Russian-linked hackers have escalated destructive cyberattacks on European critical infrastructure, including a foiled attack on a Swedish heating plant in spring 2025 and a significant attempted strike on Poland’s power grid in December 2025, signaling more aggressive tactics across Sweden, Norway, and Denmark.

Cyber & Information WarfareCyber AttacksAttacks on critical infrastructure (energy, transport, hospitals)

Aggressor

Summary

Sweden's defense ministry reported a significant increase in destructive cyberattacks on Europe's critical infrastructure attributed to Russia-linked hackers. Civil Defense Minister Carl-Oskar Bohlin stated that over the past year, Russia's cyber tactics shifted from denial-of-service attacks to more destructive efforts targeting organizations in Europe. A specific incident involved a foiled attack on a heating plant in western Sweden in spring 2025 by a group with links to Russian intelligence, where security systems prevented damage. Similar challenges were noted in Norway and Denmark, indicating a shift toward riskier and more reckless cyber behavior that could damage society. Additionally, a large-scale attempted attack by Russia-linked actors on Poland’s power grid in December 2025 was highlighted as a major strike on energy infrastructure. Western agencies also exposed a sweeping campaign by the GRU-linked hacking group Fancy Bear, which infiltrated poorly secured Wi-Fi routers across Europe and North America to steal credentials and sensitive data.

Classification

Confidence: High

The report attributes destructive cyberattacks explicitly to Russia-linked groups targeting critical infrastructure in multiple European countries with confirmed incidents, indicating hostile hybrid warfare activity.

Source URL

https://politico.eu/article/sweden-warns-russia-is-ramping-up-cyberattacks-on-critical-infrastructure

Open source

Provenance

Publisher: extension
Submitted: May 19, 2026, 09:27 UTC
Last updated: Nov 10, 2026, 02:40 UTC
Event time: Mar 1, 2025, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "6b25debf-6cf2-4369-afb0-97c1c22e50c1",
  "url": "https://politico.eu/article/sweden-warns-russia-is-ramping-up-cyberattacks-on-critical-infrastructure",
  "source": "extension",
  "status": "approved",
  "category": "Cyber & Information Warfare",
  "subcategory": "Cyber Attacks",
  "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
  "country": "Sweden",
  "source_reliability": "C",
  "info_credibility": "3",
  "tags": [
    "Critical infrastructure",
    "Energy infrastructure",
    "Hackers",
    "Intelligence",
    "Cyberattacks",
    "Security",
    "Russia",
    "Sweden",
    "Norway",
    "Denmark",
    "Poland"
  ],
  "nodes": [],
  "countries": [
    "Sweden"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "Sweden's defense ministry reported a significant increase in destructive cyberattacks on Europe's critical infrastructure attributed to Russia-linked hackers. Civil Defense Minister Carl-Oskar Bohlin stated that over the past year, Russia's cyber tactics shifted from denial-of-service attacks to more destructive efforts targeting organizations in Europe. A specific incident involved a foiled attack on a heating plant in western Sweden in spring 2025 by a group with links to Russian intelligence, where security systems prevented damage. Similar challenges were noted in Norway and Denmark, indicating a shift toward riskier and more reckless cyber behavior that could damage society. Additionally, a large-scale attempted attack by Russia-linked actors on Poland’s power grid in December 2025 was highlighted as a major strike on energy infrastructure. Western agencies also exposed a sweeping campaign by the GRU-linked hacking group Fancy Bear, which infiltrated poorly secured Wi-Fi routers across Europe and North America to steal credentials and sensitive data.",
  "summary_short": "Russian-linked hackers have escalated destructive cyberattacks on European critical infrastructure, including a foiled attack on a Swedish heating plant in spring 2025 and a significant attempted strike on Poland’s power grid in December 2025, signaling more aggressive tactics across Sweden, Norway, and Denmark.",
  "summary_extended": null,
  "actor_primary": "GRU-linked hacking group Fancy Bear",
  "target_primary": null,
  "location_text": "Western Sweden (heating plant)",
  "location_region": "Västra Götaland County",
  "location_coordinates_lat": 58.6439,
  "location_coordinates_lon": 12.3223,
  "location_precision": "Approximate",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The report attributes destructive cyberattacks explicitly to Russia-linked groups targeting critical infrastructure in multiple European countries with confirmed incidents, indicating hostile hybrid warfare activity.",
  "event_time_utc": "2025-03-01T00:00:00.000Z",
  "end_time_utc": "2025-05-31T23:59:59.000Z",
  "event_time_confidence": "pm24h",
  "created_at": "2026-05-19T09:27:00.335Z",
  "updated_at": "2026-11-10T02:40:58.112Z",
  "reliability_band": "strong",
  "location_precision_band": "approximate",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "single_source"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighSingle sourceTime: Same dayLocation: Approximate

