On Friday, Czechia and Germany disclosed that they were the victims of a prolonged cyber espionage campaign orchestrated by the Russia-linked nation-state actor known as APT28. This revelation has drawn criticism from the European Union (E.U.), the North Atlantic Treaty Organization (NATO), the U.K., and the U.S.

The Czech Republic's Ministry of Foreign Affairs (MFA) stated that certain unnamed entities in the country were attacked using a security flaw in Microsoft Outlook, identified as CVE-2023-23397. This flaw, which has since been patched, could allow an adversary to access Net-NTLMv2 hashes and then use them to authenticate themselves via a relay attack.

Germany's Federal Government linked the same Outlook vulnerability to a cyber attack on the Executive Committee of the Social Democratic Party. This attack, which lasted a "relatively long period," compromised numerous email accounts.

APT28, believed to be connected to Military Unit 26165 of the Russian Federation's military intelligence agency GRU, is also known by several other names, including BlueDelta, Fancy Bear, and Forest Blizzard. The group has been accused of exploiting a Microsoft Windows Print Spooler component to deliver a previously unknown custom malware called GooseEgg to infiltrate various organizations.

According to a report from cybersecurity firm Trend Micro, the APT28 actors are believed to have used a botnet comprising hundreds of small office and home office (SOHO) routers in the U.S. and Germany to conceal their malicious activities.

Russian state-sponsored cyber threat activity, including data theft, destructive attacks, and influence operations, is expected to pose a significant risk to elections in regions like the U.S., the U.K., and the E.U.

Recent data from Cloudflare and NETSCOUT show a surge in DDoS attacks targeting Sweden following its acceptance to the NATO alliance, mirroring the pattern observed during Finland's NATO accession in 2023.

Government agencies from Canada, the U.K., and the U.S. have released a new joint fact sheet to help secure critical infrastructure organizations from continued attacks launched by apparent pro-Russia hacktivists against industrial control systems (ICS) and small-scale operational technology (OT) systems since 2022.

Recommendations to mitigate the threat include hardening human machine interfaces, limiting exposure of OT systems to the internet, using strong and unique passwords, and implementing multi-factor authentication for all access to the OT network.