Cyber threats to European elections: beyond the headlines

After UK Prime Minister Rishi Sunak announced in late May that general elections will take place on July 4, UK voters will be among the two billion people heading to the polls in 2024. Europeans have several elections ahead besides the United Kingdom: the European Parliament, Austria, Belgium, Croatia, Iceland, Romania, Lithuania, and Moldova.

Election reporting can easily distort our understanding of threats. The conversation within Europe is often dominated by a small subset of issues that are prone to sensationalism, such as cyber-enabled vote tampering or the role of deepfakes. Concerns around these topics are reasonable and valid, yet other types of attacks and targets may present a greater threat. We have yet to see compromises of voting machines in the wild, and there are only limited indications that election system manufacturers are being targeted.

Instead, the cyber threat landscape for the European elections involves a variety of targets, tactics, and threat actors. This can quickly feel overwhelming. Zooming out to acknowledge the wider spectrum of election threats and applying historical knowledge can help build level-headed analysis.

Ministries, political parties and campaigns

Ministries, government functions, election administrators, political parties, campaigns, media outlets, and even voters are more likely targets than cyber-enabled vote tampering. Advanced Persistent Threat 29 (APT29), a cyber actor linked to Russia’s Foreign Intelligence Service, has a track record of targeting foreign ministries. In February 2024, APT29 took its attacks further: at Google Threat Intelligence, we saw it target German political parties for the first time.

This is a warning signal to other political parties and civil society groups across Europe that they are now on the menu for cyber espionage campaigns. Across this broader election ecosystem, many entities are particularly vulnerable, such as grassroots campaigns that typically lack robust cyber security.

Hybrid threats

The two primary types of threats associated with elections are network intrusions targeting high-value political entities and information operations targeting the wider public. Each of these topics is important to prepare for in its own right, yet the security community often fails to consider how they come together. Threat actors are now deliberately layering attacks through hybrid operations. Each tactic magnifies the others.

Hack-and-leak operations are a longstanding example of this concept in action: sensitive information stolen through a network intrusion boosts the effectiveness of subsequent information operations. By leveraging authentic documents, an adversary can maximise societal disruption. In one instance, the then-UK opposition leader Jeremy Corbyn in 2019 cited authentic UK healthcare service documents that were initially leaked by Russia. In another instance, a Brexit leak website was linked to Russia in 2022. Various disruptive cyber operations, including DDOS, website defacements and the deployment of wiper malware, also now contain a clear psychological component.

More adversaries

Russia represents the most serious threat to European elections. It is the main perpetrator of hybrid operations. Russia-nexus groups, such as APT44 (AKA Sandworm), have a track record of combining espionage campaigns, destructive operations, and spreading disinformation. The group has a longstanding record of interfering in democratic processes and has been behind some of the most high-profile incidents in Ukraine, France, Georgia, and the United States.

Although not directly election-related, the Russia-Ukraine conflict also provides important context on how Russian actors could target democratic processes through hybrid operations. After deploying wiper malware on Ukrainian entities, the Russian Chief Intelligence Directorate (GRU) routinely uses Telegram channels and assumes hacktivist identities to claim responsibility for cyberattacks. They also leak stolen documents and post proof of compromise from their targets that way. This ensures that victims are publicly outed, even if they decide not to publicise an attack.

A political party or campaign might be able to recover from a denial-of-service attack or recover systems after wiper malware. However, when such an incident is publicised by an adversary, it can easily create a perception among the public that democratic institutions are under threat in the run-up to an election. This blended approach is baked into Russia’s ‘information confrontation’ approach to cyber conflict.

Russia is not the only threat to European elections. For instance, uncategorised (UNC) threat group 1151 (UNC1151) is tied to the Belarusian government. The group has previously targeted European governments and provided technical support to information operations such as GHOSTWRITER, which has promoted narratives critical of NATO. Unlike Russia’s interest across Europe, UNC1151’s operations have typically targeted countries neighbouring Belarus, and many of the information operations it has supported are directed at Eastern Europe.

Other players could also threaten European elections. Chinese information operations have typically focused on the United States and local and near-abroad issues like Xinjiang, Hong Kong, and Taiwan. However, these operations have expanded in scope and scale in recent years, including operations conducted in European languages and targeting private sector companies.

China-nexus groups also spy on European democracies. In March, the United Kingdom called out China for targeting the UK’s Electoral Commission and parliamentarians in 2021 and 2022.

Beyond state threats, the Russia-Ukraine and Israel-Hamas conflicts have precipitated a resurgence in hacktivism that has targeted European countries. For example, the Russia-aligned hacktivist group Killnet targeted the European Parliament website in late 2022, shortly after members voted to declare Russia a state sponsor of terrorism.

Cybercriminal groups could also target election infrastructure. Although they are not interested in elections, their methods include targeting organisations during high-pressure moments. For instance, ransomware groups target the education sector ahead of a new academic year or retail companies in the run-up to the holiday period.

Level-headed responses

Despite the variety of potential threats, calm and level-headed responses are more needed than ever. Understanding relevant threats can empower the policymaking and network defence communities to build more proactive strategies. Moreover, information operations and disruptive cyber campaigns thrive when their impacts are built up. At a time when there is no shortage of sensationalism and doom-mongering on election-related cyber threats, objective analysis will be more important than ever.