Europe is fixated on Russian cyberattacks, but Chinese-linked groups are increasingly targeting public institutions and private companies. The threat landscape is shifting, and artificial intelligence is accelerating the race between attackers and defenders. Robert Lipovsky, principal threat intelligence researcher at ESET, explains how the game is changing.
For years, the dominant narrative in European cybersecurity has revolved around Russian advanced persistent threat groups. Yet, as Lipovsky points out, Chinese APT groups have been steadily intensifying their operations on the continent for at least two years. Poland, alongside Belgium, Italy, and Spain, has been a target of campaigns by groups like Webworm.
Why China flies under the radar
– If we look at Poland, Russian APT groups are seen as a bigger threat, which is understandable given the media coverage – said Lipovsky. – Chinese groups are not generally known for sabotage on the scale we have seen from Russian actors. Their operations tend to focus on covert cyber-espionage rather than destructive attacks. That is why they generate fewer headlines.
However, the data from ESET’s latest threat report shows a clear upward trend in Chinese APT activity across Europe. The groups target both government institutions and private enterprises, often exploiting vulnerabilities in publicly available applications. – Our analysis shows that Chinese groups rely more on exploiting N-day vulnerabilities than Russian actors, who favor spear-phishing – Lipovsky added.
AI: a double-edged sword
Artificial intelligence is lowering the barrier to entry for cybercriminals. – AI accelerates the race on both sides – said Lipovsky. – Attackers can find and exploit vulnerabilities more cheaply. Defenders must use the same tools to patch and prevent. But the scale of the challenge is growing. Even without deep technical knowledge, individuals can now run sophisticated campaigns using LLM-generated phishing messages.
The quality of phishing emails has improved significantly. Lipovsky noted that while many campaigns remain simple, others are highly targeted and linguistically polished thanks to large language models. This makes it harder for organizations to rely on training alone.
Lessons from Ukraine and the basics of defense
The war in Ukraine has become a testing ground for cyber tactics. – We see waves of destructive activity, especially with wipers, followed by quieter periods when attackers need to rebuild access – explained Lipovsky. – That pattern has become the norm since the full-scale invasion. When a group deploys a wiper, it burns its assets and has to start over.
Regarding the Sandworm attack on Polish energy infrastructure, Lipovsky clarified the attribution difference with CERT Polska. – We based our assessment on tooling and TTPs, while CERT Polska had network-level visibility. Both are valid, but they used different data sets.
For small and medium enterprises, Lipovsky’s advice is simple: focus on the basics. – Enable two-factor authentication. Patch your systems. Use modern security solutions. Many victims still fail on these fundamentals. Attackers exploit unpatched vulnerabilities and misconfigurations. Start there before investing in advanced solutions.
He predicts the number and sophistication of attacks will keep rising. – AI allows attackers to scale. The trend is clear: more attacks, higher quality, greater impact. But AI also empowers defenders. The key is to deploy these tools effectively. The intersection of AI and cybersecurity is where the next generation of specialists will find the most opportunity.
Źródło: WNP.PL, Fot. Materiały prasowe / ESET