Source reliability

Info credibility

Event time

Mar 1, 2025, 00:00 UTC

End time

May 31, 2025, 23:59 UTC

Event time confidence

pm24h

Location

Western Sweden (heating plant)

Region

Västra Götaland County

Primary actor

GRU-linked hacking group Fancy Bear

Country

Sweden

Countries

Sweden

Tags

Critical infrastructure, Energy infrastructure, Hackers, Intelligence, Cyberattacks, Security, Russia, Sweden, Norway, Denmark, Poland

Loading signal...

{ "id": "6b25debf-6cf2-4369-afb0-97c1c22e50c1", "url": "https://politico.eu/article/sweden-warns-russia-is-ramping-up-cyberattacks-on-critical-infrastructure", "source": "extension", "status": "approved", "category": "Cyber & Information Warfare", "subcategory": "Cyber Attacks", "incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)", "country": "Sweden", "source_reliability": "C", "info_credibility": "3", "tags": [ "Critical infrastructure", "Energy infrastructure", "Hackers", "Intelligence", "Cyberattacks", "Security", "Russia", "Sweden", "Norway", "Denmark", "Poland" ], "nodes": [], "countries": [ "Sweden" ], "where_text": "Cyberspace", "headline": null, "description": "Sweden's defense ministry reported a significant increase in destructive cyberattacks on Europe's critical infrastructure attributed to Russia-linked hackers. Civil Defense Minister Carl-Oskar Bohlin stated that over the past year, Russia's cyber tactics shifted from denial-of-service attacks to more destructive efforts targeting organizations in Europe. A specific incident involved a foiled attack on a heating plant in western Sweden in spring 2025 by a group with links to Russian intelligence, where security systems prevented damage. Similar challenges were noted in Norway and Denmark, indicating a shift toward riskier and more reckless cyber behavior that could damage society. Additionally, a large-scale attempted attack by Russia-linked actors on Poland’s power grid in December 2025 was highlighted as a major strike on energy infrastructure. Western agencies also exposed a sweeping campaign by the GRU-linked hacking group Fancy Bear, which infiltrated poorly secured Wi-Fi routers across Europe and North America to steal credentials and sensitive data.", "summary_short": "Russian-linked hackers have escalated destructive cyberattacks on European critical infrastructure, including a foiled attack on a Swedish heating plant in spring 2025 and a significant attempted strike on Poland’s power grid in December 2025, signaling more aggressive tactics across Sweden, Norway, and Denmark.", "summary_extended": null, "actor_primary": "GRU-linked hacking group Fancy Bear", "target_primary": null, "location_text": "Western Sweden (heating plant)", "location_region": "Västra Götaland County", "location_coordinates_lat": 58.6439, "location_coordinates_lon": 12.3223, "location_precision": "Approximate", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The report attributes destructive cyberattacks explicitly to Russia-linked groups targeting critical infrastructure in multiple European countries with confirmed incidents, indicating hostile hybrid warfare activity.", "event_time_utc": "2025-03-01T00:00:00.000Z", "end_time_utc": "2025-05-31T23:59:59.000Z", "event_time_confidence": "pm24h", "created_at": "2026-05-19T09:27:00.335Z", "updated_at": "2026-11-10T02:40:58.112Z", "reliability_band": "strong", "location_precision_band": "approximate", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "single_source" }