Loading story…
The European Commission unveiled a revised EU Cybersecurity Act proposal that would allow the bloc to identify and potentially exclude “high-risk” suppliers—including those deemed vulnerable to third-country influence—from critical digital infrastructure across 18 essential sectors. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and geopolitical risk-management issue.
Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around network equipment and connected energy technologies such as solar inverters that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand ENISA’s mandate, including closer operational cooperation with national authorities to help counter threats such as ransomware, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After the EU proposals were unveiled, China criticized the planned restrictions on suppliers such as Huawei and ZTE as protectionist. A Chinese foreign ministry spokesperson said Chinese companies had not endangered Europe's national security.
The Commission's proposal introduced mechanisms to identify and restrict or phase out high-risk third-country suppliers from critical digital infrastructure, including telecom networks. Member states would be required to derisk mobile networks, and operators could be given up to three years to remove components from suppliers deemed to pose significant cybersecurity risk.
On 2026-01-20, the European Commission presented draft revisions to the EU Cybersecurity Act and related NIS framework to strengthen EU cyber resilience. The package proposed faster certification, expanded ENISA responsibilities, improved ransomware reporting and response, and a new supply-chain security framework.
In September 2025, a malware attack on an IT service provider caused days of passenger and baggage handling disruptions at airports including Berlin, Brussels, Dublin, and London Heathrow. The incident was cited as an example of the real-world impact of ransomware and related cyberattacks on essential services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcetherecord.media
Open sourcetechrepublic.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen **union-level supply-chain risk management** for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from **“high-risk suppliers.”** Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially **as little as three years**—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure. The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as **Huawei** and **ZTE** in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Jun 29, 2026
The European Commission proposed revisions to the **EU Cybersecurity Act** aimed at strengthening EU-wide cybersecurity certification, tightening **ICT supply-chain risk management**, and improving protections for critical infrastructure, including measures affecting European **mobile telecommunications networks**. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors. The proposed direction has also triggered geopolitical and industry pushback tied to potential **supply-chain restrictions**: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as **Huawei** if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.
Jun 29, 2026
The European Commission has frozen funding for solar energy projects that use key components from Chinese suppliers, particularly inverters, citing cybersecurity risks to critical infrastructure. The restriction applies to projects financed by the European Investment Bank and partner banks, and officials warned that inverters from high-risk suppliers could be used to manipulate electricity production parameters, disrupt generation, access operational data without authorization, or remotely shut down systems in ways that could contribute to large-scale blackouts. The move comes as the EU prepares revisions to the Cybersecurity Act that could enable broader market restrictions or bans on inverters from high-risk suppliers. While officials did not publicly name a company, reporting identified **Huawei** as the likely focus because of China’s high-risk classification and the company’s strong position in the inverter market. The decision also reflects wider concern that Europe’s clean-energy transition is creating strategic dependence on Chinese technology, prompting countries including **Lithuania** and **France** to tighten limits on Chinese participation in solar supply chains.
Jun 29, 2026