In brief

• The Czech cyber agency NÚKIB warns that Russian state-backed groups are running long-term attacks on Czech and allied institutions.
• Cyber espionage against government, NGOs, companies and individuals is the main activity, but destructive attacks cannot be ruled out.
• Attackers scan the internet for weakly secured devices and often exploit known weaknesses, phishing and unpatched software.

Espionage remains the main threat

NÚKIB says the Russian groups are targeting Czech and allied institutions over a long period. According to the agency's analysis, most of the activity takes the form of cyber espionage aimed at public administration, non-governmental organisations, private companies and individuals (Úřad upozorňuje na ruské kyberútoky, hlavní aktivitou je kyberšpionáž – Seznam Zprávy) (Cílí na stát i jednotlivce. NÚKIB varuje před destruktivními kyberútoky z Ruska – iDNES.cz) (NÚKIB varuje před kybernetickými útoky z Ruska – Deník.cz) (NÚKIB varuje před kybernetickými útoky z Ruska – Novinky.cz).

Destructive attacks not excluded

The agency also said it cannot rule out attempts at destructive cyberattacks. Such attacks do not aim to steal data or extract ransom. Their goals can include permanently destroying data, taking systems out of operation or physically damaging infrastructure (NÚKIB upozorňuje na ruské kyberútoky. Hrozí prý i destruktivní – ČT24).

Wide scanning of the internet

Beyond targeted operations, the attackers scan the internet at scale, automatically searching for weakly secured or unpatched devices regardless of their owners. Compromised equipment such as routers and IP cameras is then used for further attacks.

Common methods

According to NÚKIB, the hackers often rely less on advanced tools than on known weaknesses. These include phishing emails and links that harvest login credentials, weak or unprotected accounts and devices, and user carelessness. They also exploit flaws in widely used software and internet-connected hardware, including newly discovered vulnerabilities, which makes timely updates essential.

What organisations should do

The agency's guidance centres on basic hygiene: applying software updates promptly, protecting accounts and devices with stronger access controls, and training staff to spot fraudulent messages.