Czech cyber agency warns Russian espionage targets institutions and individuals

Russian state-sponsored hackers are conducting sustained, sophisticated campaigns against Czech and allied institutions, with cyberespionage their principal activity, according to Czechia’s cybersecurity authority.

The National Cyber and Information Security Agency, known as NÚKIB, says targets include government bodies, nongovernmental organizations, private businesses and individuals.

Its analysis also warns that destructive attacks cannot be ruled out. Unlike espionage or ransomware, these aim to destroy data, disable systems or potentially damage physical infrastructure.

Phishing remains the main route attackers use to gain initial access, according to the analysis published by NÚKIB.

Messages are tailored to their intended recipients. Campaigns targeting government institutions use official themes, event invitations and apparent requests to share documents.

In one example, a Russian actor impersonated the Czech Foreign Ministry and sent messages to foreign diplomatic missions posing as an assistant to a Czech ambassador. The emails used the deceptive domain mav.cz.

The campaigns also extend to messaging services such as Signal and WhatsApp. Attackers use social engineering—manipulating people into trusting a false identity or request—and may pose as technical support.

NÚKIB warns that these methods can circumvent multifactor authentication. The analysis describes manipulation of users, rather than suggesting that the messaging services themselves have necessarily been compromised.

Attackers also exploit vulnerabilities in email services and applications. Some attacks require little or no interaction: receiving or displaying a specially crafted message may be enough to trigger malicious code when a relevant vulnerability exists.

Alongside carefully selected targets, Russian actors scan the internet more broadly, automatically searching for vulnerable or unpatched devices regardless of who owns them.

Compromised routers and internet-connected cameras can then serve as infrastructure for further attacks.

The analysis cites incidents this year involving APT28, which took control of TP-Link routers in Czechia by exploiting a vulnerability and unchanged default passwords.

Attackers used the compromised equipment to intercept passwords and login tokens, including credentials for corporate email.

That illustrates how devices outside a government or company’s central systems can still become part of an espionage operation. A router may be compromised because it is vulnerable, even if its owner was not the attacker’s original target.

NÚKIB identifies intelligence gathering as the dominant activity, while also highlighting the possibility of more damaging operations.

The warning covers an ongoing pattern of Russian state-backed activity rather than a single newly disclosed breach. Its examples show attackers combining technical vulnerabilities with convincing impersonation to gain access to accounts, communications and organizational networks.