrastructure and government entities. This briefing examines recent activities, tactics, and the evolving threat landscape.

Russian Cyber Operations

Targeted Sectors

Russian state-sponsored groups have primarily focused on:

• Energy Sector: In early 2023, Russian threat groups launched cyberattacks against Eastern Europe's energy industry, with Ukraine being a primary target. (scworld.com)

• Government Entities: The European Union Agency for Cybersecurity (ENISA) reported a significant increase in cyber operations targeting public institutions and critical infrastructure over the past year. (computing.co.uk)

Notable Threat Actors

• FROZENBARENTS: Operated by Russia's General Staff Main Intelligence Directorate (GRU), this group has conducted versatile cyber operations, including credential phishing and malware deployment, targeting sectors such as government, defense, energy, and transportation. (scworld.com)

• APT28 (Fancy Bear): Known for its cyber-espionage activities, APT28 has targeted Ukrainian entities, including government and military organizations, employing spear-phishing campaigns and malware. (scworld.com)

Chinese Cyber Operations

Targeted Sectors

Chinese state-sponsored groups have been active in:

• Government Entities: The group known as Silver Dragon has been conducting cyber-espionage campaigns targeting government entities in Eastern Europe, including Russia, Poland, Hungary, and Italy, since at least mid-2024. (techradar.com)

Tactics and Techniques

• Malware Deployment: Silver Dragon embeds malware within legitimate services such as Google Drive and Windows components, using a custom backdoor named GearDoor for command-and-control operations. (techradar.com)

• Evasion Strategies: The group employs sophisticated techniques to evade detection, disguising malicious activities within normal system operations and trusted platforms. (techradar.com)

Regional Cyber Defense Initiatives

In response to the escalating cyber threats, Eastern European nations have enhanced their cyber defense capabilities:

• Estonia: Established the Cyber Command in 2018, focusing on defensive and offensive cyber operations to protect national interests. (en.wikipedia.org)

• Albania: Formed the Military Cyber Security Unit in January 2024, dedicated to defending military networks and infrastructure against cyber threats. (en.wikipedia.org)

Conclusion

The cyber threat landscape in Eastern Europe remains high, with state-sponsored actors from Russia and China employing sophisticated tactics to target critical infrastructure and government entities. Continuous vigilance, enhanced cyber defense measures, and international cooperation are essential to mitigate these evolving threats.

Highlights:

• Chinese hackers hide malware within Windows and Google Drive to hit government targets, Published on Thursday, March 05
• Record number of UK businesses hit by nation state attacks as attackers weaponize AI, Published on Wednesday, March 18