ENISA Threat Landscape 2025

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

CONTACT

For contacting the authors please use etl@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

AUTHORS

Jamila BOUTEMEUR, Ifigeneia LELLA, Ilias BAKATSIS, Georgios CHATZICHRISTOS, Kevin FOLEY, Jussi LESKINEN, Jakub OTCENASEK, Dominik ZIOLEK, ENISA.

EEAS STRATCOM.

CONTRIBUTORS

The ENISA Threat Landscape authors would like to express their appreciation to the EEAS STRATCOM and Europol EC3 colleagues, as well as the ENISA Incident and Vulnerability reporting services (IVS) and CIRCL colleagues for their active support to the report.

ACKNOWLDGEMENTS

The ENISA Threat Landscape authors would like to acknowledge the valuable feedback and validation of the members of the National Liaison Officers (NLO) network, of the CSIRTs Network (CNW), and of the ENISA Cyber Partnership Programme, as well as the comments received from our European Union Aviation Safety Agency (EASA) colleagues, I4C+ (Information and Analysis Center for Cities), the Financial Services Information and Analysis Center (FI-ISAC), and the European Rail Operators Information and Analysis Center (Rail-ISAC).

We also want to thank our ENISA colleagues, Apostolos MALATRAS, Stefano DE CRESCENZO , Razvan GAVRILA, Erika MAGONARA, Eleni PHILIPPOU, Edgars TAURINS, and Johannes CLOS for their input and overall support.

LEGAL NOTICE

This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to the Regulation (EU) No 2019/881. ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and it must be accessible free of charge. All references to it or its use as a whole or partially must contain ENISA as its source.

ENISA THREAT LANDSCAPE 2025

Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2025 This publication is licenced under CC-BY 4.0 “Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/). This means that reuse is allowed, provided that appropriate credit is given and any changes are indicated”. For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders.

ISBN:978-92-9204-723-8 ISSN: 2363-3050 DOI: 10.2824/1946374

ENISA THREAT LANDSCAPE 2025

TABLE OF CONTENTS

1. EXECUTIVE SUMMARY 6 2. METHODOLOGY 7 3. THREAT LANDSCAPE OVERVIEW 8 4. GENERAL KEY TRENDS 11

4.1 PHISHING REMAINS A PRIMARY INITIAL INTRUSION VECTOR 11

4.2 INCREASINGLY TARGETED CYBER DEPENDENCIES 11

4.3 CONTINUOUS TARGETING OF MOBILE DEVICES 12

4.4 THREAT GROUPS CONVERGING 13

4.5 PREDICTABLE USE OF AI 14

5. SECTORIAL ANALYSIS 16

5.1 PUBLIC ADMINISTRATION 17

5.2 TRANSPORT 20

5.3 DIGITAL INFRASTRUCTURE AND SERVICES 22

5.4 FINANCE 25

5.5 MANUFACTURING 26

6. CYBERCRIME 28

6.1 KEY CYBERCRIME THREATS 28

6.2 CYBERCRIME SECTORIAL IMPACT 31

6.3 CYBERCRIME GEOGRAPHICAL IMPACT 32

6.4 KEY CYBERCRIME TRENDS 33

6.4.1 Tactics, Techniques and Procedures (TTPs) 33 6.4.2 Evolution of the ecosystem 34

7. STATE-ALIGNED ACTIVITIES 36

7.1 KEY STATE-ALIGNED THREATS 37

7.1.1 Russia-nexus intrusion sets 37

ENISA THREAT LANDSCAPE 2025

7.1.2 China-nexus intrusion sets 39 7.1.3 North Korea-nexus intrusion sets 40 7.1.4 Rest of the World (RoW) 41

7.2 KEY STATE-ALIGNED TRENDS 42

7.2.1 Tactics, Techniques and Procedures (TTPs) 42 7.2.2 EU as a target, and as a lure 42

8. FOREIGN INFORMATION MANIPULATION AND INTERFERENCE 44

8.1 KEY FIMI THREATS 44

8.1.1 Russia-aligned Information Manipulation Sets 44 8.1.2 Other Information Manipulation Sets 46

8.2 KEY FIMI TRENDS 46

8.2.1 Tactics, Techniques and Procedures (TTPs) 46 8.2.2 Exploitation of strategic events 47

9. HACKTIVISM 49

9.1 KEY HACKTIVISM THREATS 49

9.2 HACKTIVISM GEOGRAPHICAL TARGETING 51

9.3 HACKTIVISM SECTORIAL TARGETING 52

9.4 KEY HACKTIVISM TRENDS 53

9.4.1 Tactics, Techniques and Procedures (TTPs) 53 9.4.2 Evolution of the ecosystem 54

10. TTPS & VULNERABILITIES 56

10.1 OBSERVED TACTICS, TECHNIQUES & PROCEDURES (TTPS) 56

10.2 VULNERABILITIES 57

10.3 RECOMMENDATIONS 61

10.4 SYSTEM HARDENING 62

10.5 ACCESS & PRIVILEGE 62

10.6 NETWORK PROTECTIONS 62

10.7 MONITORING 62

10.8 RESILIENCE 62

11. OUTLOOK & CONCLUSION 63 12. APPENDIX 64 ENISA THREAT LANDSCAPE 2025

12.1 TACTICS, TECHNIQUES & PROCEDURES (TTPS) 64

12.2 VULNERABILITIES 81

12.3 LEXICON 85

13. LOG HISTORY 87 ENISA THREAT LANDSCAPE 2025

1. EXECUTIVE SUMMARY

This year’s ENISA Threat Landscape (ETL) introduces a revised and concise format designed to deliver insights through a threat-centric approach and enhanced contextualisation. This edition integrates additional analysis of adversary behaviours, vulnerabilities and geopolitical drivers, aimed at both strategic and operational audiences, offering an actionable perspective on trends shaping the EU’s cyber threat environment.

The ETL 2025 provides an overview of the European cyber threat ecosystem from July 2024 to June 2025, drawing on nearly 4 900 selected and curated incidents. The reporting period highlights a maturing threat environment characterised by rapid exploitation of vulnerabilities and growing complexity in tracking adversaries.

Intrusion activity remains significant, with ransomware at its core. Cybercriminal operators notably responded to the actions of law enforcement by decentralising operations, adopting aggressive extortion tactics and capitalising on regulatory compliance fears. The continuous proliferation of ransomware-as-aservice models, builder leaks and the services of access brokers has further lowered barriers to entry and diversified ransomware families, fuelling a professionalised and resilient criminal ecosystem.

In parallel, state-aligned threat groups intensified their long-term cyberespionage campaigns against the telecommunications, logistics networks and manufacturing sectors in the EU, demonstrating advanced tradecraft such as supply chain compromise, stealthy malware frameworks and abuse of signed drivers.

Hacktivist activity continues to dominate reporting, representing almost 80% of recorded incidents and driven primarily by low-level distributed denial-of-service operations. While overall resulting in very low impact, these campaigns demonstrate how low-cost tools are scaled for ideology-driven operations.

Sectoral targeting patterns reinforce the EU’ systemic exposure. Public administration networks remain the primary focus (38%), notably for hacktivists and state-nexus intrusion sets, while transport emerged as a high-value sector, particularly maritime and logistics. Aviation and freight operations have faced ransomware disruptions, while digital infrastructure and services remain strategic targets for both cyberespionage and ransomware operators.

Phishing remains the dominant intrusion vector (60%) and is evolving through techniques used in largescale campaigns. The availability of phishing-as-a-service platforms demonstrates the industrialisation of phishing operations, enabling adversaries of all skill levels to launch complex campaigns. Abuse of cyber dependencies have also intensified, as shown by compromises in open-source repositories, malicious browser extensions and breaches of service providers, amplifying risk throughout interconnected digital ecosystems.

Across all campaigns, adversaries continue to rely on a consistent set of tactics, techniques and procedures. Vulnerability exploitation remains a cornerstone of initial access (21.3%), with widespread campaigns rapidly weaponising them within days of their disclosure—underscoring the need to ensure patch availability and to implement and enforce basic measures for cyber hygiene.

Artificial intelligence has become a defining element of the threat landscape. By early 2025, AIsupported phishing campaigns reportedly represented more than 80 percent of observed social engineering activity worldwide, with adversaries leveraging jailbroken models, synthetic media and model poisoning techniques to enhance their operational effectiveness.

The threat landscape depicted in this edition reflects how the cyber threat landscape is shifting toward mixed, possibly convergent pressure, with fewer single high impact incidents, and more continuous, diversified and convergent campaigns that collectively erode resilience.

ENISA THREAT LANDSCAPE 2025

2. METHODOLOGY

The ENISA Cybersecurity Threat Landscape (ENISA CTL) updated methodology published in August 2025 was used to write the ETL.

For the purpose of the ETL 2025 report, ENISA analysts collected and analysed 4 875 incidents, mainly based on information from open sources, as well as anonymised information shared by EU Member States (EU MSs) and members of the ENISA Cyber Partnership Programme . The reporting period referred to spans from 1 July 2024 to 30 June 2025, with the cut-off date being 30 June 2025.

As much as possible, primary sources are referenced in footnotes to substantiate ENISA’s analysis and assessments. ENISA appreciate that open sources and information shared voluntarily do not constitute a complete picture of the cyber threat landscape. Moreover, multiple caveats are inherent to open-source reporting. Those notably include reporting depth and temporality. For instance, vague sectorial or geographic reporting (i.e., ‘private companies’, ‘Europe’) is likely to impact ENISA’s dataset. Another caveat is the proper sectorial categorisation, especially when one incident impacts an organisation operating in multiple sectors. To avoid inflating the threat, ENISA analysts proceeded to a thorough curation of the dataset either by choosing one specific sector or by registering the incident as ’unknown’. While particular attention was paid to the matter, it is highly likely a deviation will remain.

It should be noted that incidents are not necessarily reported immediately or confirmed in open sources. For instance, where ransomware and DDoS are more immediate ‘visible’ threats, often claimed directly by their operators, cyberespionage campaigns are typically documented with a delay spanning from 6 months to more than 4 years. It should also be noted that, to some extent, increased reporting of a specific threat does not necessarily reflect an increased tempo but rather speaks to the audience’s interest.

The incidents analysed in the Foreign Information Manipulation and Interference (FIMI) section have been shared by the European External Action Service (EEAS) and based on the strategic FIMI monitoring efforts of the EEAS. They reflects patterns seen in known sources related to overt FIMI, or independently imputed operations by selected actors and on priority issues of the EEAS. The totality of the incidents used in the EEAS sample refers to activities suspected to be linked to Russian Information Manipulation Sets to different degrees. Data on cyber-related FIMI activities by other threat groups are not systemically collected. The evidence presented serves illustrative purposes and should not be used to draw conclusions about general trends in FIMI, as it reflects only a limited subset of threat actors’ activity.

