Russia-linked actors target NATO energy infrastructure systematically
Pro-Russian groups linked to Russian security services are conducting destructive cyberattacks against European critical infrastructure, with confirmed attacks on heating and power systems in Sweden, Poland, Norway, and Denmark designed to disrupt civilian energy supply without triggering military escalation.
Sourceatlanticcouncil.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Swedish authorities have publicly attributed a 2025 cyberattack on a western Swedish heating plant to pro-Russian groups with links to Russian security and intelligence services, marking the first official Swedish attribution of such activity to state-connected actors. This follows a December 2025 coordinated cyberattack against Poland's power grid that targeted wind and solar farms, combined heat and power plants, and industrial control systems, causing disruption to critical control systems and damage to equipment without triggering nationwide blackouts. The attacks represent a tactical shift toward targeting operational technology controlling physical infrastructure rather than traditional network denial-of-service, with similar incidents reported in Norway and Denmark.
These operations are framed by officials as part of Russia's "below threshold" warfare strategy—designed to pressure NATO members supporting Ukraine while avoiding triggering Article 5 responses. The attacks employ integrated cyber and physical disruption techniques, with timing coordinated (the Polish attack occurred during winter holidays) to maximize societal pressure. Over 150 documented incidents of sabotage, cyberattacks, and influence operations linked to Russia have occurred across Europe since 2022. Attribution analysis suggests involvement by Russian military intelligence (GRU) and potentially the Federal Security Service (FSB), though the operational landscape includes a complex ecosystem of state agencies, patriotic hackers, and cybercriminals operating with varying degrees of state direction and protection.
Defenders should recognize that these operations target supervisory control and data acquisition (SCADA) and industrial control systems in energy infrastructure, with a focus on degrading communication between assets and operators. Protective systems in both Sweden and Poland successfully prevented wider disruption, but the attacks demonstrate sustained reconnaissance and operational capability against critical infrastructure. European states are responding through accelerated civil preparedness initiatives, infrastructure protection frameworks, and public-private coordination mechanisms, while NATO and EU cooperation has deepened in response to the sustained campaign.
Mentioned in this report
Detection guidance
Disk Wipe or Structure Corruption Attempt on Energy Infrastructure Host
A behavioural hunt for the technique in general.
Detects low-level disk write operations or partition table manipulation targeting critical infrastructure systems—sign of destructive payload execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Disk Wipe or Structure Corruption Attempt on Energy Infrastructure Host
description: "Detects direct disk I/O operations (via cipher.exe, diskpart.exe, or\
\ raw device writes) that could corrupt partition tables or wipe storage\u2014typical\
\ final-stage destructive payload in energy infrastructure attacks."
tags:
- attack.impact
- attack.t1561
logsource:
category: process_creation
product: windows
detection:
selection_diskpart:
Image|endswith: \diskpart.exe
CommandLine|contains:
- clean
- delete partition
- format
selection_cipher:
Image|endswith: \cipher.exe
CommandLine|contains: '/w:'
selection_raw_write:
Image|endswith:
- \dd.exe
- \rawwrite.exe
CommandLine|contains:
- if=
- of=\\.\\PhysicalDrive
filter_admin_maintenance:
ParentImage|endswith:
- \System32\mmc.exe
- \csrss.exe
condition: (selection_diskpart or selection_cipher or selection_raw_write) and not
filter_admin_maintenance
falsepositives:
- Legitimate disk formatting during asset decommissioning
- Windows secure-erase tools run by IT during routine sanitization
level: high
id: cee24a7b-2826-5e9b-8009-bff4097d1fb7
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.atlanticcouncil.org/dispatches/dispatches-from-the-front-lines-of-russia-linked-cyberattacks-on-europe
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the actors and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs