Since at least mid-2022, Russian military intelligence, particularly the Sandworm group, has used malware to target critical systems including an Estonian logistics company and water utility data systems in the US, France, and Poland. The malware dubbed "Kapeka" was directly linked by Finnish cyber security firm WithSecure to Russia's Sandworm unit. While disruptions have been limited, such as water tank overflow in Texas, this represents an escalation from intelligence gathering to active cyber-attacks on NATO countries. Mandiant, a Google subsidiary, supports the attribution to Russian intelligence, although claims by a Russia-based hacker group complicate the picture. Finnish expert Mikko Hyppönen notes that Finland has not yet suffered destructive cyber-attacks but is likely subject to ongoing espionage. He advocates for improved integration of IT and cybersecurity experts for national defense. These developments indicate increased Russian offensive cyber activity against Western allied infrastructure.

Since at least mid-2022, Russian military intelligence, particularly the Sandworm group, has used malware to target critical systems including an Estonian logistics company and water utility data systems in the US, France, and Poland. The malware dubbed "Kapeka" was directly linked by Finnish cyber security firm WithSecure to Russia's Sandworm unit. While disruptions have been limited, such as water tank overflow in Texas, this represents an escalation from intelligence gathering to active cyber-attacks on NATO countries. Mandiant, a Google subsidiary, supports the attribution to Russian intelligence, although claims by a Russia-based hacker group complicate the picture. Finnish expert Mikko Hyppönen notes that Finland has not yet suffered destructive cyber-attacks but is likely subject to ongoing espionage. He advocates for improved integration of IT and cybersecurity experts for national defense. These developments indicate increased Russian offensive cyber activity against Western allied infrastructure.