Hence, this report should be seen as an overview of prevailing trends, constituting a snapshot of threats faced by EU MSs and EU-based organisations.

To differentiate between what was reported by other sources and ENISA’s assessments, words of estimative probability are used, with a matrix available in the Appendix.

Finally, the association of a threat with a particular nexus is solely based on attribution done by national authorities globally, and imputation (aka technical attribution) achieved by trusted private vendors, all referenced accordingly.

ENISA THREAT LANDSCAPE 2025

3. THREAT LANDSCAPE OVERVIEW

Based on the analysis of the dataset, social engineering tactics remain the primary entry point for threat actors, with phishing (including vishing, malspam, and malvertising) accounting for about 60% of observed cases. Exploitation of vulnerabilities (21.3%) remains a prevalent intrusion vector, followed by botnets (9.9%). Malicious applications represent 8%, showing that compromised or trojanised software and applications continue to play a role in system intrusions, while unauthorised access by insider threats (0.8%) contribute smaller but still relevant shares. Overall, the distribution underscores that while phishing dominates the threat landscape, technical exploits, malware delivery mechanisms and insider risks remain meaningful concerns.

The data shows clear contrasts between phishing and vulnerability exploitation as intrusion vectors. While phishing is the most common pathway, its impact is diverse. Approximately 73% of phishing cases are classified as unknown, reflecting unclear or varied follow-up of malicious activities, and 27% led to intrusions. In terms of payloads, phishing leads to the deployment of malicious code in 23% of cases, suggesting it might be primarily used for malwareless objectives. Vulnerabilities, on the other hand, show a more focused risk profile. Nearly 70% of vulnerability cases culminate in intrusions, with 30% categorised as unknown, and 68% of these vulnerability-based incidents result in the deployment of malicious code, indicating that the exploitation of vulnerabilities is often a direct precursor to the installation of malware.

The distribution of incident types is dominated by DDoS attacks, which make up about 76.7% of recorded cases. This category is overwhelmingly driven by hacktivist groups, which account for the majority of collected DDoS incidents, with cybercrime groups contributing a marginal fraction, often tied to extortion (e.g., ransom DDoS). Intrusions follow with 17.8%, dominated by cybercriminal activities, followed by statealigned intrusion sets, which typically pursue persistence. Hacktivists appear only marginally in intrusion cases. Defacements were almost exclusively associated with hacktivists, underlining their role as a symbolic tactic for visibility and protest rather than a sustained intrusion method.

ENISA THREAT LANDSCAPE 2025

The prevalence of cybercriminal-led intrusions is illustrated through the type of malicious code deployed following intrusions, as well as the outcome of recorded intrusions. The combined share of ransomware, banking trojan, and infostealers accounts for 87.3% of these intrusions.

Out of recorded intrusions, 68.6% led to data breaches leaked on cybercriminal forums for sale, including 2.8% of these advertised breaches being presented as a direct outcome of a ransomware attack. Data exfiltration, including credential theft (8.9%) and strategic data collection (21.3%) accounted for 30.2%.

The distribution of threat categories shows a clear concentration in a few areas. Mobile threats account for the largest share at 42.4%, highlighting how mobile devices continue to be a primary attack surface. Web threats follow with 27.3%, underlining the persistent exploitation of online services and applications. Operational technology threats represent 18.2%, reflecting the growing exposure of industrial and critical systems as they continue being increasingly connected and targeted. Supply chain risks make up 10.6%, showing that attackers are actively leveraging indirect pathways through third-party providers and dependencies.

ENISA THREAT LANDSCAPE 2025

Based on assessed objectives, cyber activities targeting or impacting the EU mostly pertained to ideology-driven incidents exclusively carried out by hacktivists through DDoS. Financially motivated operations were primarily carried out by cybercriminal operators, while a few cases were associated to hacktivist groups, and state-aligned threats. Finally, cyberespionage campaigns accounted for 7.2%.

ENISA THREAT LANDSCAPE 2025

4. GENERAL KEY TRENDS

4.1 PHISHING REMAINS A PRIMARY INITIAL INTRUSION VECTOR

Phishing continued to be the primary method for initial intrusion, remaining an effective technique to carry out credential theft, session hijacking, payload deployment or command execution.

ClickFix-style scams appeared during the reporting period with the technique gaining momentum in Q1 2025 for both cybercriminal and state-aligned intrusion sets , often disguised as fake CAPTCHA prompts on compromised or fraudulent websites. These overlays tricked users into executing PowerShell commands 4 5 under the pretext of human verification, leading to the installation of information stealers and loaders .

Another innovative technique was the weaponisation of compromised WordPress sites to distribute infostealers through drive-by downloads. From Q2 2025, threat actors embedded fake CAPTCHA and verification prompts into compromised websites to lure users into executing malicious payloads. The ClearFake campaign saw the distribution of credential-stealing malware including Lumma and Vidar, resulting in 9 300 confirmed infections . These campaigns leveraged legitimate browser interfaces and social engineering to create convincing lures.

Phishing-as-a-Service (PhaaS) platforms, designed to automate the generation of branded phishing kits by cloning login pages and distributing links through templated infrastructure, enable low-skill operators to emulate trusted brands. This is illustrated by the Darcula platform, seen impersonating more than 200 7 8 organisations, whose services were seen leveraged to target victims in more than a hundred countries . Another PhaaS called Lucid expanded their portfolio by supporting phishing campaigns via mobile messaging services—iMessage and RCS— enabling over 169 targets in 88 countries to be reached. Additional PhaaS developments include FlowerStorm, an adversary-in-the-middle kit mimicking Microsoft 365 portals and bypassing MFA .

Enabling endpoint protections evasion and email filtering, QR code phishing (aka quishing) was also reportedly seen, as observed in the Scanception campaign, where malicious QR codes embedded in PDF attachments were aimed at redirecting victims to credential harvesting pages hosted on trusted cloud 11 12 platforms; these targeted users globally, including in the EU .

4.2 INCREASINGLY TARGETED CYBER DEPENDENCIES

During the reporting period, cybercriminals increasingly targeted third-party providers, such as Digital 13 14 Services, highly likely as an opportunity to optimise the efficiency of their attacks . In mid-2024, the cyberespionage campaign Operation Digital Eye targeted professional IT providers in Southern Europe, aiming to infiltrate supply chains. Compromise attempts were reportedly unsuccessful . In March 2025, Plus Service, an external provider managing the Telemaco platform for multiple Italian transport companies suffered a data breach involving unauthorised exfiltration to a remote cloud, prompting temporary access restrictions while remediation was carried out. This notably resulted in the Mobilita di Marca (MoM) ticketing systems being paralysed for two days, impacting several thousand commuters . The same campaign

ENISA THREAT LANDSCAPE 2025

data of 180 000 BVG customers , and unauthorised access to Spanish energy company Repsol’s customers, resulting from the compromise of one of the company’s providers .

Adversaries were also seen exploiting the digital supply chain, notably by compromising software, repositories or browser extensions . Since 2022, and increasingly observed over the reporting period, DPRK-

nexus Lazarus leveraged supply chain compromise, with its most recent activities pertaining to the deployment of malicious Node Package Manager (npm) packages in GitHub repositories, mimicking legitimate 22 23 24 libraries to compromise developers’ environments . Of note, repositories remain particularly exposed to

secret sprawls stemming from insufficient protection with detected secrets reportedly increasing by 25% between 2023 and 2024 . A surge in attacks leveraging malicious browser extensions was observed in late 2024, with a campaign that compromised multiple companies’ Chrome browser extensions; these notably

4.3 CONTINUOUS TARGETING OF MOBILE DEVICES

Q1 2025 observed an increased level of reporting pertaining to the targeting of mobile devices, with Android

devices facing a higher level of threat.

Q3 2024 reportedly saw an uptick in the exploitation of outdated devices by the deployment of the Rafel RAT, primarily targeting Android devices for financially-motivated and cyberespionage purposes, notably in

Czechia, France, Germany, Italy and Romania , as well as the re-emergence of the Medusa banking trojan

updated with new features, and expanding their victimology to France and Italy . Medusa was notably observed focusing on On-Device Fraud (ODF) through Account Takeover (ATO). Leveraging the same

technique, BingoMod RAT was observed draining bank accounts and wiping devices, a concerning

evolution .

Android spyware for surveillance purposes used by State-aligned intrusion sets were also increasingly documented, with Reaper’s Android spyware KoSpy , or Android spyware BoneSpy and PlainGnome

leveraged by Uzbekistan-nexus Sandcat. Of particular interest is a report documenting EagleMsgSpy, a legal intercept surveillance program targeting Android devices, reportedly developed by Wuhan Chinasoft Token

Information Technology Co., Ltd. and used by Chinese Public Security Bureaus since at least 2017 . In

February, multiple cybersecurity vendors published reports pertaining to the targeting of mobile devices by Russia-nexus intrusion sets. Google Threat Intelligence Group (GTIG) reportedly observed Sandworm,

UNC5792, UNC4221 (aka UAC-0185) targeting the WhatsApp, Signal and Telegram accounts of individuals in

Ukraine . Notably Sandworm was observed enabling Russian military forces to connect Signal accounts on devices collected on the battlefield to actor-controlled infrastructure for follow-on exploitation. Sandworm was also observed abusing the ‘linked devices’ feature, by crafting malicious QR codes to link a victim's account to

an actor-controlled Signal instance, and operating WAVESIGN. Volexity and Microsoft also reported on the

ENISA THREAT LANDSCAPE 2025

leveraging of Signal, as part of a recent spearphishing campaign conducted by CozyLarch UTA0304, UTA0307 and Storm-2372 .

In October 2024, Qualcomm published a vulnerability impacting its Qualcomm’s Digital Signal Processor (DSP) software . The vulnerability has an impact on chipsets widely used by various mobile devices and was reported to have been exploited in the wild .

In 2025, iVerify published an in-depth technical report revealing that state-linked telecommunications providers continue to exploit vulnerabilities in outdated mobile signalling protocols—specifically SS7 and Diameter . These protocols, which underpin global mobile communications, were not designed with encryption or strong authentication, leaving them susceptible to interception, location tracking and session hijacking. iVerify demonstrated that operators with privileged access to international telecom infrastructure— such as China Mobile International and China Telecom Global—can remotely monitor and manipulate mobile communications across borders without needing access to the target’s device. These operations are silent, infrastructure-level and difficult to detect, posing significant risks to diplomats, journalists, and political actors.

