Cyberattacks and bomb threats: Europe investigates suspected Russian links

European security services have joined forces in a cross-border investigation to determine the source of a series of coordinated bomb threats that affected dozens of flights across Europe this week.

According to the Financial Times, citing intelligence officials, suspicion has focused primarily on Russia. Several European security chiefs consider a Russian connection the most likely scenario because of possible motives, the techniques used, similar incidents in the past and initial evidence gathered during the investigation.

Investigators are examining whether pro-Kremlin activists or hacking groups were behind the threats. Officials stress, however, that the investigation is still at an early stage and that those responsible may never be conclusively identified.

Even if the threats are confirmed to have come from people with pro-Russian views, it remains unclear whether, or to what extent, Russian intelligence services directed, encouraged or approved the operations. Investigators say the threats do not pose a direct risk to European aviation safety.

The emails were sent from anonymous accounts based in different parts of the world. One was traced to Colombia, while many of the emails were written in the languages of the countries to which they were sent.

In a message sent to Irish media, the senders claimed they had tested a method known as “multithreading,” recruited people in Europe and gained access to compromised devices, servers and accounts.

A threat sent on Thursday to Rome’s Fiumicino Airport was linked to the Russian ultranationalist group “Male State.” The organization’s founder, Vladislav Pozdnyakov, has denied that the group was involved.

Vidas Ksanas, who is responsible for airport security in Lithuania, said the same group, or people posing as its representatives, had previously sent bomb threats to Lithuanian airports. In October 2023, more than 1,500 false alerts targeted schools and kindergartens in Lithuania. Authorities in Vilnius blamed a “state actor” without naming it, while intelligence sources attributed the incidents to Russian activists suspected of having been encouraged by Kremlin services.

Another cyber incident has meanwhile been reported in Europe, this time involving Bbt Se, the company responsible for the Brenner Tunnel project linking Austria and Italy.

The Austrian newspaper Tiroler Tageszeitung reported that unauthorized individuals had accessed data available via the internet. After detecting the incident, the company activated its security protocols, isolated the affected systems and began forensic examinations to determine the nature and extent of the intrusion.

The attack has not affected the company’s operations. Investigations into both incidents are continuing as European authorities face growing concerns about hybrid threats, including disinformation, false alerts and cyberattacks against institutions and critical infrastructure.