Bitter

Government and public administration across Switzerland and Europe took a broad spread of attacks this week — ransomware, espionage watering-holes, AI-tooled APTs and credential-phishing

Government and public administration — the profiled constituency's core — absorbed an unusually broad spread of activity in 2026-W28, notable less for any single incident than for how many different attack classes landed on the sector in one week.

On the ransomware front, CERT.LV disclosed that a crew breached Latvijas Valsts Meži (LVM), Latvia's state forestry operator, through a service left unpatched for roughly two years, and framed it explicitly as an EU/NATO-shared-threat matter for a state-owned critical operator (CERT.LV, 2026-06). In Switzerland, Psychiatrische Dienste Aargau (PDAG), a cantonal health authority, had staff email accounts compromised via phishing and abused to relay spam — a low-sophistication but high-frequency pattern against public-sector mailboxes (SwissCybersecurity.net, 2026-07-09). On the espionage axis, SentinelLabs documented converging China- and India-nexus operations weaponising a citizen-facing e-government complaint portal as a watering hole with a CMS implant (SentinelLabs, 2026-07-10); Kaspersky profiled Armored Likho hitting government and electric-power targets with an AI-generated loader and the BusySnake stealer (Kaspersky Securelist, 2026-07-11); and CERT Polska tracked UNC1151/Ghostwriter moving to Gmail with real-time 2FA-relay phishing against officials (CERT Polska, 2026-06).

Why this is a sector pattern for the constituency: two of the five strands carry a direct home-region or EU-critical-operator nexus (a Swiss cantonal authority and a Latvian state operator); the e-government watering-hole targeted a Pakistani law-enforcement programme (EU-funded but with no direct European victim nexus) and is carried for its transferable technique, while the remaining two are actors whose targeting profile — government and energy — matches the constituency. The exposed surfaces recur: unpatched internet-facing services, public-sector email identity, and citizen-facing web applications.

Builds on: 2026-07-10/cert-lv-lvm-olpha-ransomware-eu-nato-shared-threat · 2026-07-09/pdag-aargau-email-account-compromise-spam-relay · 2026-07-10/e-government-portal-watering-hole-cms-implant-espionage · 2026-07-11/armored-likho-busysnake-ai-generated-loader-python-stealer · 2026-07-09/unc1151-ghostwriter-gmail-realtime-2fa-phishing

Espionage actors weaponise a citizen-facing e-government complaint portal as a watering hole, serving a fake 'portal update' that reflectively loads a RAT

SentinelLabs documented sustained, independent cyberespionage between February 2024 and April 2026 against several Pakistani law-enforcement bodies, and while the victim class carries no direct European nexus, one technique is squarely relevant to any government running citizen-facing digital services: a suspected China-nexus actor planted custom implants directly in a public-facing Complaint Management System (CMS) — a portal used by both police staff and ordinary citizens — turning it into a watering hole (T1189, SentinelLabs, 2026-07-09). The compromised web applications were part of an EU-supported "Smart Police Station" digitalization programme, so the case is a concrete illustration of trusted e-government infrastructure being weaponised against its own users. Two implant variants were deployed: a Rust stager and a .NET executable masquerading as security/portal-update software (T1036) that displays "Update Complete! Please refresh the page" to the victim; the .NET variant reflectively loads AsyncRAT (T1620) configured against separate command-and-control infrastructure (T1071.001). SentinelLabs ties the CMS-implant samples to a Chinese-speaking developer through a shared build-path artefact across related samples, and separately attributes a converging India-nexus intrusion set at the same targets to the actor tracked as Bitter (registry: actor:bitter; aka TAG-179 / Mysterious Elephant / APT-C-08) using Remcos, alongside commodity PlugX, ShadowPad and Cobalt Strike activity (SentinelLabs, 2026-07-09; corroborated by The Express Tribune, 2026-07-09). Per this pipeline's no-IOC policy, the report's C2 addresses are not reproduced here; the transferable content is the technique class, not the indicators.