4.4 THREAT GROUPS CONVERGING

Across the period, the lines between hacktivism, cybercrime and state-nexus activity continued to blur. Intrusion sets historically distinguished by TTPs’ level of advancement. conducted activities, or assessed objectives increasingly shared toolsets and modus operandi.

This was notably exemplified by hacktivist-led DDoS waves by pro-Russia groups around electoral events, where increased activity was often observed as typical FIMI-aligned behaviour to associate disruption with aspects of information operations. A prominent facet of this trend is faketivism, where state-aligned intrusion sets leverage hacktivist personas and activities. Notable examples include Cyber Army of Russia Reborn, 40 41 associated to Russia-nexus Sandworm , and the CyberAv3ngers group linked to Iran’s IRGC .

In parallel, hacktivist tooling and criminal ecosystems increasingly intersect. FunkSec’s emergence in late 2024 brought FunkLocker ransomware, blending political messaging with financial extortion, underscoring 42 43 how quickly ideology-driven branding can pivot to monetisation . Hacktivists, seeking funding and visibility, embraced ransomware beyond DDoS and defacements. CyberVolk, operating in line with Russian interests, has used and promoted multiple strains—AzzaSec, HexaLocker, Parano, as well as LockBit and Chaos— 44 45 46 since May 2024 . KillSec, originally a pro-Russia hacktivist brand aligned with Anonymous, debuted its platform in June 2024 .

Another aspect of this trend is the false-flag operation carried out by Turla, taking over Transparent Tribe’s 48 49 infrastructure , or cybercriminals masquerading as other cybercriminal groups or spoofing their brand, as notably seen with email extortion campaigns impersonating the CL0P ransomware group , physical

ENISA THREAT LANDSCAPE 2025

ransom letters mailed to executives by criminals masquerading as the BianLian ransomware group , or the

State-nexus intrusion sets also leveraged or brokered cybercrime tradecraft, as illustrated by DPRK-

nexus Kimsuky using the Clickfix technique, Andariel linked to the Play ransomware activity, likely as an

affiliate or IAB, and Moonstone Sleet reported leveraging the Qilin ransomware . Similar cross-over was

identified with China-nexus intrusion sets, with NailoLocker operations in June and October 2024 targeting the

EU health sector, and Mustang Panda leveraging the RA ransomware, plausibly in the frame of moonlighting

APT29 and Sandworm were observed using commercial residential proxy networks and sharing hosting with

cybercriminal groups adopted social engineering techniques seen used by state-nexus groups, as

observed with FIN6 leveraging job applications and fabricated LinkedIn personas to deliver malware, echoing DPRK’s playbook .

Finally, hybrid campaigns should also be mentioned in this section, especially with activities aligned with

Constitutional Court annulled the presidential first-round results after its intelligence agencies presented declassified findings that Russian-linked cyber operations—including coordinated social media campaigns

with AI-driven misinformation and alleged cyberattacks—distorted the electoral process in favour of the far-

right candidate . In March 2025, investigative reporting detailed pro-Russia groups using Telegram to recruit

4.5 PREDICTABLE USE OF AI

Over the reporting period, the continuous use of AI across multiple intrusion sets continued to be

observed, both as tools to facilitate or enhance offensive activities and as targets for exploitation. The large-

scale deployment and availability of AI systems objectively generate a new level of scalability in malicious

activity on the side of attackers . While AI-enabled threat activity previously involved attempts by threat actors

to use consumer-grade AI tools to augment existing operations, rather than achieve breakthrough capabilities,

the emergence of stand-alone malicious AI systems since the beginning of 2025 is of particular concern.

As a predictable trend, Large Language Models (LLMs) are leveraged to craft more convincing phishing

emails; with reportedly over 80% of all phishing emails identified between September 2024 and February

2025 using AI to some extent . AI is notably used in vishing and online fraud involving impersonation, with the

ENISA THREAT LANDSCAPE 2025

use of deepfakes , as well as for malware development . Threat groups were observed to be leveraging commercial LLMs to augment operations, as well as jailbroken or retrained (diverted) LLMs such as WormGPT, EscapeGPT and FraudGPT, to automate social engineering activities and accelerate

the development of malicious tools . China-nexus, Iran-nexus and DPRK-nexus intrusion sets were

reported using AI solutions, including Google's Gemini and OpenAI’s ChatGPT , primarily as research assistants for boosting productivity as well as for reconnaissance and anomaly detection evasion. Famous Chollima was notably seen using AI to generate convincing LinkedIn profiles and support communications with

victim organisations . The emergence of allegedly stand-alone malicious AI systems over the past two quarters, such as Xanthorox AI, likely indicates a trend of threat groups moving beyond jailbreaks towards

customised tools running on local servers to avoid detection .

Another noteworthy trend is the use of AI as a lure, in the context of the rising popularity of generative AI. Multiple sources reported the proliferation of fraudulent websites, impersonating legitimate AI tools such as

Kling AI, Luma AI, Canva Dream Lab and DeepSeek-R1, to deliver malware . Further reporting

included the deployment of ransomware and malware masquerading as legitimate AI tool installers .

Also observed was the targeting of the AI supply chain, with poisoned hosted machine learning (ML)

models and Python Package Indexes (PyPI) reportedly used to distribute trojanised packages , and a supply chain attack vector called ‘Rules File Backdoor’, enabling the injection of malicious instructions into

configuration files that AI coding assistants use, like Cursor and GitHub Copilot . Interestingly, and as generative AI becomes increasingly integrated into software development, the term ‘slopsquatting’ was

introduced . Although publicly available evidence suggests that misuse of LLMs and other AI tools occurs more frequently than direct efforts to compromise AI systems, researchers identified multiple Proofs of Concept (PoC) by which an intrusion set could subvert the intended function of AI models for malicious

purposes . The increased integration of AI systems into enterprise environments introduces a potentially vulnerable new attack surface. AI software is not immune to vulnerabilities, as exemplified by the critical

remote code execution vulnerability discovered in Langflow or Microsoft 365 Copilot . The infrastructure on which AI systems rely to operate has also been found vulnerable, for instance through CVE-2024-27564, a Server-Side Request Forgery vulnerability present in commit f9f4bbc, used within OpenAI’s ChatGPT

system .

ENISA THREAT LANDSCAPE 2025

5. SECTORIAL ANALYSIS

This section examines cyber threats from a sectorial perspective. While it includes the 18 sectors identified under the NIS2 Directive as high‑criticality or other critical, our analysis extends beyond these to consider a broader range of sectors. In our analysis, particular emphasis is placed on the five most targeted sectors to highlight key threat patterns.

Over the reporting period, ENISA collected and curated 4 875 events. 28.5% of the total number of incidents were not associated to a specific sector, either because the sector was not properly documented (i.e., private sector, private companies) or not mentioned at all. Once this significant share is redacted, the top five targeted sectors in the EU include public administration (38.2%), transport (7.5%), digital infrastructure and services (4.8%), finance (4.5%) and manufacturing (2.9%). While recorded incidents include non-NIS2 sectors, the close alignment of the top five targeted sectors with sectors explicitly covered under the directive confirms the relevance of the NIS2 approach , as essential entities represent 53.7% of

the total number of recorded incidents.

While public administration, transport and finance were already listed as the top targeted sectors of EU MSs in the previous reporting period, incidents targeting public administration substantially increased, notably due to the increase of hacktivist-led DDoS attacks against this sector. Overall, DDoS attacks were the most prevalent threat and affected multiple sectors in the EU (81.4%).

ENISA THREAT LANDSCAPE 2025 5.1 PUBLIC ADMINISTRATION

As in the previous ETL, public administration remains the most targeted sector (38%), showing a significant increase, primarily due to hacktivist-led DDoS attacks. The highest number of recorded incidents reportedly impacted the public administration sector in France (27%), Italy (26.3%) and Germany (16.2%), followed by Spain (15.3%) and Poland (15.1%).

The distribution of incidents affecting public administration over the reporting period shows that incidents primarily impacted regional (24.4 %) and central entities (15.1%).

ENISA THREAT LANDSCAPE 2025

Within the central entities category, defence and military related entities and intelligence and security services represented 2.4%, while law enforcement related bodies made up 0.9% and political parties represented around 0.1%. Diplomatic missions such as embassies accounted for 1.4%. Union entities and NATO Enterprise each contributed 0.7% of all incidents. 1% of recorded DDoS attacks targeting the websites of EU organisations were related to non-EU countries, namely Iranian or Israeli organisations.

Unsurprisingly, this threat picture is largely impacted by hacktivist-led DDoS (96.2%) attacks, with the targeting of public administration websites being the first-line option around specific events, such as takedowns and arrests, electoral processes or high visibility events , as illustrated with a few contextualised examples hereunder.

Hacktivist groups NoName057(16) (66.7%), Dark Storm (20%), and Keymous+ (13.3%) were the most active intrusion sets targeting public administration in the EU. Alliances such as 7 October Union and Holy League contributed to the increasing tempo and intensity of DDoS attacks targeting the websites and portals of public administrations in EU MSs, in the context of Russia’s war of aggression against Ukraine, as well as the Israel-Hamas conflict. Other claims made by these alliances also pertained to societal issues, including EU migration policies, LGBTQ+ legislation, or perceived anti-religious stances.

ENISA THREAT LANDSCAPE 2025

The EU public administration sector continued facing ransomware incidents (2.2%), which were particularly prevalent against municipalities. The most reported strains used against the public administration sector included NightSpire (41.7%), SafePay (33.3%), and Stormous (25%) ransomware. While accounting for 26 events against the EU’s public administration sector in the last ETL iteration, the LockBit ransomware was not seen to be active over this reporting period, highly likely as a consequence of law enforcement’s Operation Cronos in February 2024 . Data breaches relevant to the EU public administration accounted for 17% of all recorded data breaches.

Overall, the targeting of the public administration by State-nexus intrusion sets underscores a focus on diplomatic, and governmental entities, with Russia-nexus and China-nexus offensive cyber activities displaying the broadest sectorial spread, and India-nexus activity showing a clear unique focus on this sector. With a total of 77 incidents, and excluding unidentified sectorial targeting, public administration was the most targeted sector by state-nexus intrusion sets in the EU, for cyberespionage purposes.

China-nexus intrusion sets including APT31, Mustang Panda, and APT17 notably focused on government entities across several EU member states including ministries of foreign affairs and municipal administrations.

ENISA THREAT LANDSCAPE 2025

The targeting of the public administration by Russia-nexus threat groups such as APT28, APT29, Turla, and GoldenJackal, is more diverse, impacting diplomatic entities, ministries, law enforcement and political parties, in addition to core government institutions. A newcomer among the most active state-nexus intrusion sets in the EU, Sidewinder demonstrated a clear focus on diplomatic entities and governmental organisations within EU public administrations.

5.2 TRANSPORT

While remaining in second position compared to the previous ETL, the number of recorded incidents against the EU transport sector amounted to 7.5% of all incidents across all sectors. Of note, 12% of the incidents with a significant impact reported under the NIS directive in 2024 were incidents in the transport sector .

The distribution of incidents impacting the transport sector in the EU highlights a concentration of incidents in air transport (58.4%), followed by logistics (20.8%). Of note, it is likely logistics would include entities involved in air, water, road and rail transport.

Yet again, the transport sector was largely impacted by hacktivist-led DDoS attacks (87.6%); the most active hacktivist groups against this sector included NoName057(16) (36.4%), DarkStorm Team (15.4%) and Mysterious Team Bangladesh (6.2%).

ENISA THREAT LANDSCAPE 2025

This is notably illustrated by NoName057(16) explicitly mentioning announcements by Czechia, Latvia and Poland related to new bilateral security agreements with Ukraine as a trigger to target transport entities in 110 111 112 these EU MSs . In December 2024, Italy’s Malpensa and Linate airport portals were briefly 113 114 115 unreachable in attacks later claimed by NoName057(16) , likely in the context of Italy’s government decree to authorise the transfer of means, materials and equipment to Ukraine .

Cybercrime incidents against the transport sector accounted for 8.4% of all incidents, with ransomware accounting for 83.9% and data breaches 16.1% of cybercrime incidents.

Top three ransomware claims against the EU transport sector include Akira (12.9%), INC Ransom (9.7%), and Cl0p (9,7%). Despite being a small share of recorded events, ransomware displayed a more disruptive impact in a few cases. For instance, following an incident reportedly involving Akira ransomware, the Split Airport in Croatia saw the disruption of the passenger reception information system, ultimately impacting the landing and take-off of aircrafts and leading to a temporary 116 117 suspension of all flights .

ENISA THREAT LANDSCAPE 2025

While low overall (4.1%), the targeting of the EU transport sector by state-nexus threat groups was dominated by China-nexus and Russia-nexus intrusion sets (46.7%). China-nexus intrusion sets, including Mustang Panda, UNC5221 and APT41, notably focused on maritime and shipping and logistics subsectors across multiple EU MSs. This activity aligns with Beijing’ strategic interest in securing maritime supply chains and transport corridors tied to the Belt and Road Initiative, as well as maintaining visibility over European trade infrastructure. Russia-nexus intrusion sets, notably APT28, seemingly focused on air transport, logistics and freight, particularly in Germany, France and Belgium, likely reflecting Moscow’s broader strategy to target the critical infrastructure of NATO Allies, especially in the context of the war in Ukraine.

Smaller shares are associated to DPRK-nexus Lazarus (6.7%), possibly aiming at gathering strategic data pertaining to the evasion of sanctions. Rare Werewolf’s activity against logistics of an EU MS represent a residual threat, likely linked to spill over activities.

5.3 DIGITAL INFRASTRUCTURE AND SERVICES

For the purpose of this report, the notion of digital infrastructure and services (DIS) includes the digital infrastructure sector in accordance with NIS2, as well as incidents related to digital providers and ICT service management. With a share of 4.8% of overall incidents, DIS comes third in the top five targeted sectors across the EU over the reporting period. While the targeting of DIS likely stems from the sector being of high value for collecting data and disrupting services at a larger scale, it is likely this also speaks to the dispersed nature and heterogeneous levels of maturity of the organisations comprising this ecosystem.

ENISA THREAT LANDSCAPE 2025

Among DIS entities, the most impacted sub-sectors include telecommunications (25.1%), and digital services providers (DSP) (13.4%).

Hacktivist-led DDoS attacks against DIS websites accounted for 57.5% of attacks on EU DIS, with NoName057(16) (33.8%), Keymous+ (21.4%) and Mr Hamza (6.5%) reportedly the most active groups.

Representing 34.3% of overall incidents, the cybercrime threat to EU DIS includes data breaches (38%) and the deployment of Cl0p (9.8%), FOG, and Qilin (6.5%). It is highly likely DIS is perceived as a target of interest due to the amount and criticality of data they hold, as well as the opportunity to disrupt services across a large number of organisations, sectors and EU MSs, increasing the likelihood of ransom demands being met.

ENISA THREAT LANDSCAPE 2025

With a total share of incidents amounting to 8.2%, targeting DIS in the EU shows a clear concentration of a few key intrusion sets, notably a stark dominance of operations linked to Russia-nexus intrusion sets, primarily

driven by APT29 and APT28. These intrusion sets account for the majority of observed incidents, with campaigns targeting IT service providers and telecommunications companies. DPRK-nexus malicious activities against this sector are largely skewed by Famous Chollima’s activities targeting IT providers and

software developers in the EU , and the DeceptiveDevelopment campaign targeting freelance software

developers . In contrast, activity associated to China-nexus intrusion sets, notably Salt Typhoon, appears less frequently but concentrates on telecommunications infrastructure, with long running highly advanced

campaigns, consistent with the broader global patterns of China-nexus cyberespionage .

ENISA THREAT LANDSCAPE 2025 5.4 FINANCE

The finance sector accounted for 4.7 % of all collected incidents, with hacktivist-led DDoS attacks clearly dominating the threat picture, making up 83.5% of the incidents, followed by cybercrime (14.8%) and statealigned (1.7%).

Of note 11% of the incidents with a significant impact reported under the network and information security (NIS) directive in 2024 were incidents in the finance sector .

Within the finance sector, incidents are primarily concentrated in the banking subsector, which accounts for 21.6% of cases. The insurance subsector follows at around 3.4%, while blockchain-related services represent an exceedingly small share at less than 1%.

Banks are also the most targeted subsector by hacktivist groups (69%), likely in an attempt to create nuisances for the users of online banking services, ultimately contributing to the information operation component of hacktivism. NoName057(16) (71.1%), Keymous+ (13.7%) and DarkStorm Team (15.2%) were recorded as being the most active against the finance sector overall. Peaks of activity were notably observed around electoral processes in EU MSs , as well as during tense political and societal contexts at the national level in EU MSs, especially when related to polarising topics.

ENISA THREAT LANDSCAPE 2025

As they clearly process a significant amount of financial and personal data, financial institutions represent high value targets for cybercriminals. Data breaches pertaining to the finance sector amounted to 64% while ransomware accounted for 36%. The ransomware strains reportedly deployed against EU financial institutions were Akira (20%), Datacarry (12%) and BlackLock (4%).

Typically associated with DPRK-nexus intrusion sets, targeting of the finance sector over the reporting period by China-nexus intrusion sets was also observed, with an overall total of two incidents. While the widelyspread nature and lack of granularity of events associated to Lazarus does not allow for a more detailed analysis pertaining to EU organisations and based on Lazarus’ previously reported activities, it is highly likely this intrusion set still represents a primary threat to EU financial organisations.

5.5 MANUFACTURING

Despite a rather low share overall (2.9%), the manufacturing sector went from seventh to fourth place among NIS2 sectors compared to ETL 2024.

While a majority of impacted manufacturing organisations were unidentified (94%), the breakdown of identified subsectors shows a clear focus on defence and automotive related entities. As websites of these two subsectors were particularly targeted by hacktivist-led DDoS attacks (45.8% of manufacturing targeting by hacktivist groups), it is highly likely this justifies the EU MS ranking, where these EU MSs are perceived as particularly mature in both their defence and automotive sectors.

Similarly to the targeting of previously documented sectors, hacktivist activities against this sector (39.3%) were primarily grounded in the context of the support of Ukraine by EU MSs and led by NoName057(16) (75.6%). Hacktivist activity targeting the manufacturing sector included DDoS attacks and, in some cases,

ENISA THREAT LANDSCAPE 2025

attempts to disrupt operational technology systems These campaigns often aimed to publicly associate 132 133 manufacturers with geopolitical conflicts, particularly when firms were linked to defence supply chains .

Cybercrime is reportedly the primary threat to the manufacturing sector, both in terms of level of activity (59.3%) and reported impact. While data breaches accounted for 20.5%, the most deployed ransomware strains include Akira (48.7%), Qilin (20.5%), and FOG (10.3%). In H2 2024, multiple ransomware incidents resulted in prolonged disruptions to the business continuity of EU manufacturing organisations, including an attack by BlackBasta on the German consumer‑electronics maker Medion AG that resulted in prolonged IT 134 135 and website disruptions in November 2024 , and the targeting of the German Arntz Optibelt Group in 136 137 August 2024 that impacted their IT systems . These incidents illustrate the impact of ransomware on the manufacturing sector. As both companies operate globally, including in the EU, it is highly likely these attacks also had an impact in other EU MSs.

Based on reports mentioning the targeting of the manufacturing sector by State-nexus intrusion sets in the EU, two incidents were identified, including activity imputed to UNC5221 observed in Germany, while an unidentified China-nexus intrusion set was linked to a broader campaign involving clusters such as PurpleHaze and ShadowPad. This campaign, running from July 2024 to March 2025, affected over 70 global targets, including multiple entities in manufacturing. It is plausible that part of these activities would

pertain to the theft of intellectual property.

ENISA THREAT LANDSCAPE 2025

6. CYBERCRIME

While accounting for 13.4% of all incidents, cybercrime continued to remain a prevalent threat for the short-tomedium term, with encrypting ransomware constituting the most directly impactful threat. Over the reporting period, cybercrime activities targeting EU organisations notably included ransomware (81.1%) and data breaches (15.2%); the latter were specifically documented as resulting from ransomware incidents. The cybercriminal ecosystem structure was regularly impacted by the operations of Law Enforcement Agencies (LEA) and internal competition among cybercriminal groups.

6.1 KEY CYBERCRIME THREATS

Based on monitored Data Leak Sites (DLS) and cybercriminal forums, cybercrime claims accounted for 81% of activities.

Known EU victims include a broad range of sectors, with at least 36 sectors identified in total, including critical sectors as shown in the NIS2 Directive, with DIS and the manufacturing sector remaining the most impacted in the EU.

Over the reporting period, data breaches primarily impacted EU digital infrastructure and services (27.7%), notably through the sale of customer data from telecommunications providers, followed by the sale of data related to public administration (17%). Ransomware claims were made primarily against the manufacturing sector (14.9%).

While the recorded share of ransomware deployments remained stable, a shift in the ransomware ecosystem was observed over the reporting period, marked by a continuous fragmentation, ultimately leading to the emergence of new ransomware variants and Ransomware-as-a-Service (RaaS) programmes. A total of 82 ransomware variants were reportedly deployed against EU MSs organisations, with Akira emerging as the most frequently deployed (11.6%), followed by SafePay (10.1%), and Qilin (7.5%).

While a few major groups and ransomware strains were particularly prevalent in the previous reporting period, activity in 2024–2025 was more evenly distributed. This evolution is clearly illustrated by LockBit3, which accounted for nearly a quarter of all reported claims over the previous reporting period (ETL 2024) with 198 claims. In May 2025, the LockBit ransomware programme was reportedly compromised resulting in the leak of their internal database, which is likely justifying the absence of claims of this group since 27 May 2025 and the emergence of LockBit4 since April, notably leveraged by an operator called Syrphid . Similarly, a decrease in 8Base’s deployments followed partial infrastructure leaks and administrator arrests in early 2025 . Showing a significant decrease in EU deployments (0.73%) against Austrian, French, German and Italian organisations, BlackBasta stopped claiming incidents altogether since January 2025. In February, the BlackBasta group saw their internal chat messages leaked, exposing disagreements among members as well 141 142 as its toolset, eventually leading to the group’s infrastructure going offline .

ENISA THREAT LANDSCAPE 2025

Akira maintained a continuous but low tempo, SafePay rose to prominence in Q2 2025 , while Hunters International, which had sustained steady activity in 2024, recorded a decline following a public announcement

that it was shutting down in 2025 . RansomHub, previously one of the most deployed ransomware strains in

the EU, went offline on 1 April 2025 , shortly after increased activity around the formation of a new ransomware alliance led by the DragonForce group.

Info-stealers sold on cybercriminal marketplaces remained a consistent threat vector during the reporting period, primarily facilitating credential theft, session hijacking and access brokering. Although the impact of infostealers’ leveraging cannot be assessed, they continue to be key enablers of malware

deployments, making them a solid and prevalent link in the cybercriminal supply chain, as notably illustrated through the BlackBasta leaks .

The info-stealers market observed a significant disruption following Operation Magnus in October 2024,

which notably led to the dismantling and seizure of the infrastructure of RedLine and META, two prevalent 147 148 long-running info-stealer families . This led to the increased use of Lumma info-stealer by more than

350% between the first and second halves of 2024 . Within the EU, between September 2024 and March 150 151 2025 waves of Lumma infections were seen in Italy .

ENISA THREAT LANDSCAPE 2025

Lumma Stealer (aka LummaC2 Stealer) is a C language information stealer available through a Malware-as-a- 152 153 Service (MaaS) model on Russian-speaking forums since at least August 2022 . Data is exfiltrated to a C2 server via HTTP POST requests using the user agent TeslaBrowser/5. The stealer also features a non-resident

loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell , allowing for the

leveraging of this malware by ransomware operators and state-nexus intrusion sets .

Assessed as having remained the most prevalent info-stealer since the beginning of 2025, Lumma was

reportedly deployed on 394,000 Windows machines globally between March and May 2025, with a strong prevalence in the EU . In May 2025, joint international LEA action coordinated by Europol led to the seizing, takedown, suspension and blocking of approximately 2 300 malicious domains in Lumma’s infrastructure . A

few days following the takedown, Lumma seemingly resumed their operations .

Data breaches continued being observed, with high visibility cases pertaining in particular to public administration, digital infrastructure and services, and finance in the EU, and typically sold on forums by Initial

Access Brokers (IAB), ultimately leading to their exploitation in follow-up malicious cyber activities, including

phishing campaigns. Notable examples during the reporting period included the compromise of contact details 159 160 for over 62 000 Dutch police staff and the data of 3.2 million Belgian WhatsApp users advertised on

BreachForums as well as the personal and banking details of 15 000 customers of Direct Assurance, a

French company and claims of stolen source code and credentials of the Swedish company Nokia via a third-party vendor .

The IAB economic model was seen to be evolving, notably shifting toward lower-cost, higher-volume sales, 164 165 with most accesses reportedly priced under EUR 2 800 (about USD 3 000) ; IAB activities also

expanded, with a sharp increase of VPN access sale in 2024, while the sale of Personally Identifiable Information (PII) and Remote Desktop Protocol accesses remained stable.

Predictably, online scamming and fraudulent activity continued, and was noted over the reporting period.

While this type of basic activity is often given less attention in cyber security focused reporting, its simplicity and ubiquity merits at least a cursory mention. Recent cases illustrate how these seemingly ‘low-level’ scams

can evolve into complex, transnational criminal enterprises. In Poland, authorities dismantled an international

cybercrime group that impersonated bank and law enforcement officials, defrauding dozens of victims of nearly €570,000 (USD665,000) through spoofed calls and fraudulent transfers . On a much larger scale, a

Chinese group named Vigorish Viper was found to be behind illegal online gambling operations advertised

across European football stadiums . Vigorish Viper was also linked to human trafficking and cyber fraud compounds in Southeast Asia. Meanwhile, a Dutch court recently sentenced an individual for phishing, bank

helpdesk fraud and VIN fraud .

ENISA THREAT LANDSCAPE 2025 6.2 CYBERCRIME SECTORIAL IMPACT

Cybercriminal activities continued to impact multiple sectors in the EU in both NIS2 and non-NIS2 sectors. Over the reporting period, digital infrastructure and services was identified as the most targeted sector (13.7%), followed by manufacturing (13.26%) and business services (9.7%).

While ransomware attacks inherently

impact the confidentiality,

integrity and accessibility of data,

assessing their economic,

operational and reputational impacts

remains challenging. Within cybercrime activities, ransomware operators primarily claimed attacks against the Over the reporting manufacturing sector (14.9%) and DIS (10.3%). Data breaches were primarily claimed against period, a limited DIS (28.2%) and public administration (16.8%). number of attacks

impacting EU Overall, cybercrime incidents showed a broadly distributed targeting pattern, likely underscoring companies claimed prioritisation of achieving their lucrative-driven objectives over sector-specific targeting. by ransomware operators were In the second half of 2024, multiple ransomware incidents reportedly resulted in service 169 170 171 172 173 174 175 176 acknowledged, and disruption and/or interruption of EU organisations . Of interest is the wave of incidents that impacted the French media industry, with three incidents impacting the the operational

177 178 179 impact was sector in less than two months . As leveraged ransomware strains or initial intrusion vectors are not known, it is not possible to assess whether these incidents stemmed from documented in very

similar entry points, third party attacks or connections to specific geopolitical contexts. few cases. While it is likely some claims

are preposterous and ransomware

attacks do not systematically

impact operations, under-reporting and 169 https://therecord.media/kawasaki-europe-cyberattack-operations-restored 170 the superficial https://libertia.es/noticias-en-ciberataques-resumen-2024/ 171 https://www.lemondeinformatique.fr/actualites/lire-ransomware-les-boutiques-de-musees-francais-touchees-94449.html documentation of 172 https://www.cybersecitalia.it/attacco-ransomware-al-comune-di-fabriano-mette-fuori-uso-i-pc-e-causa-disservizi-agliutenti/37222/ ransomware attacks 173 https://www.lemondeinformatique.fr/actualites/lire-ransomware-les-boutiques-de-musees-francais-touchees-94449.html in open sources are 174 https://www.bleepingcomputer.com/news/security/lynx-ransomware-behind-electrica-energy-supplier-cyberattack/ 175 additional reasons https://www.universite-paris-saclay.fr/piratage 176 https://soziales.provinz.bz.it/de/news/technische-probleme-in-mehreren-zentralen 177 for this intelligence https://www.lemonde.fr/actualite-medias/article/2024/09/10/le-journal-la-croix-et-le-groupe-bayard-victimes-d-unecyberattaque-par-rancongiciel_6311493_3236.html gap. 178 https://www.lemonde.fr/pixels/article/2024/10/25/le-journal-liberation-victime-d-une-attaque-de-typerancongiciel_6359555_4408996.html 179 https://www.afp.com/fr/lagence/notre-actualite/communiques-de-presse/attaque-sur-le-systeme-dinformation-de-lafp

ENISA THREAT LANDSCAPE 2025

While incidents impacting the health sector accounted for only 4.2% of the overall cybercrime incidents identified, ransomware attacks against two German organisations that resulted in the postponement of 180 181 medical procedures remain of particular concern .

6.3 CYBERCRIME GEOGRAPHICAL IMPACT

Ransomware incidents continued affecting EU Member States, with a notable shift in geographical impact compared to ETL 2024.

The top five EU MSs referenced in ransomware and data breaches claims include Germany (23.4%), Italy (11.33%), Spain (9.8%), France (9.5%), and Belgium (3.7%). While this ranking could stem from multiple factors, and as analysed by the CCB, it is likely these EU MSs would be seen as major economic players within the EU and thus represent high value targets .

During the report period, manufacturing remained the most consistently targeted sector across all five EU MSs. Germany recorded the highest number of claims by SafePay, INC Ransom and Akira, with the most targeted sectors being manufacturing and digital services providers. Italy saw increased activity from Akira, Sarcoma, and Qilin, targeting the manufacturing sector, followed by digital infrastructure and services. Spain saw Qilin in first place, followed by Akira and FOG, with manufacturing being targeted the most, followed by business services and public administration. France was mostly impacted by Qilin, Hunters International, and CL0P, Belgium saw activity from RansomHouse and Play, alongside SafePay and Qilin. In both Belgium and France, manufacturing was the most targeted sector, followed by DIS.

ENISA THREAT LANDSCAPE 2025 6.4 KEY CYBERCRIME TRENDS 6.4.1 Tactics, Techniques and Procedures (TTPs)

Over the reporting period, cybercriminal groups were seen updating their TTPs, notably through the

development or maintenance of their toolsets, as well as their pressure tactics.

Reuse of leaked builders continued to be observed, as illustrated by the SafePay ransomware, suspected of

being derived from a modified LockBit3 builder . It is likely that publication of the VanHelsing RaaS source

code in May 2025 will be leveraged by other ransomware operators and contribute to the lowering of barriers of entry to the cybercriminal market for newcomers .

While infostealers continued to be delivered through cracked software, phishing pages and public code

repositories, new delivery mechanisms were observed, such as fake CAPTCHA verification pages, cloud-

based file hosting services and embedded links in video platforms as well as other high-traffic low-cost 185 186 delivery vectors .

During this reporting period, cybercrime groups started using tools designed to disable Endpoint Detection

and Response (EDR) solutions, enabling them to conduct stealthier intrusions focused on rapid data

exfiltration. In July 2024, FIN7 was observed advertising AvNeutralizer (aka AuKill), a specialised tool for tampering with endpoint defences, to multiple ransomware groups . The tool had been previously linked to

intrusions deploying AvosLocker, MedusaLocker, BlackCat/ALPHV, Trigona and LockBit , all of which were reportedly active in the EU. In August 2024, RansomHub started using similar tools, as can be seen by their 189 190 adoption of EDRKillShifter and TDSSKiller —leveraging them to disable EDR protections . In June 2025,

variants of EDRKillShifter started to be incorporated in multiple RaaS toolsets, including LockBit, Medusa, and 191 192 193 BlackCat/ALPHV . Another technique illustrating this trend is the use of a HeartCrypt-packed loader

with the malicious driver ABYSSWORKER in a Medusa ransomware chain, revealing how attackers exploit or

bring their own signed drivers to disable EDR systems . Of particular concern in this regard is the reported abuse of a legitimate tool called HRSworld , likely to be increasingly observed in cybercriminal activities.

Fog and Qilin, both relatively recent ransomware strains, relied on aggressive pressure tactics, including

countdown timers, victim profiles and downloadable sample files in double extorsion, targeting reputational damage or regulatory exposure , or in the case of Qilin a new ‘call lawyer’ feature, which mimics legal

escalation, pressuring victims to act quickly under the illusion of formal consequences . The legal pressure

developments are of particular relevance in the EU, where cyber incident reporting and GDPR obligations are likely to represent an additional incentive for impacted companies to pay the requested ransom.

Additional TTPs of interest over the reporting period include resorting to physical components . 199 200 Observed since at least the mid-2010s in China and globally since 2019 , pig-butchering scams are

increasingly reported as being leveraged to target citizens in EU MSs. In 2024, pig-butchering scams grew by

ENISA THREAT LANDSCAPE 2025

almost 40% year-on-year, reportedly generating between €9.1 (USD 10.6) billion and €11.4 (USD 13.3) billion,

and accounting for over one-third of global cryptocurrency scam revenue . Throughout this period, open

sources noted the increased use of generative AI and deepfake videos to impersonate trusted contacts,

enhancing the social-engineering phase of these scams. In late 2024, over two million accounts linked to pig-

butchering activity were taken down, much of it originating from criminal centres in Southeast Asia and,

an international operation dismantling a mobile-phone phishing network that unlocked over 1.2 million stolen

devices; elements of the compromised devices and stolen credentials had been repurposed for pig-butchering

outreach and cryptocurrency theft .

Of rising and significant concern is the physical targeting, including kidnapping, of crypto-asset holders and

often contain PII, including, in some cases, home addresses . Such physical attacks were publicly reported

6.4.2 Evolution of the ecosystem

As previously mentioned, the cybercriminal ecosystem underwent frequent disruptions, stemming

from internal competition, alliances and LEA operations .

RansomHub in April 2025 . The latter was announced to have joined the DragonForce-led coalition

alongside RansomBay in the same month . Since then, while DragonForce primarily claimed ransomware

incidents in the US, 19 EU MSs organisations were listed on their DLS.

Having faced a coordinated LEA operation as well as sanctions against one of their affiliates also linked to Evil

their affiliate management panel, and since May 2025 the group seems to have cease their activities. Whether

the newly documented LockBit4 operator Syrphid is a former LockBit affiliate was not known at the time of

reporting .

Multiple operations aiming at disrupting cybercriminal activities across the full supply chain included

operations against the communication means of cybercriminals, as illustrated by the dismantling of the

ENISA THREAT LANDSCAPE 2025

Nulled and BreachForums , and the seizure of the servers of cryptocurrency exchanges suspected

of being used to launder financial flows, notably originating from ransomware operations .

The 28 October 2024 takedown of RedLine and META infostealers under Operation Magnus resulted in

multiple arrests and server seizures across Europe and the US . These efforts continued with the arrest

of four leaders of the 8Base group on 10 February, which significantly reduced Phobos ransomware activity . A subsequent phase of Operation Endgame from 19–22 May 2025 neutralised seven malware families — Bumblebee, Lactrodectus, Qakbot, Hijackloader, DanaBot, Trickbot, and Warmcookie—commonly used by

Initial Access Brokers (IAB) to breach victim systems and enable the deployment of ransomware .

Law enforcement also focused on dismantling the services and networks that facilitate other forms of cybercrime. On 4 June 2024, Portuguese and Spanish authorities arrested 54 suspects in a vishing

operation . Between 10–17 September, Europol coordinated an operation with Ameripol that dismantled a

phishing network, which unlocked over 1.2 million stolen mobile phones and resulted in 17 arrests .

Other notable takedowns included the arrest of a suspect linked to DoppelPaymer ransomware in Moldova on

12 May , and Operation Macefall on 21 May, which seized over 2 300 domains tied to LummaStealer

infostealer operations . The month also saw authorities take down a group providing crypting and counter-

antivirus services on 27 May .

ENISA THREAT LANDSCAPE 2025

7. STATE-ALIGNED ACTIVITIES

In this section, ‘nexus’ should be understood as aligned or associated to some extent to a specific country, as reported in open sources, based on public attributions from national, EU and non-EU authorities as well as high confidence imputation by trusted private vendors.

State-aligned adversaries tracked by ENISA include state-nexus intrusion sets, hackers-for-hire, faketivists and private sector offensive actors (PSOAs). While also considered a part of state-aligned activities, Intrusion Manipulation Sets (IMS) involved in information operations are covered in a separate dedicated section of this report.

Among state-aligned adversaries, 46 distinct intrusion sets were observed to be active in the EUover the reporting period. Approximately 14.2% of state-aligned malicious cyber activities were not imputed to a known or newly documented intrusion set, with Russia-nexus recording the highest number of unidentified intrusion sets (47%), followed by China-nexus (43%) and DPRKnexus (36%). This gap likely stems from shifts in or the emergence of observed Tactics, Techniques and Procedures (TTPs) and toolsets leveraged by Intrusion Sets, known offensive cyber doctrines of specific nexuses (i.e. usage of front companies, contractors, digital quartermasters) and the diverse tracking and reporting practices of private vendors. While this lack of association does not impact detection strategy, it is likely to hinder accurate situational awareness and preparedness efforts.

Between July 2024 and July 2025, 7.2% of incidents associated with state-aligned activities against EU MSs were identified, with Russia-nexus intrusion sets documented as the most active, followed by China-nexus and DPRK-nexus intrusion sets. Over the reporting period, outliers

were identified, notably with activities

carried out by India-nexus intrusion sets. While accounting for a low share, statealigned cyberespionage remains a primary concern in the medium-to-long term.

ENISA THREAT LANDSCAPE 2025

Almost all EU MSs were reportedly targeted by State-aligned offensive cyber activities. While no information related to the targeting of Luxembourg was identified in open sources, it is plausible the targeting of this MS would be conflated in the ‘unidentified EU MS’ category. Accounting for 38% of the total number of reported targeting, this category notably includes vague phrasing documented in open-source reports such as ‘Western Europe’, ‘Southern Europe’, or ‘EU country’.

From a sectorial vantage point, the top five targeted NIS2 sectors in the EU by State-aligned threat groups based on open-source reports include public administration, transport, digital infrastructure, energy and health. As mentioned before, this ranking comes with multiple caveats, based on unspecified or non-granular reporting – notably exemplified by the ‘unknown’ and ‘private companies’ categories accounting for 33% of all recorded targeting as well as differences in sectorial worldwide reporting conventions. However, as will be detailed in the following sections and based on historical reporting, this graph is assessed to be a realistic snapshot of sectorial targeting by State-aligned intrusion sets.

7.1 KEY STATE-ALIGNED THREATS 7.1.1 Russia-nexus intrusion sets

Reportedly the most active over the reporting period, Russia-nexus intrusion sets continuously

targeted EU MSs in cyberespionage campaigns.

The most documented intrusion sets include APT29, followed by APT28, and Sandworm. Overall, Russia-nexus offensive cyber activities targeted the public administration with a clear focus on governmental and diplomatic entities, the defence sector and the digital infrastructure sector. While targeting multiple EU MSs, geographical targeting in the EU indicates a focus on Poland, France, Germany, Belgium and Greece.

Both sectorial and geographical targeting are

likely to be partly related to EU MSs’ support for Ukraine, in the context of Russia’s war of aggression against Ukraine since February 2022.

ENISA THREAT LANDSCAPE 2025

This is notably exemplified by spearphishing campaigns for cyberespionage purposes targeting EU MSs, with

a particular focus on transport , defence and logistics related entities as well as telecommunications

infrastructures and embassies carried out by APT28. This intrusion set was also observed targeting

political parties and institutions .

In the aftermath of its successful compromise of Microsoft systems in January 2024 , APT29 was reported to be conducting a global rogue RDP campaign using spearphishing emails to target multiple EU

MSs, the European Space Agency (ESA) and NATO Enterprise . Registration of the identified infrastructure reportedly started as early as August 2024, with domains notably impersonating Amazon and Microsoft services and masquerading as organisations in the government, NGO, military and IT sectors. APT29 was also seen resuming their wine tasting event spearphishing campaign, masquerading as an EU MS

embassy to target EU Ministries of Foreign Affairs .

Finally, assessed to be particularly advanced intrusion sets, Turla and Sandworm were both reported active in the EU. While focused on conducting cyberespionage and disruptive campaigns against Ukraine,

Sandworm’s apparent mandate still pertains to the energy vertical , notably illustrated by its targeting of a gas storage entity in an EU MS, as well as a spearphishing campaign targeting attendees at an EU-based

natural gas conference . Turla was reported as conducting a long-standing cyberespionage campaign seemingly focused on one specific EU MS, with multiple attempts against governmental entities between

January 2024 and May 2025 .

ENISA THREAT LANDSCAPE 2025 7.1.2 China-nexus intrusion sets

The top five China-nexus intrusion sets active in

the EU include UNC5221 (reportedly overlapping

with Volt Typhoon), Mustang Panda, APT41, Flax

Typhoon and Salt Typhoon. The overall targeting

of China-nexus intrusion sets in the EU indicates

a focus on the public administration, transport,

civil society and digital infrastructure sectors, as

well as consistent cyberespionage campaigns

against Italy, Germany, France and Belgium.

A more granular analysis of the sectorial targeting

by these intrusion sets shows a particular interest

in targeting governments and diplomatic entities,

aviation and maritime industries, NGOs and

human rights advocacy groups and

telecommunications. Slowly emerging as outliers

is the targeting of food manufacturing and agricultural research. It is likely these campaigns pertain to

strategic data collection and intellectual property theft, mirroring China’s Made in China 2025 (MIC 2025) goals for the acquisition of technology and transport connectivity related to China’s Belt and

Road project and logistics strategies in Europe. Civil society targeting likely reflects domestic priorities

around narrative control and the monitoring of dissident or diaspora networks.

While reportedly increasing in Asia, documented China-nexus cyber threats in the EU was particularly inflated

by the compromise of edge devices, notably leveraged in Operational Relay Boxes (ORBs) for follow-up

telecommunication providers, manufacturing, aerospace and public administration in the EU.

