NATO’s 76th summit, which will be held June 24-25, 2025, in The Hague, Netherlands, comes at a time as the alliance’s member countries grapple with a rapidly changing global security dynamic. Russia continues to press on with its war campaign in Ukraine despite efforts to achieve a cease fire. Deep questions remain over the U.S. military commitment to Ukraine and if the U.S. would assist Europe if a conflict surfaced as required under Article 5 of NATO’s founding treaty. Israel undertook bombing strikes against Iran on the pretence that Iran was edging close to building viable nuclear weapons, which was followed by U.S. airstrikes. Since the previous summit, the leaders of European NATO countries have shown a dramatic change in rhetoric regarding the need to take on greater responsibility for security on the European continent, particularly as it pertains to increases in defense spending and military assistance to Ukraine. With an anticipated ambitious agenda, evidence of a clear rift in transatlantic relations and the alliance’s global super power distracted with other priorities, the summit could be hampered by disruption and division. This environment is ripe for cyber threats, prompting NATO member states to be on the look out for activity that could impact critical infrastructure entities. These threats could come from ideological and politically motivated attackers, who may seek to draw attention through distributed denial-of-service (DDoS) attacks, data leaks and website defacements affecting NATO nations. This blog, which draws on Intel 471’s Cyber Geopolitical Intelligence, will outline the issues at hand at the summit, the challenges facing NATO and look at the possible cyber threats.
Former U.S. President Joe Biden’s administration made little progress in establishing a clear and direct strategy to address the number of mounting global challenges facing the alliance at the 75th annual NATO summit — held in July 2024, in Washington, D.C. NATO leaders focused on three primary topics: bolstering long-term political, economic and military aid to Ukraine; strengthening NATO’s own defense and deterrence capabilities; and deepening the alliance’s partnerships in the Asia-Pacific (APAC) region with Australia, New Zealand, Japan and South Korea. We assessed then that the lack of any meaningful strategy change regarding NATO support to Ukraine would mean that the conditions of the Russia-Ukraine war at that time would lead to a continuation of the status quo for the next 12 months — which largely has turned out to be true. Several allies pledged to continue the provision of critical military assistance and the alliance released a joint declaration affirming Ukraine is on an “irreversible path to full Euro-Atlantic integration.” However, Russia’s continued unwillingness to compromise on its long-standing maximalist objectives in Ukraine underscores NATO’s failure to deter Russian President Vladimir Putin into altering his calculus. Putin appears to believe Russia can outlast the West’s resolve to support Ukraine and will remain capable of sustaining enough political and military pressure to eventually trigger Ukraine’s collapse.
The U.S. has pushed its allies to fund more of their own defenses. The drive has taken on more urgency in Europe since President Donald Trump’s administration took office in January 2025. The U.S. upbraided Ukraine’s president in the Oval Office and briefly withheld intelligence — two acts that sent strong signals that U.S. aid and support for Ukraine could be tenuous, which would have broad implications for European security and its ability to suppress Russian aggression. The first quarter of 2025 saw several new initiatives from Europe, including the Readiness 2030 (formerly called ReArm Europe) plan that seeks to allow EU member states to spend up to 800 billion euros on defense and security over the next four years. In addition, the U.K. and France sought to build a so-called “Coalition of the Willing”, intended to provide a European “reassurance force” to secure peace in Ukraine in the event a peace agreement to end the war were to materialize.
In a more recent and major feat, NATO chief Mark Rutte said all NATO countries will reach the alliance’s 2% of GDP target for defense spending in 2025 for the first time since it was agreed to more than a decade ago. Some will likely push their defense spending to 3%. The U.S. remains firm behind the perspective that they should be doing more, with statements from the White House and secretary of state saying they need to meet 5% over the next decade — Spain, however, has rebuffed this as an unrealistic demand and reached a deal with NATO to be excluded from the requirement.
