Google Warns of Escalating State-Backed Cyber-Espionage Targeting Europe’s Defense Industrial Base

Google’s Threat Intelligence Group reported an intensifying, state-backed cyber-espionage campaign against Western defense companies—particularly across Europe—describing a “constant, multi-vector siege” aimed at stealing sensitive R&D, disrupting production, and gaining insight into next-generation battlefield systems. The report highlights drone manufacturers and advanced weapons developers as priority targets, with Russia-linked activity emphasized in the context of the war in Ukraine and a focus on unmanned aircraft technologies and their suppliers. Google attributed one phishing campaign to UNC5976, which used malicious Remote Desktop Protocol (RDP) files and spoofed domains impersonating defense firms across multiple countries.

Google assessed that multiple state actors—Russia, Iran, China, and North Korea—are leveraging a broad set of access paths, including exploitation of hiring processes, personal accounts, and remote work environments, while smaller manufacturers and adjacent suppliers are also seeing extortion attempts, indicating widening supply-chain pressure. Separate reporting also described leaked documents indicating China has used a training platform (Expedition Cloud, developed by CyberPeace) to rehearse critical-infrastructure intrusions against neighboring countries by building network “templates” of targets and running reconnaissance-to-attack drills, underscoring the operational maturity and preparation that can translate into real-world campaigns against high-value sectors such as defense and critical infrastructure.