> ## Content Index > Fetch the complete content index at: https://www.adriadefense.com/llms.txt > Use this file to discover other available public pages before exploring further. # Czech Cyber Agency Warns Russian Espionage Campaign Targets Defense Industry - URL: https://www.adriadefense.com/czech-cyber-agency-warns-russian-espionage-campaign-targets-defense-industry/ - Published: 2026-11-14T07:00:00.000Z - Updated: 2026-11-14T07:00:01.000Z - Description: Czech cybersecurity agency NÚKIB reports 65 incidents in Q3 2026 and warns of Russian-linked cyberespionage targeting European government institutions and defense industry organizations. - Author: AdriaDefense Desk - Tags: Czech Republic, Intelligence, CEE, Defense Industry, Russia, Cybersecurity The Czech Republic's National Cyber and Information Security Agency (NÚKIB) has warned of continued Russian-linked cyberespionage activity targeting European government institutions and defense industry organizations, as the country recorded a sharp increase in cybersecurity incidents during the third quarter of 2026. In its quarterly threat assessment published on November 13, NÚKIB reported 65 cybersecurity incidents between July and September, an increase of almost 50% compared with the previous quarter. Thirteen incidents were classified as significant, the highest quarterly number recorded over the past year. None was classified as very significant. The report highlights persistent foreign intelligence activity involving compromised email systems, targeted phishing campaigns and sophisticated malware, with Russian-linked groups among the principal threats. ## Russian Cyberespionage Targets Defense Organizations One of the assessment's most important findings concerns a cyberespionage campaign targeting users of the Zimbra Collaboration Suite email platform. NÚKIB said it participated with international partners in a joint warning about the campaign, which has been associated with a group linked to the Russian Federation. The operation seeks to obtain email correspondence, authentication credentials and other sensitive information from organizations operating across several sectors. Targets identified in the advisory include government institutions, defense industry organizations, energy companies, media outlets, educational institutions and nongovernmental organizations. The campaign illustrates how attackers can exploit widely used communication platforms to access strategically valuable information without directly compromising classified military networks. For defense manufacturers, email systems may contain procurement correspondence, supplier relationships, technical documentation and information about ongoing projects. Compromising those communications could provide foreign intelligence services with insights into European defense industrial capabilities and commercial relationships. The report does not identify specific Czech defense manufacturers as confirmed victims of the campaign, nor does it attribute all 65 nationally recorded incidents to Russian actors. ## Signal Users and Security Officials Face Targeted Phishing NÚKIB also highlighted targeted phishing operations against users of the encrypted messaging application Signal. According to the agency, the campaigns have been linked primarily to actors associated with Russia and have focused on politicians, security service personnel, government officials and other individuals of intelligence interest. The assessment separately identifies abuse of an authentication mechanism known as Device Code Flow. Such techniques can deceive users into authorizing access to their accounts, allowing attackers to obtain credentials or valid authentication tokens without relying exclusively on traditional password theft. These campaigns underline the importance of personal communications security for officials and professionals working with sensitive government or military information. ## Russian and Chinese Cyber Operations Remain Active Beyond the Zimbra and Signal campaigns, the quarterly assessment describes additional activity associated with state-linked cyber groups. NÚKIB highlighted the deployment of a backdoor known as HOOKEDGE by a Russian group during operations against European government and diplomatic targets. The agency also referenced activity by at least four groups associated with China that exploited vulnerabilities in Google Chrome and Windows using an exploit kit known as BlueMoon. Security researchers additionally identified backdoors in certain networking devices manufactured by Chinese companies Tenda and Zbtlink. Together, the findings illustrate the variety of techniques used in cyberespionage, from targeted credential theft to malware deployment and exploitation of network equipment. NÚKIB reported that intrusion-related incidents accounted for almost two-thirds of the cyber incidents recorded during the quarter, primarily affecting public administration, education and healthcare. ## Defense Industry Faces Wider Intelligence Exposure The Czech findings add to concerns about the security of European defense suppliers as NATO members increase military production and continue supporting Ukraine. The Czech Republic is an important regional center for ammunition production, military vehicle manufacturing, aircraft development and defense technology exports. These industries depend on interconnected networks of suppliers, engineering firms and government customers, creating potential opportunities for espionage beyond the largest manufacturers. As [AdriaDefense previously reported](https://www.adriadefense.com/czech-intelligence-warns-russia-may-escalate-against-nato/), Czech Security Information Service director Michal Koudelka has warned that Russia could escalate covert operations against NATO countries supporting Ukraine. The Czech cybersecurity assessment also follows recent findings elsewhere in Central and Eastern Europe. On November 11, [AdriaDefense reported on a Russian-linked espionage toolkit discovered by Slovakia's ESET](https://www.adriadefense.com/russian-espionage-tool-targets-nato-and-eu-emails-in-romania/), involving compromised government email infrastructure in Romania and Kazakhstan. Although the incidents concern different operations and malware, they illustrate the continued importance of email and communications infrastructure as intelligence targets. ## Cybersecurity Becomes an Industrial Security Priority NÚKIB's latest assessment underscores the need for defense companies to treat cybersecurity as part of their broader industrial security planning. The report also identifies a growing challenge associated with artificial intelligence: increasingly capable tools can accelerate the discovery of software vulnerabilities while organizations may struggle to deploy patches at the same pace. For defense manufacturers, this creates pressure to strengthen authentication, protect sensitive correspondence and monitor both internal networks and external suppliers. The agency's findings do not establish that Czech defense companies were responsible for the quarterly increase in reported incidents. They do, however, place defense organizations among the sectors exposed to ongoing foreign cyberespionage campaigns. With military production and cross-border industrial cooperation expanding across Europe, the protection of commercial and technical information is becoming an increasingly important element of defense readiness.