FSB Hackers Enter Slovak Defence Networks

The router in the corner of an office, the VPN used by staff working from home, the network box nobody thinks about until it fails: these are now part of Europe’s front line. In Slovakia, Russian state-linked hackers appear to have been testing exactly those doors around systems connected to energy networks, arms production and government ministries.

Slovakia’s foreign ministry confirmed the country had been targeted by cyber operations linked to Russia’s FSB intelligence service (Topky/TASR). The Ministry of Investments said the activity was aimed at critical infrastructure, the arms industry and the energy sector (TA3). The lights stayed on. Trains kept running. That matters, because the absence of visible disruption does not mean the incident was harmless.

The burglar who ignores the television

The operation behind the activity, known as Turla, is not a ransomware outfit chasing a quick payout. It is run by the FSB’s Centre 16 unit and is designed to get inside networks quietly, remain there, and gather intelligence over months or years (CISA). The better comparison is a burglar who leaves the television alone but photographs the fuse box, studies the cameras and takes impressions of the keys.

The points of entry are often dull, which is why they work. A joint advisory from CISA and the FBI describes Centre 16 actors exploiting badly configured routers, weak network-management settings and outdated VPN gateways, the devices that sit between an organisation and the open internet (CISA AA26-194A, FBI/IC3). A VPN gateway can be a visitor book and a floor plan at the same time: it shows who connects, from where, and which internal systems they can reach. Configuration files can reveal trusted connections and routes further inside the network (AttackIQ).

For a ministry or an energy company, that gives an attacker a way to map weak points without setting off a crisis. On the public evidence, this looks like reconnaissance for future leverage, rather than proof of imminent sabotage.

Why neighbours care

European infrastructure is less a row of detached houses than an apartment block with shared wiring. Slovakia and Austria are linked through gas transmission networks and the busy Vienna-Bratislava rail corridor (Gas Connect Austria, ÖBB). Czechia shares defence data-exchange channels and border-region systems (Novinky). That does not mean those systems were breached. It does explain why governments treat a Slovak intrusion as a wider European problem.

No neighbouring state has reported a confirmed compromise from this incident. The worry is more practical: stolen configurations, supplier credentials or knowledge of weak points can help attackers plan later moves against connected systems. Austria summoned the Russian ambassador over related cyberattacks. The EU and UK imposed their first joint sanctions against Centre 16 and the Turla operation (Sabr Cyber & Tech News, formiche.net). The message is that governments see the threat as shared, even without evidence of damage crossing borders.

A building code that cannot patch a router

This is the kind of case NIS2 was written for. The directive is, in effect, a building code for essential digital services: it requires operators of critical infrastructure to manage cyber risk, report incidents quickly and secure their supply chains (EUR-Lex). Slovakia’s handling tested that logic. According to media reports, the government confirmed the attacks only after journalists asked questions (TA3), while opposition figures accused it of dangerous passivity (Aktuality).

A building code can require fire exits and smoke alarms. It cannot stop someone leaving the door wedged open. NIS2 can set reporting deadlines and demand risk assessments. It cannot patch an old router or rotate a leaked VPN key.

What happened in Slovakia is not evidence, on what is public, that Russia can paralyse European infrastructure at will. It shows something quieter: Russian-linked actors targeted systems that could help them understand, map and prepare pressure against critical services. The access is patient. The value lies in what can be learned before anyone notices. Europe’s test is whether it treats that quiet foothold as seriously as a visible shutdown.