Allied Intelligence — 2026-11-14

Czech Cyber Agency NUKIB Warns Russian State Espionage Targeting Institutions Cannot Rule Out Destructive Attacks

BLUFAPT28's exploitation of unmanaged consumer routers and spoofed government domains to harvest credentials means Czech and allied defenders must extend monitoring well beyond traditional network perimeters to counter an espionage campaign that has already breached edge infrastructure.

Czechia's National Cyber and Information Security Agency (NÚKIB) released an analysis depicting long-running, sophisticated cyber campaigns by Russian state-sponsored actors against Czech and allied institutions, with cyberespionage the main activity, targeting government bodies, NGOs, private firms and individuals 123. NÚKIB states that destructive attempts, such as permanent data destruction or system disablement, cannot be ruled out 12. Phishing remains the dominant initial-access method; in one case a Russian actor impersonated the Czech Foreign Ministry from the spoofed domain mav.cz to email foreign diplomatic missions 13. The analysis also cites APT28's compromise this year of TP-Link routers in Czechia through a vulnerability and unchanged default passwords, used to capture passwords and login tokens including corporate email credentials 13.

Analysis
Russian state actors have converted unmanaged consumer and edge devices into espionage infrastructure, so home and small-office routers belong in the government attack surface. APT28's capture of corporate email credentials through Czech TP-Link routers, and phishing that bypasses multifactor authentication via Signal and WhatsApp, mean perimeter controls alone no longer safeguard diplomatic and ministry accounts. The spoofed mav.cz domain aimed at foreign missions extends exposure to allies, who may receive similar lures. NÚKIB cites no observed wiper or sabotage activity in Czechia, so espionage remains the demonstrated threat, and the destructive-attack warning may be a standard caveat rather than a signal of changed Russian intent. Confidence is high because four outlets report the findings consistently, though all rest on one NÚKIB document, and the Czech reports track a single ČTK wire text, so independent sourcing is thinner than the count suggests.

4 sources

NÚKIB v analýze upozorňuje na dlouhodobé ruské kyberútoky - České noviny (ČTK)
NÚKIB upozorňuje na ruské kyberútoky. Hrozí prý i destruktivní - ČT24 (Česká televize)
Czech cyber agency warns Russian espionage targets institutions and individuals - Expats.cz
NÚKIB upozorňuje na kybernetické útoky ruských aktérů - Deník N