Loading story…
Geopolitical tensions among major powers such as Russia, China, Iran, and North Korea are increasingly shaping the global cyber threat landscape, with organizations facing heightened risks due to shifting international relations, sanctions, and state-sponsored cyber activity. Businesses are now part of interconnected global ecosystems, where political developments can rapidly alter their exposure to cyber threats, necessitating the integration of geopolitical intelligence into cybersecurity risk assessments and operational decision-making.
In response to these evolving threats, NATO conducts annual large-scale cyber defense exercises, such as Cyber Coalition, to train and test the coordination of military cybersecurity personnel from member and partner nations. These exercises simulate hybrid cyberattacks on critical infrastructure in fictional scenarios that mirror real-world geopolitical conflicts, emphasizing the importance of international collaboration and information sharing to defend against sophisticated, state-aligned cyber adversaries.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
In 2025, NATO conducted its week-long Cyber Coalition exercise from Tallinn, Estonia, involving about 1,500 participants from 29 NATO members and seven partner countries. The exercise used seven concurrent fictional incident storylines covering attacks on critical infrastructure, backups, satellite communications, and a malware-affected fuel management system.
In 2022, the Russian cyberattack on Viasat became a major real-world inspiration for a later Cyber Coalition storyline focused on space-domain cyber incidents and satellite communications disruption.
NATO began its Cyber Coalition exercise in 2008 as an annual multinational cyber defense training event designed to improve coordination, information sharing, and trust across allied and partner nations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
bankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcerapid7.com
Open sourcerapid7.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Senior officials from the **EU, NATO, the United States, Sweden, Estonia, and Taiwan** used the Munich Cyber Security Conference to warn that cyber and “hybrid” operations are now a persistent feature of geopolitical competition and are increasingly aimed at **critical infrastructure** (energy, health, government services, satellites, and military command networks). EU Executive Vice President **Henna Virkkunen** argued Europe cannot be “naive” about adversaries’ ability to disrupt essential services and pointed to proposed revisions to the **EU Cybersecurity Act** intended to strengthen the EU cybersecurity agency and reduce critical ICT supply-chain risk, including phasing out designated **high-risk suppliers**. NATO Deputy Secretary General **Radmila Shekerinska** said Russia and China are challenging the alliance in both physical and digital domains and cited attempted disruptions to Poland’s energy infrastructure as an example of the threat environment. U.S. officials signaled a shift from primarily defensive “resilience” toward **deterrence** by “imposing real costs” on malicious actors, while also emphasizing deeper cyber partnerships with allies and industry to send a coordinated message to adversaries; National Cyber Director **Sean Cairncross** said a forthcoming U.S. cyber strategy will align with broader national security strategy and rely on whole-of-government tools. Estonia’s intelligence chief **Kaupo Rosin** urged Europe to invest in **homegrown offensive cyber capabilities** to reduce reliance on non-European tools, while Swedish defense official **Lisa Gustafsson** said societies must be designed to function under sustained disruption under Sweden’s “total defense” model. Taiwan’s National Security Council adviser **Yuh-Jye Lee** warned China may be rehearsing a “digital siege,” referencing activity like **Volt Typhoon** and reporting on alleged Chinese training infrastructure (“**Expedition Cloud**”) designed to simulate foreign power grids and communications networks; separate reporting also underscored that much of the technology stack underpinning cyber defense is controlled by **U.S. firms**, complicating sovereignty and supply-chain decisions.
Jun 29, 2026
Multiple nation-state actors, including China, Russia, Iran, and North Korea, are intensifying cyber operations targeting critical infrastructure, government entities, and private sector organizations worldwide. China-linked groups such as Ink Dragon have expanded espionage campaigns against European governments, while Russia-linked actors like Callisto have targeted NGOs and are implicated in disruptive attacks in Europe. Iran's MuddyWater has focused on critical infrastructure in Israel and Egypt, and North Korea is increasing disruptive attacks on various sectors. These activities are accompanied by sophisticated cybercrime campaigns, exploitation of zero-day vulnerabilities, and significant data breaches affecting sectors such as health, telecommunications, and justice. In response, Western governments and institutions are taking legal and policy actions, including EU sanctions and fines, UK and Polish legal proceedings against Russian actors, and increased attribution of attacks to state-sponsored groups. However, there is growing concern that U.S. cyber defenses are lagging behind adversaries, with strained mission capacity, weakened public-private collaboration, and unstable federal leadership. Experts call for renewed strategic focus, improved coordination with allies, and robust policy reforms to counter the persistent and evolving threat landscape posed by hostile nation-states.
Jun 29, 2026
Nations are increasingly integrating cyberspace into their military and national security strategies, developing both defensive and offensive capabilities to project power and protect their interests. Experts highlight that while technological advances in forensics and artificial intelligence have improved cyber defense, attributing responsibility for cyber operations remains a significant challenge. The formal recognition of cyberspace as a domain of warfare by organizations like NATO has led to the establishment of specialized units and procedures for both conducting and attributing cyber activities, often in coordination with other domains of conflict. Recent conflicts, such as the war in Ukraine, have demonstrated the evolving nature of offensive cyber operations, with countries like Ukraine leveraging both state and non-state actors to conduct attacks that target military and civilian infrastructure. These operations have sometimes challenged established international norms and legal frameworks, as seen in Ukraine's willingness to militarize hacktivist groups and target a broad range of assets to achieve strategic objectives. The adaptation of adversaries and the ongoing debate over responsible behavior in cyberspace underscore the complexity and high stakes of modern cyber conflict.
Jun 29, 2026