Ultimately, reducing Europe’s reliance on the U.S. security umbrella in any meaningful way likely will take years, significant investment as well as extensive coordination and compromise between the region’s stakeholders. With varying threat perceptions and countries regularly prioritizing their national interests over those of multinational alliances, building the political consensus on a shared strategy for NATO, particularly across Europe will remain extremely difficult. Although statements have come out ahead of the 76th summit that most European leaders will agree to the 5% spending mark to keep discussions on track and show willingness to carry more of the regional security responsibility, it almost certainly will not be enough to keep Trump’s recurring criticisms of the alliance at bay.
Alongside the evidence of a rift in some dimensions of the trans-atlantic relationship, other strategic considerations and recent developments in the Middle East are likely to distract the U.S. from the intended agenda and priorities of the alliance's European members.
Iran’s relations with China and Russia grew closer in the first quarter of 2025, starting with the Iranian president’s trip to Moscow to sign the much-delayed Comprehensive Strategic Partnership Agreement — making Iran one of Russia’s closest allies, at least on paper. Iran’s relations with Russia were predicted to grow in the short term, as its relations with China would not see any significant development. The several back-and-forth retaliatory strikes between Israel and Iran that preceded the current explosion of tensions, it was obvious that neither ally did much in support of Iran other than to condemn Israel's actions and, in Russia’s case, appeal to international bodies to a small degree on Iran’s behalf — although this yielded no changes to the status quo.
Iran’s supposed projection towards obtaining a nuclear weapon through its civilian uranium enrichment activity has brought the Islamic Republic back to the spotlight as a primary enemy to peace in the Middle East and a threat to Western interests in the region. Major governments such as France, Germany and the U.S. are behind Israel and are attempting to force Iran, via military pressure, into a complete capitulation to stop all nuclear program activity in the country. Following U.S. airstrikes in Iran that “blew up” the diplomatic course of reaching a resolution over Iran’s nuclear program has prompted reactions that mostly call for Iran to come back to the negotiating table. Following Iran’s pre-warned retaliatory strikes against U.S. bases in Qatar and Iraq, a ceasefire was announced between Iran and Israel.
Russia has stated it is at war with NATO and has been preparing its government and society for a prolonged confrontation with the West. As such, we should particularly anticipate the long-term continuation of cyber activity targeting multinational alliances, national governments, and many critical and non-critical infrastructure organizations that play a role in providing support to Ukraine or seek to inform and influence policy towards Russia. This expanding strategic hybrid warfare campaign correlates with the alliance's continued support for Ukraine — a matter Russia perceives as a direct threat and a clear manifestation of Western interference in Russia’s geopolitical affairs. However, it almost certainly intends for such activities to remain below a threshold that would trigger a direct military confrontation with NATO.
Sowing conflict in cyberspace is an ideal domain for Russia to exert influence. It allows Russia to maintain plausible deniability and also cause damage and project power in ways that would not invite a kinetic response. All reporting from European intelligence and defense agencies in the last year have made one thing clear: Russia is acting without impunity to conduct cyber, sabotage and espionage campaigns to undermine the West. NATO needs to revive a strong strategy of deterrence to weaken the extrinsic threats it faces.
Ahead of the NATO summit, the Dutch Military Intelligence and Security Service aka MIVD published its public 2024 annual report, which warned that similar to the sentiment felt among many European countries, the Netherlands finds itself positioned within the unpredictable gray zone between war and peace. The report revealed alarming attempts by Russia-linked cyber threat groups to sabotage digital control systems of critical infrastructure entities as well as cyber espionage activity targeting the Dutch government, military and technology organizations with increased attempts by Russian state-sponsored groups to pre-position themselves within the networks of other critical infrastructure organizations with the intent to execute sabotage operations at a later date.
It is highly likely cyber-enabled espionage activity will be observed and reported after the 76th annual NATO summit concludes, not just because the Netherlands is specifically hosting the summit, but that such activity has become the regular norm. Russian cyber espionage activities align more to the country’s desire to garner influence in its near-abroad and sow public distrust in democratic government institutions in Western countries. Any information potentially stolen from NATO organizations, government decision-making bodies, or the West’s defense industrial base are likely to be leveraged in hack-and-leak operations by the numerous hacktivist groups and online personas affiliated with Russia’s state-sponsored APT groups.
