# Russia-linked actors target NATO energy infrastructure systematically

Published: 2026-04-16 · Severity: routine · Sectors: energy, infrastructure, government-national
Canonical: https://vorant.io/reports/5510d35a-c772-5264-87c6-ddde7379d7c7/russia-linked-actors-target-nato-energy-infrastructure-systematically

> Pro-Russian groups linked to Russian security services are conducting destructive cyberattacks against European critical infrastructure, with confirmed attacks on heating and power systems in Sweden, Poland, Norway, and Denmark designed to disrupt civilian energy supply without triggering military escalation.

Swedish authorities have publicly attributed a 2025 cyberattack on a western Swedish heating plant to pro-Russian groups with links to Russian security and intelligence services, marking the first official Swedish attribution of such activity to state-connected actors. This follows a December 2025 coordinated cyberattack against Poland's power grid that targeted wind and solar farms, combined heat and power plants, and industrial control systems, causing disruption to critical control systems and damage to equipment without triggering nationwide blackouts. The attacks represent a tactical shift toward targeting operational technology controlling physical infrastructure rather than traditional network denial-of-service, with similar incidents reported in Norway and Denmark.

These operations are framed by officials as part of Russia's "below threshold" warfare strategy—designed to pressure NATO members supporting Ukraine while avoiding triggering Article 5 responses. The attacks employ integrated cyber and physical disruption techniques, with timing coordinated (the Polish attack occurred during winter holidays) to maximize societal pressure. Over 150 documented incidents of sabotage, cyberattacks, and influence operations linked to Russia have occurred across Europe since 2022. Attribution analysis suggests involvement by Russian military intelligence (GRU) and potentially the Federal Security Service (FSB), though the operational landscape includes a complex ecosystem of state agencies, patriotic hackers, and cybercriminals operating with varying degrees of state direction and protection.

Defenders should recognize that these operations target supervisory control and data acquisition (SCADA) and industrial control systems in energy infrastructure, with a focus on degrading communication between assets and operators. Protective systems in both Sweden and Poland successfully prevented wider disruption, but the attacks demonstrate sustained reconnaissance and operational capability against critical infrastructure. European states are responding through accelerated civil preparedness initiatives, infrastructure protection frameworks, and public-private coordination mechanisms, while NATO and EU cooperation has deepened in response to the sustained campaign.

## Mentioned in this report

- Threat actors: Pro-Russian cyber groups, Russian Federal Security Service (FSB), Russian Military Intelligence (GRU)
- Campaigns: Russian below-threshold warfare against NATO members

## Detection guidance (public sample)

### SCADA/ICS Process State Monitoring via WMI or Registry Polling

ATT&CK: T0801

Detects persistent querying of SCADA process state through WMI event subscriptions or registry polling—typical reconnaissance of ICS asset health before disruption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SCADA/ICS Process State Monitoring via WMI or Registry Polling
description: Detects suspicious WMI event subscriptions or frequent registry queries
  targeting SCADA/ICS process monitoring. Attackers enumerate running processes and
  service states in energy infrastructure to plan disruption.
tags:
- attack.discovery
- attack.t0801
logsource:
  category: process_creation
  product: windows
detection:
  selection_wmi_subscription:
    Image|endswith: \wmic.exe
    CommandLine|contains:
    - event subscribe
    - process list
  selection_registry_query:
    Image|endswith:
    - \reg.exe
    - \powershell.exe
    CommandLine|contains:
    - HKLM\\SYSTEM\\CurrentControlSet\\Services
    - HKLM\\SOFTWARE\\Wow6432Node\\Services
  filter_admin_tools:
    ParentImage|endswith:
    - \System32\services.msc
    - \explorer.exe
  condition: (selection_wmi_subscription or selection_registry_query) and not filter_admin_tools
falsepositives:
- System administrators performing routine service health checks
- Legitimate monitoring agents querying process state
level: medium
id: edf80602-6be4-5df7-a0af-0663444263bb
status: experimental
author: Vorant
```

### Disk Wipe or Structure Corruption Attempt on Energy Infrastructure Host

ATT&CK: T1561.002

Detects low-level disk write operations or partition table manipulation targeting critical infrastructure systems—sign of destructive payload execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Disk Wipe or Structure Corruption Attempt on Energy Infrastructure Host
description: "Detects direct disk I/O operations (via cipher.exe, diskpart.exe, or\
  \ raw device writes) that could corrupt partition tables or wipe storage\u2014typical\
  \ final-stage destructive payload in energy infrastructure attacks."
tags:
- attack.impact
- attack.t1561.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_diskpart:
    Image|endswith: \diskpart.exe
    CommandLine|contains:
    - clean
    - delete partition
    - format
  selection_cipher:
    Image|endswith: \cipher.exe
    CommandLine|contains: '/w:'
  selection_raw_write:
    Image|endswith:
    - \dd.exe
    - \rawwrite.exe
    CommandLine|contains:
    - if=
    - of=\\.\\PhysicalDrive
  filter_admin_maintenance:
    ParentImage|endswith:
    - \System32\mmc.exe
    - \csrss.exe
  condition: (selection_diskpart or selection_cipher or selection_raw_write) and not
    filter_admin_maintenance
falsepositives:
- Legitimate disk formatting during asset decommissioning
- Windows secure-erase tools run by IT during routine sanitization
level: high
id: cee24a7b-2826-5e9b-8009-bff4097d1fb7
status: experimental
author: Vorant
```

### ICS Protocol Manipulation or Brute-Force I/O Commands

ATT&CK: T0806

Detects repeated or malformed industrial protocol commands (Modbus, DNP3, OPC) or high-volume I/O requests targeting SCADA devices—reconnaissance or disruption of sensor/actuator communication. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ICS Protocol Manipulation or Brute-Force I/O Commands
description: Detects network traffic patterns consistent with brute-force or fuzz
  testing of industrial control protocols (Modbus, DNP3, OPC-UA) used in energy infrastructure.
  High-frequency malformed or repeated read/write commands indicate pre-attack reconnaissance
  or disruption.
tags:
- attack.discovery
- attack.impact
- attack.t0806
logsource:
  category: network_connection
  product: windows
detection:
  selection_modbus:
    DestinationPort: 502
    Protocol: tcp
  selection_dnp3:
    DestinationPort: 20000
    Protocol: tcp
  selection_opc:
    DestinationPort:
    - 135
    - 912
    Image|endswith:
    - \python.exe
    - \powershell.exe
  filter_scada_admin:
    SourceIpaddr|startswith:
    - 192.168.
    - '10.'
    User|contains: admin
  condition: (selection_modbus or selection_dnp3 or selection_opc) and not filter_scada_admin
falsepositives:
- Legitimate SCADA engineering workstations communicating with field devices
- Industrial automation testing tools used during system maintenance
level: medium
id: 1dcdf64b-bb32-5771-9fa2-d02d16cf245f
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/dispatches/dispatches-from-the-front-lines-of-russia-linked-cyberattacks-on-europe

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/5510d35a-c772-5264-87c6-ddde7379d7c7/russia-linked-actors-target-nato-energy-infrastructure-systematically.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup