Finnish intelligence warns of persistent cyber espionage from Russia, China

Finland’s intelligence service warned that Russia and China continue to conduct extensive cyberespionage and influence operations targeting the country’s  technology sector, research institutions and government, according to a new national security assessment released Tuesday.

The Finnish Security and Intelligence Service (SUPO), which is responsible for foreign intelligence as well as domestic counterintelligence, was last year reorganized to “enhance information gathering.” In a major assessment following that reorganization, SUPO warned that foreign intelligence activity targeting Finland was widespread, combining cyberintrusions, traditional espionage and political influence campaigns aimed at gathering sensitive information and shaping decision-making.

“The principal threat to Finland arises from the sustained operations of Russian and Chinese intelligence services in various sectors of Finnish society,” the agency stated.

Cyberespionage remains the country’s most significant digital threat, with attackers targeting government systems, research institutions and companies developing advanced technologies, the report said, warning that Finland faces “continual attempts at cyberespionage, with no prospect of such operations subsiding, even in the long term.”

Finland has already faced several high-profile cyber incidents illustrating the risks described in the report. In 2020, hackers breached the psychotherapy provider Vastaamo, stealing highly sensitive therapy records belonging to tens of thousands of patients and attempting to extort both the company and individual victims.

Aleksanteri Kivimäki, a Finnish cybercriminal, was sentenced to seven years in prison after being convicted of more than 20,000 counts of attempted extortion tied to the incident. Finnish prosecutors have also charged U.S. national Daniel Lee Newhard, who lived in Estonia, with the attempted extortion.

That same year as the Vastaamo hack, Finland’s parliament disclosed a serious cyber intrusion affecting internal IT systems used by lawmakers and staff, an attack widely viewed as likely linked to state-backed espionage. Officials formally blamed the incident on the Chinese state-sponsored group APT31.

SUPO also warned that foreign intelligence services increasingly target universities and research institutions to obtain sensitive technology and research data.

“Research institutions and companies may possess information of interest to foreign states,” the report said. Cyber operations may attempt to steal R&D information “with a view to enhancing the global competitive status of authoritarian states and their business operations.” 

Finland’s growing strategic importance has also increased intelligence interest in the country. The Nordic state joined NATO in 2023 following Russia’s full-scale invasion of Ukraine, a war which has reshaped how Russian intelligence operates across Europe. 

The report notes that widespread expulsions of Russian diplomats — many believed to be intelligence officers operating under diplomatic cover — disrupted traditional espionage networks and “weakened Russia’s intelligence capabilities in Europe,” the agency said. 

Alongside cyber operations to make up for this shortfall, SUPO said foreign governments are conducting influence campaigns aimed at shaping political debate and public opinion — often sharing partly genuine material combined with misleading narratives to influence their target audiences.

Finland and neighboring Nordic countries have also experienced hybrid disruptions linked to Russian activity. Aviation authorities have repeatedly reported GPS interference affecting aircraft navigation in northern Finland and Norway, disruptions regional officials say originate from Russian military systems on the Kola Peninsula.

“Hostile state actors may combine intelligence operations, cyber activities and influence operations,” the report said. While addressing the threat from terrorism and domestic extremists, SUPO emphasized that the most persistent risks to Finland’s security environment stem from state-sponsored intelligence activity.

“Finland and its population are continually subject to a broad range of unlawful intelligence operations,” the agency said, adding that as Finland deepens its integration with Western security and technology networks, digital espionage and foreign intelligence operations are likely to remain a constant feature of the country’s security landscape.