Pro-Russian and allied hacktivist groups have and will continue targeting NATO countries. The history of campaigns targeting NATO countries due to their continued support of Ukraine has consistently been observed since Russia’s full-scale invasion of Ukraine in 2022. It is clearly observed that they leverage geopolitical events to add commentary and rhetoric for their followers, as well as fodder to justify their specific targeting approaches. However, this activity almost always is reactive rather than proactive and leans on press releases and political statements that reaffirm or recommit to providing support to Ukraine.
In a recent case study, we looked at the activity originating from the pro-Russian hacktivist group NoName057(16). We have long assessed that this group conducts attacks on a semi-rotational basis and primarily focuses on one or two NATO-contributing countries or supporters of Ukraine during a single week of activity. Oftentimes these targets are aligned to a political statement, sign of diplomacy, military activity, activism, or promises of further aid to Ukraine. In most cases, the group will provide a recent event that will initiate a new operation to garner attention and rally support from allied hacktivist groups to participate in its targeting efforts. However, over time, more evidence has revealed it is possible the group is operating on a pre-set primary target rotation, with the frequency of new geopolitical events regarding the Russia-Ukraine war merely aiding in the prioritization of this list.
Patterns of activity suggest it also is possible that pro-Russian hacktivists are more focused on events that can immediately impact Ukraine’s capabilities on the battlefield and are less concerned about Europe’s security plans after a peace agreement they likely do not accept as an eventuality. It would be easy to suggest an increase in pro-Russian activity or more generally activity impacting NATO countries has increased leading up to the 76th annual summit, but there has been very little change in the campaigns or the contributors to these efforts. With the number of geopolitical tension points, there are many motivating factors that these groups latch onto to justify their activity. The upcoming summit has no immediate impact on the war or other kinetic events that hacktivists typically are encouraged by. It is more likely the groups that use European-centric events to launch attacks will use post summit declarations in the days and weeks following the meeting at The Hague.
The sheer number of burgeoning issues could pack the summit agenda and result in very little progress for an alliance facing a number of global threats. Disunity also is highly likely. Trump has in the past cast NATO as obsolete, and the continued questioning by the U.S. around the value of the alliance does anything but create a unified front. It also makes it difficult to assess that any substantive outcomes will be seen from the 76th annual meeting. These fractures are like open wounds that NATO’s traditional adversaries will seek to exploit to get closer to realizing their new world order ideals. The political pressure from the Trump administration regarding expenditures on defense across Europe to shore-up the U.S.’s continued materiel and financial support to the alliance has led to difficulties in creating any long-term strategy regarding the ongoing Russia-Ukraine war.
Unfortunately, much is dependent on the European leaders being able to keep Trump’s focus long enough to address and seek resolutions on several outstanding key issues regarding European security, the Russia-Ukraine war, and more. With Washington now heavily focused on the Middle East, it might be that they see a repeat of Trump’s limited participation at the 51st G7 summit that was held in Canada earlier this month — which he left early to focus on the Israel-Iran war. Centering most of the effort in The Hague on getting a direct answer regarding the U.S.’s position on continued support in Europe will be key. This will allow European members to have more productive, smaller meetings after the fact to develop specific strategy and policy to strengthen their deterrence capabilities and possibly take a stronger position against Russia’s hybrid warfare and cyber activity.
Pro-Russian hacktivism campaigns continued to be directed at countries and entities supporting Ukraine. Here's a briefing about new hacktivist groups and the risks the groups pose.
mommy Access Broker is enabling access-as-a-service operations through detailed intrusion guides and compromised credentials, and Intel 471 has released reporting and Hunt Packages to support threat hunting and detection.
DragonForce is a Ransomware-as-a-Service group targeting global industries with customizable payloads, enabling widespread attacks and persistent extortion through an affiliate-driven model.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.