State-Sponsored Cyber Operations Intensify in Eastern Europe Amid Rising Geopolitical Tensions

Overview

In early 2026, Eastern Europe has witnessed a significant uptick in state-sponsored cyber operations, primarily attributed to Russian Advanced Persistent Threat (APT) groups. These activities have targeted critical infrastructure, government entities, and private sector organizations, underscoring the region's heightened vulnerability amid escalating geopolitical tensions.

Attribution and Threat Actors

APT28 (Fancy Bear), a Russian state-sponsored hacking group, has been notably active in the region. In February 2026, APT28 launched "Operation MacroMaze," a sophisticated spear-phishing campaign targeting organizations in Western and Central Europe. The campaign utilized personalized emails containing malicious Microsoft Word documents with embedded macros, leading to the deployment of multi-stage malware designed to steal information and establish persistent access. (techradar.com)

APT29 (Cozy Bear) has also been implicated in cyber activities targeting European entities. In February 2026, reports indicated that APT29 exploited vulnerabilities in Microsoft Office to deliver email-stealing and backdoor malware, enabling data theft and remote access. This campaign, known as "Operation Neusploit," demonstrated APT29's rapid adoption of newly disclosed vulnerabilities and its focus on Central and Eastern Europe. (cert.europa.eu)

Targeted Sectors and Impact

The primary targets of these cyber operations include:

• Critical Infrastructure: Attacks have been directed at energy sectors, transportation networks, and telecommunications, aiming to disrupt essential services and instill public fear.

• Government Entities: Cyber intrusions into government networks have been reported, with the intent to steal sensitive information and potentially manipulate political processes.

• Private Sector Organizations: Businesses, particularly those in defense, technology, and research sectors, have been targeted to gain access to proprietary data and intellectual property.

Notable Incidents

• 2025 Cyberattack on Polish Power Grid: In December 2025, a cyberattack targeted Poland's power grid, affecting renewable energy plants and a combined heat and power plant. The attack was attributed to Russian APT group Berserk Bear, highlighting the threat to critical infrastructure in the region. (en.wikipedia.org)

• Signal Messenger Phishing Campaign: In February 2026, a sophisticated phishing campaign impersonating Signal's support bot targeted high-profile figures across Europe, including politicians, military personnel, and journalists. The attackers aimed to steal sensitive information by deceiving users into re-entering PINs or re-registering devices. (cert.europa.eu)

Geopolitical Context

These cyber operations are part of a broader strategy of hybrid warfare, where digital attacks complement traditional military actions. The European Union and NATO have condemned these activities, emphasizing the need for a coordinated response to safeguard democratic institutions and critical infrastructure. (euronews.com)

Conclusion

The escalation of state-sponsored cyber operations in Eastern Europe reflects a concerning trend in modern geopolitical conflicts. The integration of cyber capabilities into statecraft necessitates enhanced cybersecurity measures, international cooperation, and a comprehensive understanding of the evolving threat landscape to effectively mitigate risks and protect national interests.

Highlights:

• Russian hackers target European firms with new spear-phishing cyberattacks, Published on Tuesday, February 24
• Record number of UK businesses hit by nation state attacks as attackers weaponize AI, Published on Wednesday, March 18