Spain

This page covers cyber threats to Spain. It brings together official Spanish texts (INCIBE-CERT, the Official State Gazette, the Ministry for the Ecological Transition), the European Commission, MITRE ATT&CK, and Brandefense research.

Threat groups that official sources link to Spain

None of the groups in our threat group library is named by an official source we opened as having targeted Spain, so none is listed here. MITRE ATT&CK does mention Spain for a few groups and campaigns that do not yet have a profile on this site. It says Operation Wocao, a cyber espionage campaign, targeted organizations in several countries including Spain. It says Gorgon Group ran campaigns against government organizations in the United Kingdom, Spain, Russia and the United States. It also says one alleged leader of Cobalt Group was arrested in Spain in early 2018.

Incidents on record

The incidents below are the major ones only. They are listed on this page from the incident library.

How attackers target Spain: Brandefense research

Our own posts that mention Spain fall into three themes.

Banking and fraud. Our post on the Xenomorph Android banking trojan says it also targets Android users in Spain, Portugal, Italy and Belgium. Our Grandoreiro technical analysis says the banking trojan targets organizations in the Spanish-speaking nations of Mexico and Spain. MITRE ATT&CK also says Crocodilus, an Android banking trojan, mimicked major Spanish banks for users in Spain.

Email theft. Our Strela Stealer technical analysis says the malware steals Outlook and Thunderbird email logins and targets only Germany, Spain, Basque Country, Saudi Arabia and Poland.

Ransomware and state-linked actors. Our OldGremlin profile says the group expanded into Spain, Poland and Germany in 2021. Our AvosLocker analysis lists Spain among the countries the ransomware targets. Our Mythic Leopard profile lists Spain among the countries whose critical systems the group targeted.

How Brandefense helps

Brandefense says its threat intelligence platform watches dark web forums and marketplaces, credential trading, phishing infrastructure and threat actor activity (source). In plain words, Cyber Threat Intelligence is how a security team learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

Spain’s National Security Council approved the National Cybersecurity Strategy 2019 on 12 April 2019. It was published in the Official State Gazette (BOE) on 30 April 2019. It sets seven lines of action. Under the Prime Minister, three bodies run cybersecurity: the National Security Council, the National Cybersecurity Council and the Situation Committee. The National Security Council acts through the Department of National Security (DSN) as the single point of contact for cross-border cooperation with other EU countries. The strategy also creates a public-private National Cybersecurity Forum.

Royal Decree 311/2022 of 3 May regulates the National Security Framework (ENS). Law 40/2015 extended the ENS to the whole public sector. The NIS Directive was transposed in Spain by Royal Decree-law 12/2018. For NIS2, member states had until 17 October 2024. On 8 July 2026 the European Commission said Spain, France, Ireland and the Netherlands had yet to notify full transposition, and decided to refer them to the Court of Justice. For Spain it had sent a letter of formal notice on 28 November 2024 and a reasoned opinion on 7 May 2025.

How incident response is organized

Spain has several response teams. Under the ENS, the National Cryptologic Center (CCN) organizes the response to security incidents around CCN-CERT. After an incident, CCN-CERT technically determines the risk of reconnecting the affected systems. The ENS text also names the ESPDEF-CERT of the Joint Cyberspace Command for military systems. INCIBE-CERT, run by INCIBE under the Ministry for Digital Transformation and the Civil Service, is the reference team for citizens, companies, digital service providers and private essential and important operators.

Sectors and rating

INCIBE-CERT handled 97,348 cybersecurity incidents in 2024, 16.6 percent more than in 2023. About two thirds affected citizens and one third affected businesses. It counted 42,136 malware cases, of which 357 were ransomware, and 21,571 phishing cases. It dealt with 341 incidents reported by essential and important operators under NIS2. These are INCIBE-CERT’s own counts of incidents it handled. They are not a count of all attacks in Spain.

Personal data

The Spanish Data Protection Agency (AEPD) is an independent administrative authority with state-wide scope, governed by Organic Law 3/2018. The AEPD says a personal data breach that risks people’s rights must be notified to it within a maximum of 72 hours of becoming aware.

The power outage of 28 April 2025 was not a cyberattack, according to the Ministry for the Ecological Transition. On 17 June 2025 it said a cybersecurity working group of more than 75 experts analyzed 133 GB of data and ruled out a cyberattack at the system operator, the control centers and the generation centers analyzed.

Official counts come from INCIBE-CERT for the incidents it handles. The official sources we opened give no overall attack count for Spain. More figures for Spain will come from Brandefense Atlas.