Cyber warfare is on the rise: Europe is becoming an increasingly critical front line

Attacks on the public sector have risen by 90 per cent globally and by 114 per cent in Europe in just 30 months

Pressure mounts as geopolitical tensions rise

Europe under pressure

Check Point Research: rapid attacks

The AI models behind state- attacks

An artificial intelligence agent exploited a vulnerability on a public website to gain access to paid data; another mistakenly submitted a federal form despite having been instructed not to do so.

These incidents, which came to light following a recent internal review at Anthropic, prompted the US company to suspend internet access for its ‘assistants’ during testing. From late August through to the end of September, however, Proofpoint, one of the world’s leading cybersecurity firms, identified at least four actors engaged in espionage who rapidly adopted the BlueMoon exploit kit for Chrome and Windows in targeted spearphishing , the use of which has not been attributed exclusively to China-linked groups but which targeted specific government entities.

Two very different incidents, both of which point to the new era of ‘cyber defence’ in which we now live, a topic that was also discussed at Cybertech Europe 2026, the international event dedicated to cyber security held this week in Rome.

Pressure mounts as geopolitical tensions rise

In June 2026, every government organisation faced an average of 2,836 cyberattacks per week globally; in January 2024, the figure was 1,496: this represents an increase of around 90 per cent. In Europe, the pressure has risen even more rapidly, with 2,563 attacks per week per organisation, compared with 1,197 30 months earlier (an increase of 114 per cent). The figures compiled by Check Point Research, to which *Il Sole 24 Ore* had exclusive access, illustrate the escalation affecting the public sector, an increasingly vulnerable target for cybercriminals.

Europe under pressure

Whilst the total number of incidents and the number of organisations actually affected are unknown, the mounting pressure on European government organisations is clear. Furthermore, the geographical distribution of the attacks reveals a clear geopolitical pattern: areas directly involved in conflicts or close to theatres of war show spikes in attempted breaches against the government sector that coincide with the timeline of the conflicts themselves, rather than a gradual increase over time.

This trend is evident both in the Middle East and in Europe, against the backdrop of the war between Russia and Ukraine. As the experts at Check Point Research point out, this is a temporal correlation rather than verifiable proof of responsibility: telemetry coverage varies from country to country and measures where and with what intensity attacks are occurring, but does not allow them to be attributed to a particular state or group.

The vulnerability of the government sector depends, in any case, on the convergence of three factors. Firstly, the presence of data of high value to organisations engaged in espionage, regardless of whether a conflict is taking place.

Secondly, the responsibility for providing essential services, the disruption of which has an immediate and visible impact on the population. Finally, the fact that public bodies often operate using technological infrastructure that is older and more fragmented than that of the private sector, thereby increasing the attack surface.

This combination of factors makes the volume of attacks against the public sector a kind of leading indicator, which tends to rise earlier and more rapidly than in other sectors, offering a unique insight into how geopolitical tensions translate into increasing cyber pressure on organisations.

Check Point Research: rapid attacks

The growing number of attacks on the public sector also reflects another trend that is causing concern amongst governments, namely the speed at which criminal attacks are spreading. According to data from Check Point Research, in fact, in the first quarter of this year, the median time taken to exploit a vulnerability fell from around one year in 2021 to less than 24 hours. This is a striking figure, though it does not fully demonstrate the role of artificial intelligence in the rise in attacks. It does, however, clearly illustrate why the increase in attack volumes (and the shorter time taken to exploit vulnerabilities) makes operational resilience a priority, particularly for organisations using legacy systems and facing long and complex technology update cycles.

The AI models behind state- attacks

Cybercriminal groups linked to China, Russia, North Korea and Iran have integrated artificial intelligence into their attack operations, with activities ranging from reconnaissance and social engineering through to malware development and system compromise. This is clearly stated in the report “AI Statecraft and Cyberthreats in 2026” by TrendAI, a division of Trend Micro, which explains how access to cutting-edge Western AI models is not necessarily a decisive factor.

Experts have in fact observed that APT (Advanced Persistent Threat) groups linked to China utilise local models when those of American and European origin are blocked or restrict their activities, thereby enabling them to continue their operations. In a cyber-attack in Thailand, attributed with low confidence to an unknown actor (possibly Earth Lamia), the attacker switched from Claude Code to MiMo-V2.5-Pro (a Chinese model, one of many in the rich and complex ecosystem of the Land of the Dragon) when the service providing access to the former encountered problems, successfully completing the collection of credentials.

What is the risk associated with this trend? The accelerated growth of malicious activity based on AI models that lie beyond the reach of Western cybersecurity vendors and providers, which would make it far more difficult to detect and counter such threats.

Notizie e approfondimenti sugli avvenimenti politici, economici e finanziari.