Cyber warfare is on the rise: Europe is becoming an increasingly critical front line

This trend is evident both in the Middle East and in Europe, against the backdrop of the war between Russia and Ukraine. As the experts at Check Point Research point out, this is a temporal correlation rather than verifiable proof of responsibility: telemetry coverage varies from country to country and measures where and with what intensity attacks are occurring, but does not allow them to be attributed to a particular state or group.

The vulnerability of the government sector depends, in any case, on the convergence of three factors. Firstly, the presence of data of high value to organisations engaged in espionage, regardless of whether a conflict is taking place.

Secondly, the responsibility for providing essential services, the disruption of which has an immediate and visible impact on the population. Finally, the fact that public bodies often operate using technological infrastructure that is older and more fragmented than that of the private sector, thereby increasing the attack surface.

This combination of factors makes the volume of attacks against the public sector a kind of leading indicator, which tends to rise earlier and more rapidly than in other sectors, offering a unique insight into how geopolitical tensions translate into increasing cyber pressure on organisations.

The growing number of attacks on the public sector also reflects another trend that is causing concern amongst governments, namely the speed at which criminal attacks are spreading. According to data from Check Point Research, in fact, in the first quarter of this year, the median time taken to exploit a vulnerability fell from around one year in 2021 to less than 24 hours. This is a striking figure, though it does not fully demonstrate the role of artificial intelligence in the rise in attacks. It does, however, clearly illustrate why the increase in attack volumes (and the shorter time taken to exploit vulnerabilities) makes operational resilience a priority, particularly for organisations using legacy systems and facing long and complex technology update cycles.

Cybercriminal groups linked to China, Russia, North Korea and Iran have integrated artificial intelligence into their attack operations, with activities ranging from reconnaissance and social engineering through to malware development and system compromise. This is clearly stated in the report “AI Statecraft and Cyberthreats in 2026” by TrendAI, a division of Trend Micro, which explains how access to cutting-edge Western AI models is not necessarily a decisive factor.

Experts have in fact observed that APT (Advanced Persistent Threat) groups linked to China utilise local models when those of American and European origin are blocked or restrict their activities, thereby enabling them to continue their operations. In a cyber-attack in Thailand, attributed with low confidence to an unknown actor (possibly Earth Lamia), the attacker switched from Claude Code to MiMo-V2.5-Pro (a Chinese model, one of many in the rich and complex ecosystem of the Land of the Dragon) when the service providing access to the former encountered problems, successfully completing the collection of credentials.

What is the risk associated with this trend? The accelerated growth of malicious activity based on AI models that lie beyond the reach of Western cybersecurity vendors and providers, which would make it far more difficult to detect and counter such threats.