European government's own operating infrastructure was the target this week — a federal document platform, a national beneficial-ownership register, a state treasury and a heat plant, with two of the entry points on no internet-facing asset inventory
If you did nothing this week: peer institutions in five European jurisdictions disclosed compromises of the machinery they run the state with — and in two of them the way in was connectivity and legacy infrastructure that appears on no internet-facing asset inventory.
Switzerland took two of them in 48 hours, at both levels of government. The Bundesamt für Informatik und Telekommunikation, which operates the Confederation's own data centres, disclosed on 4 August that its on-premises SharePoint Servers were compromised and that "rund 200 Konten kompromittiert wurden" — user accounts and technical service accounts alike (Der Bundesrat / BIT, 2026-08-04). The detail that matters for anyone still running on-premises SharePoint is the timing: BIT had begun installing the July updates immediately on release, and staff spotted the anomalies on 28 July while that work was in progress, so the servers are being rebuilt from scratch rather than patched in place. One day later the Canton of Graubünden's IT office reported a compromise of a SharePoint server hosting the cantonal administration's public web presence, reporting on first analysis no accounts compromised and no data exfiltrated (Kanton Graubünden, 2026-08-05); Keystone-SDA reporting adds that two files were placed on the server and their code was not executed (persoenlich.com, 2026-08-05). Neither Swiss disclosure names a CVE, which is why an estate-wide compromise assessment keyed on the July SharePoint exploitation window — not a CVE-scoped patch check — is the operation this pair calls for.
Two further disclosures show the objective shifting from the citizen's data to the state's own authoritative record. Liechtenstein's Amt für Justiz lost copies of the beneficial-ownership register: "Datenkopien von rund 31'000 Rechtsträgern widerrechtlich abgegriffen" (Regierung des Fürstentums Liechtenstein, 2026-08-02), and the government's follow-up media conference published the exact field set — legal-entity name plus surname, first name, date of birth, nationality and country of residence, with no address, telephone number or financial data recorded (Regierung des Fürstentums Liechtenstein, 2026-08-04). That composition is the point: what was taken is an identity-verification kit tied to the natural persons behind Swiss- and EU-administered structures, not a marketing list. In Hungary, Telex.hu reports that the Magyar Államkincstár's Agricultural and Rural Development Office was breached in late July by ByteToBreach — the actor already tracked here for the attack on Romania's national land registry — with experts consulted on attacker-leaked screenshots assessing entry through an Oracle WebLogic server whose fixes date to an October 2017 patch cycle, escalating to Windows domain-administrator rights (Telex.hu, 2026-08-03).
The week's most consequential access path was published on its last day. CERT Polska's follow-up forensic report on the 29 December 2025 attacks on Poland's energy sector discloses a second, previously unnamed victim — a combined heat and power plant supplying about 50,000 residents, where three Siemens PLCs were switched to STOP mode and password-locked, shutting down a steam turbine and the process-water treatment system. The attacker reached it from an already-compromised wind-farm substation by tunnelling over SSH through a cellular router into the distribution system operator's private APN, a mobile network shared by both sites, and then into a WAGO PFC200 controller whose WAN-side web interface answered on factory credentials (CERT Polska incident follow-up report, 2026-08-08). CERT Polska states that "the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack," and — the sentence European operators should act on — that surveys of organisations using similar solutions "indicated that this configuration was commonly encountered in Poland" (CERT Polska, 2026-08-08). Belgium supplies the fifth shape: Digitaal Vlaanderen confirmed to WIRED that Belgium's Centre for Cybersecurity notified it on 3 March 2026 of a North Korean compromise, that the affected workstation was isolated and exposed credentials rotated, and that the incident is contained — one organisation inside a victim set the researcher built from nearly two years of access to the actors' own servers (WIRED, 2026-08-05).
Triage: a compromised administrative estate of this kind produces telemetry that reads as ordinary operations, so the discriminators are relational rather than atomic. For the SharePoint cases, look for web-application process trees spawning script interpreters and for service-account authentication from hosts those accounts never normally touch — a service account is defined by its narrow, repetitive access pattern, and the deviation is the signal. For the OT path, the discriminator is direction and origin: an inbound management session to a field controller arriving from a peer device inside the carrier APN rather than from the operator's own engineering workstation subnet, and a controller-mode change (run to STOP) with no corresponding change-management window. Legitimate remote maintenance produces the same protocol events; it does not normally originate from another site's equipment.
Im Rahmen der Analyse des Vorfalls wurde festgestellt, dass rund 200 Konten kompromittiert wurden.
Dabei wurden Datenkopien von rund 31'000 Rechtsträgern widerrechtlich abgegriffen.
To the best of our knowledge, the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack.
Surveys conducted among organizations using similar solutions indicated that this configuration was commonly encountered in Poland.
ATT&CK mapping
7 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
T1190Exploit Public-Facing Application
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
T1199Trusted Relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Collection TA0009
T1213Data from Information Repositories
Adversaries may leverage information repositories to mine valuable information. Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, such as Credential Access, Lateral Movement, or Defense Evasion, or direct access to the target information. Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization (i.e., Transfer Data to Cloud Account).
Command and Control TA0011
T1572Protocol Tunneling
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.