Russia attempting cyber sabotage attacks against Dutch critical infrastructure

Russian state-sponsored hackers have attempted to sabotage Dutch critical infrastructure in attacks this year and last, according to the Dutch Military Intelligence and Security Service’s annual public report, published Tuesday.

Although the impact was said to be “minimal”, last year’s incident appeared to be “the first time that a group like this has carried out a cyber sabotage attack against such a control system in the Netherlands,” warned the service, known as the MIVD.

The incidents were not detailed further in the MIVD’s public annual report, but mark an uptick in activity since 2023 when Hans de Vries — then the director of the country’s National Cyber Security Centre, and now the head at the EU’s cybersecurity agency — told Recorded Future News the Netherlands was not observing attacks directly targeting its own infrastructure.

In 2024, “the MIVD observed an increase in cyber operations against European and NATO allied targets. These attacks were probably aimed at gaining a digital position within critical infrastructure in order to sabotage it at a later time,” said the MIVD, which added that an incident this year that was foiled by the target’s quick response.

The incidents follow one of NATO’s most senior policy officials, James Appathurai, warning last year that “a port in Europe has been under a sustained cyberattack to try to lock the locks. So we have ships transiting through, [the attackers] try to lock it and drain the water to drop the ship inside of the lock, which would damage the ship and block the port.”

Appathurai did not name the port at the time and did not confirm its identity when asked by Recorded Future News, but for a major seaport such as Rotterdam in the Netherlands — the largest port in Europe — such an incident could severely disrupt the supply of critical military and civilian materiel into Europe.

Strategic importance to Europe

Although the Netherlands is a small country in geographic terms, roughly the same size as the U.S. state of Maryland with three times the population, it has a large economy and is “of strategic importance to NATO and the defence of Europe” due to its location on the North Sea and its infrastructure.

Institutions housed in the country have faced substantial hostilities from Russia — including the recent attempted infiltration of the International Criminal Court and an attempt to hack the international chemical weapons watchdog, both in The Hague — particularly in the wake of the downing of Malaysia Airlines Flight 17 over eastern Ukraine in 2014.

Of the 298 people killed when a Russian surface-to-air missile was used to shoot at the passenger aircraft, 193 were Dutch nationals. Despite overwhelming evidence to the contrary, much of it collected by Dutch investigators, the Kremlin denied and continues to deny any culpability.

The Dutch government has continued to provide support for Ukraine. It announced last month it was reserving €3.5 billion ($4 billion) in spending to continue that support over this year and next.

The MIVD reported that it had been sharing intelligence from its own cyber investigations into Russian hostile activities with the Ukrainian government, including a report revealing how Russian cyber actors were obtaining tactical intelligence providing direct support to military units.

“For example, Russia uses vulnerabilities in applications on mobile phones to determine the locations of Ukrainian soldiers and military equipment, in order to then attack them kinetically,” the report explained, echoing warnings issued by Ukrainian authorities.

The MIVD’s roles include taking overt and covert action against what it described as the increasing number of cyber actors working within the Russian government.

The agency said the Russian government was “increasingly using a ‘whole-of-society’ approach” to conducting cyber operations, with multiple Russian entities “from private companies to the highest levels of the Russian government” contributing to Moscow's offensive cyber program.

These groups “pose an increasing threat to the Netherlands and its allies” and are improving and developing better technical capabilities and knowledge, said the MIVD.

Ruben Brekelmans, the Dutch defense minister, said: “This annual report confirms that we live in a grey zone between war and peace. The task is clear. We already have to defend ourselves against cyber attacks, espionage and attempts at sabotage every day in the Netherlands.

“There are turbulent developments in international politics and in the area of ​​alliances. They have called into question certainties on which we could rely and trust until recently. The speed at which this is happening and the potential effect on our security is unprecedented,” the minister warned.

“[W]e have to strengthen our military capabilities at a rapid pace. In NATO, this applies to both the Netherlands and other European countries,” added Brekelmans. “In order to prevent vulnerabilities towards Russia, a rapid scaling up of our armed forces and defence industry is necessary. This is the only way we can prevent more Russian aggression in Europe.”