Ready to bolster your defenses
Uncover how we can help put your resilience to the test.
This site uses cookies to enhance your browsing experience and analyze site usage. By continuing, you agree to our use of cookies. Read our Privacy Policy
For most ofthe history of cyber warfare, there has been a comforting illusion that theinternet has borders.
However, itdoesn't. So let’s talk about it.
A powerplant in Poland, a water utility in Denmark, a government network in Germany ora railway system somewhere in Western Europe can be thousands of kilometresfrom the battlefield in Ukraine and still become part of the conflict.
Theunfortunate reality is becoming increasingly difficult for European governmentsand critical-infrastructure operators to ignore.
SinceRussia's full-scale invasion of Ukraine in 2022, European authorities havedocumented an expanding combination of cyberattacks, sabotage, disruption,information operations and other hybrid activity directed at European statessupporting Ukraine. The European Union says Russian hybrid activity hasintensified since the invasion and includes cyberattacks, sabotage of criticalinfrastructure, information manipulation and attempts to undermine democraticprocesses.
Thebattlefield may be in Ukraine.
Theattack surface is Europe.
Cyberwar Doesn't Need a Battlefield
One ofthe most important developments in the current threat landscape is the blurringof the traditional distinction between military targets and civilianinfrastructure.
Criticalinfrastructure has always been attractive to attackers because of its potentialimpact to,
· Powergeneration and distribution
· Water
· Transportation
· Transit
· Telecommunications
· Foodsupply and distribution
· Industrialsystems
thatunderpin almost every other part of society.
Disruptone component and the consequences can extend far beyond the organization thatwas initially compromised, including aspects of logistics and supply chains, disruptionto financial systems and societal impact to the targeted regions.
This isparticularly important during geopolitical conflict.
Anattacker doesn't necessarily need to destroy a power station to createstrategic consequences. Disrupting operations, compromising sensitiveinformation, temporarily taking services offline or demonstrating access to animportant system can itself create uncertainty.
The EUhas explicitly identified threats to critical infrastructure as part ofRussia's broader hybrid campaign against European states.
AndEuropean governments are increasingly treating the problem accordingly.
In July2026, the European Commission issued guidance specifically addressing theresilience of critical infrastructure against a range of disruptive threats,including cyberattacks, drone attacks and other hybrid and antagonisticthreats.
Thisultimately has become a warning.
Criticalinfrastructure is no longer simply a cybersecurity problem. It is anational-security problem.
From DDoSto Disruption
One ofthe more interesting changes is the evolution of the actors involved.
Early inthe war, much of the highly visible activity consisted of only three things: distributeddenial-of-service attacks, website defacements and hacktivist campaigns.
Thoseattacks can certainly cause disruption, but they are generally very differentfrom obtaining persistent access to an operational environment.
Thatdistinction matters, ….
In July2026, the EU publicly identified what it described as a Russian cyber ecosysteminvolving intelligence services, cybercriminal groups, hacktivists and privatecompanies.
Accordingto the EU, Russian-linked activity has included infiltration of governmentnetworks and sabotage of critical infrastructure in multiple Europeancountries. The EU specifically cited disruptive operations against criticalinfrastructure in Poland, including combined heating and power plants.
The EUalso sanctioned the pro-Russian hacktivist group Cyber Army of Russia Reborn(CARR) and described sustained DDoS campaigns targeting governments, financialinstitutions, media organizations and critical infrastructure in countriessupporting Ukraine.
Thisillustrates an important point for defenders:
The modernthreat isn't necessarily one neatly identifiable hacking group.
It is anecosystem!
Stateintelligence organizations, criminal infrastructure providers, hacktivists andother actors can occupy different positions within the same broader threatenvironment.
Thatmakes attribution *ahem* defences considerably more complicated.
The OT Problem
Forcybersecurity professionals, perhaps the most concerning part of this evolutionis the increasing attention being paid to operational technology (OT) by thethreat ecosystem.
1. IT environments contain data.
2. A compromised email account is a serious problem.
vs.
3. OT environments can control physical processes.
4. A compromised industrial-control environment canbecome a safety, operational or public-service problem.
Powergeneration, water treatment, transportation, manufacturing, agriculture, food distributionand other critical services increasingly depend on interconnected industrialsystems. Those systems were never designed with today's geopolitical threatenvironment in mind.
Many weredesigned around a fundamentally different (yet flawed) assumption:
If youcan reach the control network, you're probably supposed to be there.
