Overview
For nearly four decades, Moscow-linked operators—from late–Soviet–era spies to today’s GRU and SVR–aligned teams—have used cyberspace to surveil, disrupt, and pressure European states that support Ukraine. Their campaigns range from classic espionage and supply-chain compromises to industrial sabotage, satellite comms takedowns, and mass-market hacktivist DDoS. Together, they form a through-line of “hybrid” power: cheap, deniable, and calibrated to create outsized political and economic effects across NATO and the EU.
From “Cuckoo’s Egg” to Hybrid War: A Brief Lineage
-
Late Cold War origins (1986–1990). The landmark “Cuckoo’s Egg” case tracked West German hackers selling stolen military data to the KGB—a template for state-tasked cyber-espionage against NATO institutions and partners.
-
Wake-up calls in the EU/NATO east (2007–2008). After political disputes with Russia, Estonia endured weeks of DDoS that knocked government, banking, and media services offline; the episode accelerated NATO’s cyber posture and led to the CCDCOE in Tallinn. In Georgia, coordinated cyberattacks accompanied Russia’s invasion, isolating ministries and broadcasters.
Playbook Since 2014: Espionage, Disruption, and Signaling
1) Industrial-scale disruption and spillover
-
NotPetya (2017): Launched via Ukraine’s M.E.Doc update servers, this GRU-linked wiper devastated firms worldwide (e.g., Maersk, Merck, Mondelez), causing billions in losses and demonstrating how an operation aimed at Ukraine could clobber EU supply chains.
-
Ukrainian grid attacks (2015, 2016, 2022): The Sandworm unit repeatedly hit power utilities (BlackEnergy/Industroyer/Industroyer2), pioneering malware that talks directly to substation equipment—tactics with obvious implications for European grids.
2) Striking Europe’s satellites and logistics
-
Viasat KA-SAT (Feb 24, 2022): A modem-wiper (AcidRain) disrupted satellite broadband across Europe on day one of the full-scale invasion, severing remote control to 5,800 Enercon wind turbines in Germany—a proof-of-concept for striking EU infrastructure indirectly.
-
Targeting Western supply lines (2025): A joint US/UK/EU advisory warned that GRU Unit 26165 (APT28)has focused on logistics and tech firms supporting aid flows to Ukraine, weaponizing Microsoft Outlook credential theft (CVE-2023-23397).
3) Systematic campaigns against EU/NATO governments
-
Germany (2015–2024): The Bundestag breach led to an arrest warrant and EU sanctions on a GRU operator; Berlin later attributed a 2023 campaign against the governing SPD and defence/aerospace targets to APT28 exploiting Outlook.
-
Czechia (2023–2024): Prague reported GRU/APT28 operations abusing the same Outlook bug against ministries and critical institutions, coordinated with allied condemnations.
-
France (2020–2025): Paris publicly attributed multi-year intrusions at a dozen entities to APT28, detailing TTPs (phishing, CVE-2023-23397, brute-forcing) across government and OT networks.
4) Hacktivist auxiliaries and noise
Pro-Russia collectives such as Killnet and NoName057(16) flood EU and NATO sites with DDoS to signal displeasure (e.g., Lithuania over Kaliningrad transit), while law enforcement rolls up their infrastructure when possible.
Why These Operations Matter
-
They punch through civilian life. Power outages, frozen ports, grounded logistics, and disabled satellite modems translate to real European costs—Merck’s 2017 losses alone were ~$670M, and shipping and food multinationals absorbed heavy disruption.
-
They target the arteries of aid. Intelligence and incident data since 2022 show a consistent Russian focus on states moving materiel to Ukraine—Poland, Germany, the Baltics, and others—via espionage, credentials theft, and supplier compromise.
-
They blur the line between sabotage and war crimes. The International Criminal Court is weighing whether cyberattacks on civilian infrastructure during the war meet the threshold for prosecution—an unprecedented step.
Tactics at a Glance
-
Zero-days & credentialing (e.g., Outlook CVE-2023-23397): “No-click” NTLM hash theft to pivot into European ministries, parties, and defence suppliers.
-
Supply-chain compromises (M.E.Doc/NotPetya) and satellite comms wipers (AcidRain/Viasat) that cause regional disruption from a single upstream hit.
-
ICS-specific malware (Industroyer/2) to manipulate substations—the most escalatory, least deniable class of tools seen so far.
-
DDoS and information ops by proxy groups to harass, distract, and shape public narratives across ally states.
European Responses So Far
-
Attribution and sanctions. Germany, France, Czechia, the UK, NATO, and the EU have issued coordinated attributions and sanctions, naming APT28 and GRU Unit 26165.
-
Operational takedowns. Europol’s 2025 Operation Eastwood disrupted NoName057(16) infrastructure in multiple jurisdictions.
-
Collective defense & capacity building. The CCDCOE and national CSIRTs now share playbooks at speed; major vendors report sustained Russian focus on European targets backing Ukraine.
What to Watch (Next 12–18 Months)
-
Logistics & energy: More credential-theft against forwarders, rail, ports, and grid operators in countries routing aid or hosting training missions.
-
Satcom & OT: Follow-on attempts to revisit satellite terminals and industrial gateways exposed during 2022–2024.
-
Political seasons: Phishing and leak-and-spin ops against parties and ministries ahead of national and EU votes; Outlook/Exchange-adjacent exploits remain attractive.
Practical Takeaways for EU/NATO Organizations
-
Assume compromised credentials. Enforce phishing-resistant MFA, Exchange/Outlook hardening (patch CVE-2023-23397 and monitor for NTLM anomalies), and segment admin paths.
-
Model satcom/ICS dependencies. Treat satellite terminals, remote substations, and vendor access as “crown-jewel” assets; require signed updates and out-of-band kill switches.
-
Plan for DDoS + narrative ops. Pre-arrange scrubbing, static fallbacks for public services, and comms drills for info-ops spillovers.
Bottom line: Russia’s modern cyber campaigns inherit a Soviet-era appetite for espionage and coercion, updated with industrial wipers, satellite hacks, and a stable of deniable “patriotic” auxiliaries. For Europe’s NATO and EU partners supporting Ukraine, this is not a sideshow to the shooting war; it is one of its primary fronts.
