Loading story…
The Royal United Services Institute (RUSI) warned that fragmented European policies on technology suppliers leave critical infrastructure exposed to security and economic dependency risks, particularly from Chinese vendors such as Huawei and ZTE. Only 10 of 27 EU member states have fully implemented the voluntary EU Toolbox for 5G Security, and Germany and Spain retain substantial Chinese equipment in their 5G radio-access networks. RUSI said Chinese legal requirements enabling state access to company data and vulnerability information could give intelligence services privileged early access to exploitable flaws.
RUSI urged the EU to establish a harmonized, clearly defined framework for assessing high-risk vendors while preserving national-security autonomy and accounting for sector-specific risks. Proposed Cybersecurity Act amendments would identify untrusted vendors across 18 critical sectors and could require operators to remove their equipment within 36 months. The institute called for security-led procurement, but cautioned that blanket country or vendor bans do not eliminate product vulnerabilities and that dependency and surveillance risks can also apply to US suppliers.
See the reporting duties and controls this puts on the clock.
6 events from the most recent confirmed update back to the earliest known activity.
Salt Typhoon compromised US telecommunications networks. RUSI cited the attacks as evidence that networks using non-Chinese technology can also be vulnerable.
The EU introduced its voluntary 5G Security Toolbox to harmonize mitigation of 5G security risks across member states.
China threatened Germany with economic consequences during its debate over 5G suppliers. RUSI later cited the episode as an example of Beijing using technological and economic influence.
RUSI published a report calling for a bloc-wide vendor-risk assessment framework that preserves national-security authority and accounts for sector-specific risks, noting that only 10 of 27 member states had fully implemented the 5G Security Toolbox. It warned about Chinese government control, data access and privileged access to vulnerability reports, while cautioning that blanket vendor bans do not resolve underlying product-security weaknesses.
The European Commission proposed Cybersecurity Act amendments enabling designation of untrusted vendors for exclusion from networks in 18 critical sectors, with equipment replacement required within 36 months. It indicated that Huawei and ZTE would be proposed for the potential list if the amendments passed.
Spain awarded Huawei a contract involving storage of judicial wiretap recordings, intensifying debate over the company's role in the country.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The European Commission is pursuing revisions to the EU Cybersecurity Act to strengthen **union-level supply-chain risk management** for critical IT and telecom infrastructure, including the ability to impose targeted mitigations such as restrictions or bans on components from **“high-risk suppliers.”** Reporting indicates the proposal could effectively force member states to remove non-compliant equipment within a relatively short window—potentially **as little as three years**—as part of a broader effort to counter increasingly sophisticated hybrid threats to European infrastructure. The initiative is widely viewed as an attempt to harmonize and accelerate national actions that have been uneven across the bloc, amid long-running concerns about reliance on vendors such as **Huawei** and **ZTE** in 5G and other network deployments. The Commission’s approach emphasizes coordinated risk assessments and common rules for supplier trust decisions, reflecting ongoing debate over whether certain third-country suppliers could be compelled—via domestic legal obligations—to support state espionage or disruption operations, despite vendor denials of wrongdoing.
Jun 29, 2026
The European Commission unveiled a revised **EU Cybersecurity Act** proposal that would allow the bloc to identify and potentially exclude **“high-risk” suppliers**—including those deemed vulnerable to *third-country influence*—from critical digital infrastructure across **18 essential sectors**. The proposal also aims to streamline and accelerate EU-wide cybersecurity certification, reflecting a shift toward treating supply-chain security as both a technical and **geopolitical** risk-management issue. Reporting highlighted that the proposal, while not naming countries, is widely viewed as targeting Chinese vendors and supply dependencies—particularly around **network equipment** and connected energy technologies such as **solar inverters** that may connect to cloud services and create potential access paths into the energy grid. Separate coverage of the same Commission initiative noted plans to expand **ENISA’s** mandate, including closer operational cooperation with national authorities to help counter threats such as **ransomware**, but emphasized that the proposal still requires negotiation and approval by the European Parliament and member states before it can take effect.
Jun 29, 2026
The European Commission proposed revisions to the **EU Cybersecurity Act** aimed at strengthening EU-wide cybersecurity certification, tightening **ICT supply-chain risk management**, and improving protections for critical infrastructure, including measures affecting European **mobile telecommunications networks**. The changes are positioned to raise baseline security expectations for products and services used across the EU and to increase scrutiny of supply-chain dependencies in sensitive sectors. The proposed direction has also triggered geopolitical and industry pushback tied to potential **supply-chain restrictions**: reporting highlighted warnings from EU cyber leadership that Europe’s defenses are lagging, alongside China’s stated intent to take “necessary measures” to protect firms such as **Huawei** if the EU imposes new restrictions. Together, the coverage indicates the revised Act is not only a technical certification and resilience effort but also a policy lever likely to affect vendor access and procurement decisions in European critical and telecom infrastructure.
Jun 29, 2026