Russia-linked cyber threats: understanding the risks for Belgium

A public website down for an hour, an employee receiving a very credible fake document, discreet access kept for months inside a supplier's network: these incidents are often lumped together under the label "Russian cyber threat". The term is convenient, but it mixes up actors, objectives and levels of seriousness that are very different.

To understand the risk in Belgium, you first have to separate what is trying to make noise from what is trying not to be seen.

Three realities behind one expression

The first category covers pro-Russian hacktivist collectives. They claim distributed denial-of-service attacks, publish lists of targets and seek an immediate political effect. Their success is measured mainly in screenshots, media coverage and a sense of disruption.

The second category is criminal. These groups are after money: ransomware, extortion, credential theft, payment fraud or the resale of access. They may operate from the Russian-speaking world without being directed day to day by a state service. Their interests sometimes coincide with those of a state, but attribution remains tricky.

The third category brings together operations linked to intelligence services or state-backed groups. They aim for lasting access, information gathering and the preparation of capabilities that can be used later. They are less visible than a DDoS attack and potentially far more serious.

This distinction avoids two mistakes: playing down all operations because a DDoS campaign was quickly absorbed, or presenting every outage as a strategic attack.

Why Belgium is particularly exposed

Belgium is not targeted solely for its own institutions. Brussels hosts the European institutions, NATO, diplomatic missions, professional federations and many organisations working on energy, defence, sanctions or aid to Ukraine.

An attacker may therefore take an interest in a small Belgian organisation not for what it holds directly, but because it provides a service, maintains equipment or shares documents with a more sensitive organisation. The IT provider, the consultancy, the sector association and the logistics subcontractor are all part of the same attack surface.

The campaigns observed in 2025 illustrate this diversity. The CCB recorded five coordinated waves of pro-Russian DDoS attacks, often timed to coincide with geopolitical news. Their impact generally remained limited thanks to organisations' preparation, internet service providers and the "Red Button" procedure. At the same time, state-backed activities continued to seek long-term access by exploiting known vulnerabilities, stolen credentials and exposed equipment.

DDoS: lots of visibility, a mainly political objective

A DDoS attack consists of overwhelming a service with a volume of traffic it can no longer handle. For the public, the result is simple: the website or app stops responding.

These campaigns are often announced in advance. Publicity is part of the operation: it allows the group to claim success even when the interruption is short or only affects a secondary page. Relaying every claim uncritically can then amplify the intended effect.

That does not mean DDoS should be ignored. A portal that is down at the wrong moment can block an administrative procedure, crisis communication or an essential service. The right response combines upstream technical protection, a contact ready at the hosting provider, a minimal version of the service and factual communication that does not turn the attacker into a more powerful actor than it really is.

Espionage often starts with an ordinary vulnerability

The most dangerous operations do not necessarily use an unknown technique. They frequently take advantage of an unapplied patch on a VPN, a network device, a collaboration platform or an email gateway. They may also start with a password that has already been compromised.

The sophistication lies elsewhere: patient choice of target, knowledge of the organisation, discretion after entry and the ability to exploit relationships of trust. Once inside, the attacker looks for administrator accounts, working documents, backups and connections to partners.

Artificial intelligence tools make reconnaissance and social engineering faster. They help summarise public information, produce messages in the target's language or adapt a scenario. They have not replaced the fundamentals: a known vulnerability, a poorly protected account and overly broad supplier access remain the most profitable doors.

Attribution is not a communications exercise

A foreign IP address, software already associated with a group or a claim on Telegram is not enough. Innocent machines are used as relays, tools are copied and some actors deliberately imitate the methods of others.

Public attribution combines technical traces, intelligence, timelines, infrastructure and operational context. It can take time. A victim organisation does not, however, need to wait for that conclusion before acting: isolating the affected systems, preserving evidence, revoking access and informing the competent authorities remain necessary whoever the perpetrator is.

Preparation suited to the size of the organisation

For a small organisation, the priority is not to acquire a complex threat intelligence platform. You need to know which services are exposed on the internet, who maintains them and when they were last patched. Email, administration and remote access accounts must use phishing-resistant authentication.

For a larger organisation, add segmentation, monitoring of unusual access, management of supplier accounts and a tested response capability. Logs must be kept long enough: a discreet spy can remain present well beyond a few days.

In both cases, three questions are useful:

1. If our public website goes down, what minimum service remains available?
2. If a supplier is compromised, how far can its account reach inside our systems?
3. If we discover today an access point that is six months old, do we still have the logs needed to understand it?

Communicating without serving the adversary's operation

When an attack is claimed, communication must distinguish between unavailability, intrusion and data leakage. An inaccessible website does not prove that the internal network has been compromised. Conversely, a service that works normally does not guarantee that there is no espionage.

Saying what is confirmed, what is not and what users need to do offers better protection than alarmist phrasing. This discipline reduces disinformation and helps technical teams work without unnecessary pressure.

A response that has to be European

Supply chains, hosting providers and groups of attackers cross borders. Sharing indicators, exercises between CSIRTs, common procedures and the protection of strategic suppliers are therefore just as important as the measures taken within a single organisation.

Brussels' position gives Belgium a particular responsibility: connecting national signals to European mechanisms and turning European lessons into concrete resources for local players.

Official sources

• CCB — Belgium's cyber reality in 2025 (FR)
• CCB — what the fourth quarter of 2025 reveals about 2026 (FR)
• State Security Service — 2025 Intelligence Report (FR)
• CCB — cyber threat landscape reports