Modernsecurity architecture has changed considerably, but legacy systems, remoteaccess, third-party connections and complex industrial environments continue tocreate challenges.
This isone reason European governments are increasingly emphasizing resilience ratherthan simply prevention.
Youcannot realistically assume that every intrusion will be stopped. You have torealistically assume and accept that you will be compromised. And in fact youmight already be and not know it!
The moreuseful question becomes:
Whathappens when something gets through?
Poland: TheImportant Warning
Polandprovides an especially interesting case study because of its geographicposition and its role as a major logistical hub for support to Ukraine.
The EU'sJuly 2026 assessment specifically identified disruptive Russian-linked activityagainst Polish critical infrastructure.
Thatmatters because critical infrastructure does not exist in isolation and Adisruption to an energy system can affect transportation.
Atransportation disruption can affect logistics.
Atelecommunications disruption can interfere with emergency response.
Anddisruption to any of these systems can have consequences for military mobilityand broader national resilience.
TheEuropean Union demonstrated how seriously it views this interconnectednessduring Cyber Europe 2026, an EU-wide exercise involving roughly 5,000 experts.
Theexercise simulated attacks against European railway and maritime networks andexamined how a cyber incident could escalate into a broader operational crisis.Importantly, the scenario recognized that disruption to transportation canaffect trade, military mobility and crisis response simultaneously.
In otherwords, the attack doesn't have to hit the military.
Theinfrastructure supporting the military may be enough.
The Hybrid Attack Is BiggerThan the Cyber Operations
Cyberattacksincreasingly exist alongside other forms of pressure.
TheEuropean External Action Service describes today's hybrid environment asincluding cyberattacks, information manipulation, sabotage, damage to underseainfrastructure, Data Centres and other forms of hostile activity.
Thatchanges how security teams need to think.
Imagine ahypothetical scenario:
Atelecommunications provider experiences a cyberattack.
Atapproximately the same time, suspicious activity is detected around physicalinfrastructure.
Asocial-media campaign begins claiming that critical services are failing.
Falseinformation spreads faster than the technical team can determine exactly whathappened.
Thetechnical incident may eventually be contained.
But thepsychological and operational consequences may continue.
That'sthe power of hybrid operations.
Theobjective isn't necessarily one spectacular cyberattack. It can be thecumulative effect of several smaller disruptions.
Why Attribution Is Still Sodamn hard
There isanother problem lurking underneath all of this: who really launched the cyber operation?
Moderncyber operations can involve infrastructure rented or purchased from criminalproviders, compromised servers, proxy networks, hacktivist personas and groupsoperating with varying degrees of state direction or support.
Thatcreates plausible deniability.
It alsocreates an attribution nightmare!
The EU'sJuly 2026 statement specifically described a Russian ecosystem involving stateand non-state actors, including intelligence services, cybercriminals,hacktivists and private companies.
Fordefenders, that means attribution shouldn't be the prerequisite for response.
If autility detects an intrusion into an OT environment, waiting until someone canconclusively determine whether the attacker is a Russian intelligence service,a criminal group or a patriotic hacktivist collective may be too late.
Thepriority has to be and I must add in this order:
Detect.Contain. Recover. Then attribute.
On September27, 2026, Russia struck the headquarters of Kyivstar, Ukraine's largest mobileoperator, while also targeting Ukrainian data centres and communicationsinfrastructure. Russia's Defence Ministry said it had struck a data centrebelonging to Vodafone Ukraine, the country's second-largest mobile provider.
Theattacks appear to be part of a broader pattern. According to Ukraine's DigitalMinistry, Russian strikes against internet-provider data centres during thepreceding week caused outages affecting around 100,000 households in Kyiv andthe surrounding region. Ukrainian officials said the targeting of major datacentres was intended to disrupt the flow of information.
There isan important caveat: Russia says it is targeting military-relatedinfrastructure, and Reuters could not independently verify all of the RussianDefence Ministry's claims about specific targets.
Ddddd16f[[[[[[ik
Europe's Cyber Defences Changing
Europeangovernments aren't ignoring the problem.
The EUhas expanded its mechanisms for responding to cyber and hybrid threats, whileNATO has also publicly condemned Russian malicious cyber activity targetingAllied and partner countries.
In July2026, NATO stated that Russian cyber activity was targeting critical nationalinfrastructure and government entities and said the Alliance had strengthenedits cyber posture to integrate cyber effects into NATO operations and missions.
