Russian and Chinese cyberattacks on European defense companies: What has happened and why it is relevant to the sector

Recently, the Google Threat Intelligence Group (GTIG) has warned of an increase in cyberattacks aimed at companies in the European defense sector, especially those involved in next-generation technologies such as drones. These attacks, driven primarily by state actors from Russia and China, are seriously affecting the information security and critical operations of these organizations.

The report highlights that the defense sector has become a priority objective due to its central role in current geopolitics and the development of advanced military technologies. As attackers intensify their approach, defense companies must urgently reinforce their cybersecurity systems to protect against this “constant siege.”

What is known about the cyberattack?

According to the report, cyberespionage campaigns have been carried out by groups such as UNC5976, linked to Russia, and Chinese actors, who use various tactics to compromise the networks of defense companies. Here are the most relevant details:

• Phishing and impersonation: Attackers have deployed hundreds of counterfeit domains to impersonate defense providers, using phishing techniques aimed at key personnel. This has allowed access to sensitive systems and critical data from defense contractors in several European countries.
• Objectives of the attackers: In particular, the attackers' focus has been on the theft of drone algorithms and routes, technologies essential to modern defense, which could jeopardize the security of military operations.
• Exploitation of personal vulnerabilities: Instead of focusing solely on corporate networks, attackers have also directed their efforts towards personal communications of employees, such as emails and data related to hiring processes.

Why are defense companies an attractive target?

The defense sector is a recurring target for cybercriminals for several key reasons:

• Critical infrastructures: Defense companies manage advanced technologies, such as drone systems, that are highly sensitive and crucial to national security.
• High dependence on the supply chain: The defense industry depends on a complex network of suppliers, many of whom have access to critical data, increasing the risk of a supply chain attack.
• Geopolitical risks: State actors, such as Russia and China, have strategic motivations to gain access to defense information, making this sector a key target.

How do these types of attacks occur?

Although each incident is unique, cyberattacks aimed at defense companies follow common patterns. The primary causes of these attacks include:

1. Targeted phishing: Cybercriminals target high-level employees or technical staff through personalized malicious emails.
2. Exploitation of personal devices: Attackers exploit weaknesses in employees' personal devices to access internal networks.
3. Impersonation: The creation of falsified websites allows attackers to deceive employees and obtain access credentials.

Key lessons for companies in the defense sector

This type of cyberattack leaves several important lessons for companies in the defense sector:

• Prevention is essential: Regular vulnerability audits and analysis is key to reducing the risk of attacks.
• The protection of personal communications: Employees must be aware of the importance of protecting not only corporate networks, but also their personal devices.
• Continuous monitoring: Implement monitoring systems to detect suspicious activities and emerging threats before they become serious incidents.
• Planning and quick response: Companies must have well-defined incident response plans to minimize the impact of any security breach.

Cybersecurity as a strategic priority

This type of cyberattack highlights that cybersecurity is not just a technical aspect, but a strategic priority for companies in the defense sector. A single cyberattack can compromise operations, affect reputation and have significant geopolitical consequences.

Incorporating advanced security measures, conducting regular audits and strengthening the protection of personal communications is not an expense, but an investment in resilience and operational continuity.

Apolo Cybersecurity: Preventing, Detecting and Responding to Cyber Threats

At Apolo Cybersecurity, we help companies in the defense sector to anticipate and respond to cyberattacks by:

• Security audits and vulnerability analysis.
• 24/7 monitoring and detection services.
• Definition of incident response and business continuity plans.
• Strategic support from a business perspective, not just a technical one.

If you want to evaluate your organization's actual level of exposure and know if you would be prepared for a similar incident, we can help you analyze it clearly and without obligation. Contact us now!