A similar pattern was seen with Flax Typhoon’s leveraging of the Quad7 botnet, compromising thousands of

Mustang Panda was also seen targeting governments and defence-related events in the EU .

Finally, and of particular concern, is the targeting of the telecommunications sector by China-nexus intrusion

sets, which is reportedly the unique focus of Liminal Panda, Locksmith Panda and Salt Typhoon ; these

ENISA THREAT LANDSCAPE 2025

were increasingly reported in Asia and the US. In the EU, Salt Typhoon has been active since at least

December 2024, with activities continuing in 2025, with at least three EU MSs impacted .

7.1.3 North Korea-nexus intrusion sets

Over the reporting period, DPRK-nexus intrusion sets were also seen to be active in the EU, particularly in Belgium, Italy, Germany and France. Famous Chollima was reportedly the most active, followed by Lazarus and Kimsuky. DPRK-nexus activity is heavily

skewed toward EU private companies, with a focus on Human Resources, financial services (including

crypto) and technology .

In addition to continuous job-themed campaigns notably conducted by Lazarus to target EU entities involved in the defence, aerospace, media, health and

energy sectors , Famous Chollima was seen as increasingly active, seeking employment as IT workers globally, including in EU companies, notably

defence and government-related entities

.

Following sanctions and indictments from US authorities , Famous Chollima reportedly increased

their activities in the EU since at least Q4 2024 . As an illustration of historical dual motivated DPRK-nexus alleged objectives, Famous Chollima operators were seen carrying out cyberespionage through strategic data collection and were reportedly leveraging extortion schemes upon termination of their contracts

to generate revenues .

While being continuously active against the Republic of Korea over the reporting period, Kimsuky was observed targeting a RoK based EU defence company and is suspected of having conducted spearphishing

activities against EU embassies .

ENISA THREAT LANDSCAPE 2025 7.1.4 Rest of the World (RoW)

Other state-nexus activities targeting the EU over the reporting period included offensive cyber operations

associated to India, Iran and PSOAs. Shifting from their historical regional targeting and emerging in the

EU in Q2 2024, India-nexus intrusion sets including Bitter and SideWinder conducted continuous

cooperation, likely reflecting India’s interest in understanding EU policy positions in the Indo-Pacific, maritime

security frameworks and technology transfer controls.

The activities of Iran-nexus intrusion sets displayed a low tempo with a narrow and clear focus on civil society

and NGOs, followed by public administration and transport. Active intrusion sets in the EU over the reporting

While the targeting of civil society and NGOs aligns with the historical activities of Iran-nexus intrusion sets for the surveillance of Iran’s diaspora and dissidents in the EU, it is likely the targeting of an EU MS government

would have been driven by the 12-day war between Israel and Iran.

Reportedly linked to Belarus, Ghostwriter continuously targeted Poland in spearphishing campaigns against

its public administration, specifically governmental and institutional entities while continuing focusing on

Ukrainian targets.

Assessed to likely be a spill over of offensive cyber activities in the context of conflicts, pro-Houthi intrusion

one occasion over the reporting period.

Finally, the abuse of technologies commercialised by Private Sector Offensive Actors, including Candiru,

NSO Group and Paragon Solutions continued targeting civil society in the EU. In July 2024, German MEP

Daniel Freund declared having been targeted by an attempt to deploy the Candiru spyware on his phone two

weeks before elections for the EU Parliament . Between December 2024 and February 2025, Pegasus

spyware infections were identified, with victims in Czech Republic, Poland and Spain. Victimology reportedly

. Since the beginning of January 2025, open-source reports documenting the use of Graphite spyware through the exploitation of 0-day vulnerabilities in WhatsApp’s end-to-end encryption and a zero-click

iMessage vulnerability tracked as CVE-2025-43200 emerged, reportedly targeting 90 individuals globally,

ENISA THREAT LANDSCAPE 2025 7.2 KEY STATE-ALIGNED TRENDS 7.2.1 Tactics, Techniques and Procedures (TTPs)

This section provides an overview of Tactics, Techniques and Procedures leveraged by State-aligned intrusion sets, as well as reported toolset developments. These are thoroughly documented in the appendix.

Most commonly seen TTPs leveraged across state-aligned intrusion sets include:

• Spearphishing • Exploitation of public-facing services and use of default credentials • Execution via PowerShell, credential brute-forcing and USB-based attacks

State-aligned intrusion sets continued updating and developing their toolsets to gain foothold and maintain stealth and persistent access to targeted information systems. Related key observations include:

• Innovative physical-layer-adjacent access vectors: Nearest-Neighbour Wi-Fi and Air-Gap Targeting: APT28’s nearest neighbour Wi-Fi attack enabled network breaches from adjacent infrastructures without direct proximity, while GoldenJackal demonstrated infiltration of air-gapped systems via malicious USB drives. • Networking and infrastructure exploitation: Threat actors compromise core network devices through the exploitation of zero-day and n-day vulnerabilities, such as UNC3886 targeting Juniper routers and Velvet Ant exploiting Cisco NX-OS zero-days. • Continuous shifts in programming languages: Re-implementation of existing toolsets in new languages to evade detection and improve portability. GoldenJackal transitioned from C# to Go, while APT35’s Cyclops is a Go-based successor to BellaCiao. • Anti-detection and evasion mechanisms: Multiple toolsets incorporate sandbox detection, obfuscation or legitimate software abuse to avoid security controls. Examples include SnipBot’s anti-sandbox checks and Mustang Panda’s abuse of Microsoft processes for injection. • Expanded targeting of Linux systems: Linux systems, especially in infrastructure and cloud environments, are targeted by malware such as WolfsBane, FireWood, and POOLRAT. • In-Memory malware deployment: Adversaries increasingly execute payloads entirely in memory, as seen in BackdoorDiplomacy’s QSC framework and APT29’s GRAPELOADER.

7.2.2 EU as a target, and as a lure

Over the reporting period, multiple state-nexus intrusion sets continued leveraging tailored lures impersonating EU institutions, officials and affiliated entities. These campaigns capitalised on the perceived legitimacy of EU branding, official communication styles, and references to policy-related events to increase the likelihood that recipients would engage with malicious content. This is notably illustrated by APT29 impersonating an EU Ministry of Foreign Affairs or referencing fictitious diplomatic events and cultural activities to target diplomatic staff in spearphishing campaigns, as well as mentioning ENISA in lure documents aimed at private companies. Similar examples include Callisto’s tailored phishing pages to mimic EU institutional correspondence , Storm-2372 masquerading as a member of the European Parliament’s Committee on Foreign Affairs , Laundry Bear’ spearphishing campaign posing as organisers of the European Defence & Security Summit in Brussels , and UTA0352 and UTA0355 impersonating officials from EU Member States such as Romania and Bulgaria, and Ukraine’s diplomatic missions to the EU and NATO . Additional use of the EU brand was illustrated by Earth Preta, a subgroup of APT41, embedding malware in

ENISA THREAT LANDSCAPE 2025

foreign policy briefings disguised as legitimate EU institutional documents , UNC3313 and UNC5667 impersonating the Hungarian government , Charming Kitten posing as EU-based journalists and think-tank researchers and Kimsuky leveraging EU-branded diplomatic meeting invitations containing malicious macros .

As previously mentioned, multiple state-nexus intrusion sets leveraged or compromised EU-based infrastructure to host C2 servers or support follow-up cyberattacks. Such tactics help obfuscate the true origin of traffic, exploit the trust associated with EU network assets and risk implicating EU countries in malicious activity purely on the basis of IP address attribution. China-linked intrusion sets made especially extensive use of EU infrastructure through Operational Relay Box (ORB) networks, incorporating devices, servers and hosting services in the EU . In other cases, EU-hosted servers were used to deliver secondstage payloads, such as the Remcos backdoor, in campaigns targeting Ukraine . Since 2023, Turla configured its KAZUAR backdoor to communicate via compromised WordPress installations hosted within the EU, further embedding malicious infrastructure in trusted environments .

From Q3 2024 to Q2 2025, multiple state-nexus intrusion sets targeted EU entities outside EU territory— focusing on diplomatic missions, development programmes, commercial operations and cultural institutions. These operations often aligned with the geopolitical priorities of associated nexuses, prioritising intelligence collection on foreign policy, trade negotiations and multilateral security cooperation. This is exemplified by campaigns carried out by Russia-nexus intrusion sets APT29 targeting EU diplomatic missions abroad . This is of particular concern, as overseas missions and affiliated organisations maintain regular contact with Brussels and EU Member State capitals, so compromises could facilitate lateral movement into core EU networks. This operational reality underscores the advantage adversaries gain by focusing on outposts in third countries, where strategic data can be collected in potentially more permissive environments.

State-nexus intrusion sets also targeted non-EU diplomatic missions, international organisations and commercial entities operating within EU territory, as exemplified by Callisto targeting Russian exiles in the EU, Charming Kitten leveraging journalist personas to approach Middle Eastern embassy staff stationed in 334 335 European capitals , Earth Preta targeting Asian diplomatic missions in EU capitals , and TAG-100 conducting reconnaissance activities against the Cuban embassy in France . In August 2024, as part of Operation AkaiRyū, MirrorFace was reportedly seen for the first time in the EU. Based on MirrorFace’s historical focus on Japan, it is highly likely that targeting the EU served as a vector to target Japanese entities .

ENISA THREAT LANDSCAPE 2025

8. FOREIGN INFORMATION MANIPULATION AND INTERFERENCE

8.1 KEY FIMI THREATS

This section was jointly written by ENISA and EEAS STRATCOM. Over the reporting period, multiple EU MSs were targeted by FIMI, primarily carried out by Russia-aligned Information Manipulation Sets, with increased activities around electoral events.

8.1.1 Russia-aligned Information Manipulation Sets

EEAS collected 86 FIMI operations targeting EU entities or EU MSs institutions. Known Information Manipulation Sets (IMS) accounted for 60.5% of all identified cases.

Russia-aligned IMS, including Doppelgänger, Matryoshka, Storm-1516, the Russian Foundation to Battle Injustice

and Portal Kombat, conducted FIMI operations against specific EU entities and EU MSs public institutions, notably in France, Germany and Poland. Heavily correlated with current events, identified FIMI aimed at interfering in key events such as elections or opportunistically exploiting breaking news events, including EU political events.

Among the 86 identified cases, 52 involved at least one known Information Manipulation Set (IMS) with Matryoshka (18 cases) being the most active. Doppelgänger (6), Storm-1516 (5) and Russian Foundation to Battle Injustice (4) were involved to a lesser extent. In 19 cases, the Portal Kombat infrastructure 338 339 was used to amplify content . In four additional cases, the case was imputed to another known IMS.