Meanwhile,the European Commission's resilience guidance emphasizes not just preventionbut also physical protection, mitigation, recovery and organizationalresilience.
That's animportant shift.
Cybersecuritytraditionally asks:
How do westop the attacker?
Resilienceasks:
Whathappens when the attacker succeeds?
Thesecond question is becoming just as important as the first. Russia hasdeveloped substantial undersea capabilities through GUGI — the Main Directorateof Deep-Sea Research. Open-source assessments describe GUGI as havingcapabilities relevant to things like, seabed mapping, surveillance,interception and potentially damaging underwater infrastructure. Russia alsooperates specialised vessels and submersibles capable of operating aroundsubsea infrastructure.
And FYI,this isn't purely theoretical anymore.
In theBaltic, there have been repeated incidents involving damaged telecommunicationsand energy cables. NATO has explicitly described the combination of cyberattacks,sabotage and attacks against critical infrastructure as part of the broaderhybrid-threat environment, while investigations into individual cable incidentshave often remained unresolved or contested.
Russia has warned that European factories producing weapons for Ukraine could be considered legitimate military targets.
WhatCritical-Infrastructure Operators Should Have this on their minds
Fororganizations operating critical services, the current environment suggestsseveral priorities which are listed below.
1. Assume compromise is possible
Perimetersecurity remains important, but organizations should plan around thepossibility that an attacker eventually obtains legitimate credentials orreaches an internal system.
2. Separate IT and OT wherever possible
We know segregation/segmentationisn't glamorous, but neither is explaining to the CEO why someone whocompromised an employee's laptop was suddenly able to communicate with anindustrial control system, leading to a failure in supplying power or water.Insert shrugging emoji.
3. Monitor remote access aggressively
VPNs,remote-management platforms, vendor connections and privileged accounts remainattractive paths into environments that were never intended to be directlyexposed.
4. Know your dependencies
Organizationsshould understand which third-parties, cloud services, telecommunicationsproviders, software vendors and infrastructure dependencies they rely on.
Yourorganization might have excellent security.
Yourcritical supplier might not.
5. Practice recovery—not just detection
Backupsare critical.
Testedbackups are considerably more useful.
Incident-responseplans should include scenarios involving prolonged outages, compromisedadministrative credentials and loss of access to critical systems.
6. Treat physical and cyber security as connected
Acyberattack doesn't necessarily arrive alone.
Organizationsshould consider how cyber incidents could coincide with physical intrusion,sabotage, drone activity or misinformation.
7. Don't ignore the boring stuff
Attackersdon't always need a revolutionary zero-day.
Stolencredentials, exposed remote services, weak segmentation and poor privilegemanagement remain extremely useful.
Thecybersecurity industry has spent years waiting for the next exotic attack.
Sometimesthe most dangerous attack is still someone finding the password tapedunderneath the metaphorical keyboard.
8. Anticipate the compromise
Beproactive and attempt to anticipate the compromised to shore up defences beforeit happens.
Thisneeds to be based on evidentiary decision-making, understanding goals,tradecraft and where possible the anticipation of offences so, and this iscritical,
Worktogether and collaborate, share data, experiences where possible to enrich theecosystem of the defenders.
The NewFrontline
The mostimportant lesson from the Ukraine conflict may not be that cyberwar hasreplaced conventional warfare.
Ithasn't.
It isthat cyber operations have become another layer of modern conflict.
Russia'swar against Ukraine has demonstrated how cyber operations can operate alongsidemilitary action, espionage, sabotage, information operations and other forms ofpressure.
Andincreasingly, that activity doesn't stop at Ukraine's borders.
Europeangovernments are now publicly describing Russian cyber and hybrid activityagainst their own infrastructure, while NATO and the EU are treating attacksagainst critical infrastructure as a broader security concern.
Fordefenders, this changes the equation.
Thequestion is no longer simply:
“Cansomeone hack us?”
Instead,the question is,
“If we'retargeted during a geopolitical crisis, what happens next?”
Becausethe new cyber frontline isn't necessarily a military network; it could be thepower grid, The water plant, the railway, The port. Or The telecommunicationsprovider.
Andincreasingly, anything connected to the systems that keep a country running, …
So, itcomes down to this: The battlefield may remain in Ukraine But theinfrastructure supporting Europe is increasingly part of the war's cybershadow.
Uncover how we can help put your resilience to the test.
