Russia, Chinese Hacking Buffets Europe

Nearly every member government of the European Union experienced a cyberattack from a nation-state hacker in the 12 months ending in July, primarily from Russian and Chinese threat actors who “steadily intensified” hacking, says the European cyber agency.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

The only member state with no public disclosure of an offensive cyber operation from hackers tied to a foreign power was Luxembourg – and that’s likely a case of under reporting, said the European Union Agency for Cybersecurity, or ENISA.

Between July 2024 and July 2025, ENISA recorded 46 nation-state-backed attacks, it said in its latest annual threat landscape report. These attacks accounted for 7.2% of known cyber incidents across the trading bloc, the report said.

“Russia-nexus intrusion sets continuously targeted EU member states in cyberespionage campaigns,” an agency spokesperson said. “Their offensive cyber activities focused heavily on public administration, diplomatic entities, defense and digital infrastructure.”

Attacks from Russian groups constituted roughly half of nation-state activities, ENISA said. Among the most active was a threat actor tracked as APT29, which is Russia’s Foreign Intelligence Service, as well as Units 26165 and 74455 of Russia’s General Staff Main Intelligence Directorate, popularly known as APT 28 and Sandworm, respectively.

Incidents include attacks against the European Space Agency and NATO partners by APT29 using compromised Microsoft infrastructure to steal remote desktop protocol credentials from the victims. In other cases, the hacking group impersonated Amazon and Microsoft domains to target EU foreign ministries, ENISA said.

The findings from ENISA come amid heightened risks of cyberattacks from Moscow against Western critical infrastructure, intended to weaken Europe’s support to Ukraine (see: France Says Russia Is Top Threat, Warns of ‘Open Warfare).

Similar concerns persist regarding Chinese hacking, which significantly spiked in recent months. The Dutch Military Intelligence and Security Service in June warned of heightened Chinese espionage targeting Dutch companies, including in the semiconductor industry (see: Dutch Minister Warns of Heightened Chinese Espionage Threats).

“The objectives of these campaigns pertain to strategic data collection and intellectual property theft,” the ENISA said. Chinese hacks accounted for 43% of nation-state hacks recorded during the study period.

Among Chinese-linked groups that attacked European governments are groups tracked as Mustang Panda and APT41, which targeted the maritime and shipping sectors. Other groups such as Liminal Panda, Locksmith Panda and Salt Typhoon targeted the telecommunication sector, the report said.

One hallmark of Chinese hackers is compromising edge devices and relying on operational relay boxes to conceal espionage operations. Chinese hacking groups rely on these tactics because they permit long-term strategic collection, including against critical infrastructure, researchers at French security firm Sekoia told Information Security Media Group.

“At the technical scale, it makes the attribution of a malicious campaign to a threat actor harder. At the political scale, it allows China to deny any aggressive intrusion against foreign networks for espionage purposes and to contest any technical evidence,” Sekoia researchers said.