Approximately a quarter of the documented FIMI content focused on degrading the Union through negative narratives. High-ranking officials such as the President of the European Commission and the High Representative for Foreign Affairs and Security Policy and the Vice-President of the European Commission were frequently targeted ahead of key strategic events or discredited through the circulation of out of context pictures and quotes, disseminated via inauthentic articles and amplified by un-associated accounts , as well as statements from state-controlled Russian media .

Standing out in terms of both the frequency and diversity of operations against their public institutions, France, Germany and Poland are frequently targeted with narratives aimed at discrediting their government, military and intelligence services, often accusing them of destabilisation efforts abroad or failing in their fundamental 343 344 345 duties, such as protecting their own citizens . Police departments and public media outlets are commonly at the centre of Matryoshka campaigns, where they are either impersonated or misattributed to

ENISA THREAT LANDSCAPE 2025

increase legitimacy of false narratives. The intensity of attacks against public institutions tended to increase

around and during election periods or important political events.

Doppelgänger, a major and long-running IMS, recently imputed to Struktura and Social Design Agency, and reportedly directly funded by the Russian state was seen to be particularly targeting French, German and

Polish national audiences and public institutions, as well as the Union, most notably through inauthentic articles conveying anti-EU sentiments, especially in the context of Russia’s war of aggression against Ukraine.

With an initial focus on impersonating Western news outlets and government websites, Doppelgänger has

evolved into a multi-layered operation, reportedly deploying large networks of fake domains impersonating legitimate outlets designed to manipulate platform algorithms, running sponsored ads on Meta to drive

traffic to its deceptive sites and relying on large-scale Coordinated Inauthentic Behaviour (CIB) networks to

ensure widespread distribution. Over time, the campaign has shown resilience, by refining its techniques and

adapting to takedowns by hosting providers and social media platforms by re-registering websites under different Top-Level Domains (TLDs), migrating to different hosting providers and using disposable social

media accounts to amplify content . In December 2024, Doppelgänger-associated entities and individuals 349 350 351 were sanctioned by the EU , the UK and the US .

Notably known for its videos impersonating EU institutions such as the Parliament and the Commission, EU 352 353 354 MSs public institutions within the security sector and public media outlets, Matryoshka was reported to

be using AI-assisted voice cloning to increase perceived legitimacy of the impersonation videos , with June 2025 marking the first iteration cloning of the voice an EU official . The videos are amplified on X and Bluesky through two sets of coordinated inauthentic accounts (CIBs), the first set known as ‘seeder’ accounts

posting the videos, further shared through a larger set of accounts known as ‘amplifiers’. While targeting

similar audiences as Doppelgänger, Matryoshka impersonates French and German public institutions with 357 358 359 narratives addressing broader audiences with misleading narratives . The IMS strategically exploits

narratives during major events such as election campaign seasons in countries such as Poland and Moldova. Matryoshka has reportedly funnelled substantial operational resources towards Moldova .

articles in the English, French and German languages and display visual features mimicking Western media

outlets. These inauthentic websites, as well as X accounts, are used to strategically launder information, with some of them identified for their repeated involvement in FIMI operations including publication of fake

investigations, social media posts and videos. Over the reporting period, Storm-1516 notably focused its actions on the German legislative elections, publishing multiple narratives questioning the integrity of the

elections . Investigations show the involvement of individuals and organisations close to the Russian

government behind the operations carried out by Storm-1516 . Known for its overlap in amplification patterns with Storm-1516, The Russian Foundation to Battle Injustice often publishes content mostly in English,

German and French, such as inauthentic articles, which is then laundered and amplified across various

ENISA THREAT LANDSCAPE 2025

platforms, mostly X, Bluesky and, in some cases, Reddit . Identified content focuses on portraying the EU as a hegemonic power interfering in Member States politics, particularly undermining their democratic processes by alleging that the EU is persecuting opposition parties and even attempting to ban them or violating human rights .

8.1.2 Other Information Manipulation Sets

In August 2024, an open-source publication documented an information operation aligned with China’ strategic interests through social networks . Named Green Cicada Network, this campaign operated a botnet comprised of 5 000 AI-operated accounts on X, notably accounts purportedly originating from the EU, to target Western Europe audiences. This campaign is assessed as being carried out by Yukuo Cen (aka cenyk1230), a Chinese AI researcher employed at Zhipu AI, a company allegedly tied to the People's Liberation Army and Chinese intelligence services. Of interest is the convergence, mutual learning and

increasing alignment between Chinese and Russian IMS, and the adoption of Russian FIMI

disinformation TTPs by China, leading to overlapping narratives and coordinated influence operations where Russian and Chinese networks mutually amplify content, to notably spread anti-Western narratives – 368 369 notably when Chinese state-controlled media offer a platform to sanctioned Russian outlets . January 2025 saw the targeting of Spain in the China-aligned Spamouflage operation since December 2024, leveraging the floods in Valencia, Spain, to call for the overthrow of the Spanish government .

Also identified over the reporting period were Iran-aligned influence operations pertaining to the participation

of Israel in the Olympics , as well as operation A2Z, a campaign sharing similarities with VIGINUM’s (U) 373 374 notorious BIG, associated to the Baku Initiative Group (BIG) , notably targeting audiences in France, Italy, Poland and Germany .

8.2 KEY FIMI TRENDS 8.2.1 Tactics, Techniques and Procedures (TTPs)

FIMI activities targeting EU entities and public institutions in Member States leverage a wide array of techniques as defined by the DISARM framework .

• The use of Inauthentic news articles. This was the most common type of content to convey narratives against EU entities and public institutions in EU MSs (T0085 Develop Text-Based Content, T0140.001 Defame, T0066 Degrade Adversary). Articles are often transformed into social media posts either by taking the headline or a text extract to be amplified across platforms (T0084 Reuse Existing Content). • Fabricated investigations. EU entities and public institutions in EU MSs were the subject of fabricated investigations (T0085 Develop Text-Based Content, T0023.001 Reframe Context). Often originated by the Russian Foundation to Battle Injustice, the content was laundered through inauthentic websites and unattributed channels posting across platforms (T0119 Cross-Posting; 37.2%). It was translated and shared across multiple inauthentic websites and accounts on X (T0003 Leverage Existing Narratives, T0049.003 Bots Amplify via Automated Forwarding and Reposting). • Decontextualised quotes and images. FIMI actors aimed to discredit EU officials by decontextualising and reframing statements, image or previously published content (T0023.001 Reframe Context). While the

ENISA THREAT LANDSCAPE 2025

original content may be authentic, it is reframed to better fit FIMI narratives and disseminated by unattributed channels (T0049.003 Bots Amplify via Automated Forwarding and Reposting (T0140.001 Defame). • False documents. These were used to target mostly public institutions in EU MSs through misattribution. The documents allegedly ‘leaked’ are disseminated on social media through unattributed channels. (T0003 Leverage Existing Narratives). • Amplification by state-controlled channels. Official Russian and Belarusian state-controlled channels published content aiming to discredit the EU on multiple occasions, which was then disseminated in various languages by unattributed channels and at times the Portal Kombat infrastructure. (T0023 Distort Facts, T0140.001 Defame). • Artificial Intelligence. Over the past year, FIMI actors increasingly relied on Artificial Intelligence (AI) to facilitate their efforts, with 14.3% of recorded cases targeting EU entities and public institutions in EU MSs.

The TTPs shown in the graph hereunder are tagged according to the DISARM framework and give a general overview on the type of behaviour and assessed motives of the IMS.

8.2.2 Exploitation of strategic events

Over the reporting period, 72.5% of cases of FIMI campaigns targeting Union entities and EU public institutions either targeted an event or opportunistically exploited current news.

European institutions were targeted during the Polish elections mostly by the Doppelgänger campaign; this activity was complemented by Russian and Belarusian media. The IMS focused its efforts on targeting EU institutions, aiming to undermine key policies, particularly the Green Deal, while portraying Brussels as 378 379 interfering in Poland’s sovereign decision-making . Russian and Belarusian media activity focused on 380 381 accusing the EU, especially its Commission and Parliament, of interfering in the Polish elections .

ENISA THREAT LANDSCAPE 2025

In the context of the Romanian elections, FIMI activities targeting EU entities focused on accusing them of

attempting to manipulate the electoral outcome. Russian state-controlled media outlets and official

government channels played a key role in shaping and disseminating the core narratives , which were later

adapted and amplified through IMS, notably Doppelgänger and Portal Kombat. For instance, the Russian

Foreign Intelligence Services published a press release accusing the President of the European Commission

of pressuring Romanian authorities to arrest a far-right politician , which was reshared by Russian and

During the Moldovan Presidential elections and as the vote also included a referendum on EU accession, EU

entities were particularly targeted. Russian FIMI activities leveraged themes of interference, portraying the EU

as hegemonic and tyrannical. It particularly exploited topics linked to LGBTIQ+ rights to further these

narratives. Various behavioural patterns were leveraged in these incidents, including videos impersonating the

President of the European Commission and its Vice-President, and manipulated quotes of the EU

Besides elections, a wide array of events was exploited to further their narratives and degrade Union entities

and public institutions in EU MSs as illustrated by a video demanding the replacement of the EU ambassador to Niger, accused of misuse of funds and destabilisation following an EU announcement of €4.5 million in aid

to the flood ridden Sahel and Lake Chad regions . Similarly, Matryoshka leveraged the April 2025 European

power outage blaming it on EU sanctions on Russia and accusing the President of the European Commission

of blaming it on Russia .

ENISA THREAT LANDSCAPE 2025

9. HACKTIVISM

Despite their minimal impact and low-advanced attacks, hacktivist groups remained the most active threat against EU MSs, with claimed attacks continuously increasing over the reporting period, reaching 79% of total

incidents.

DDoS attacks against the websites of EU MSs constituted 91.5 % of incidents, with exceptionally low instances of claimed intrusions (5.1%), and data breaches (3.4%). Of particular interest in addition to the increased activity against EU MSs by pro-Russia hacktivist groups is the prevalence of pro-Palestine groups, likely related to announcements of an increasing number of alliances.

9.1 KEY HACKTIVISM THREATS

At least 88 hacktivist groups claimed they targeted EU MSs organisations. Pro-Russia nexus hacktivist groups remain prevalent, with 63.1% of attacks claimed by NoName057(16), followed by Keymous+ (14.1%), Dark Storm Team (12.1%), Mr Hamza (7.9%), and RipperSec (2.8%).

While the core hacktivist threat landscape is shaped by a few hacktivist groups, it is also populated by shortlived campaigns triggered by specific events with hacktivist groups claiming attacks and then disappearing, with claimed activities ranging from a few days to a few weeks.

The tempo of activity across the five most active hacktivist groups indicated differing operational patterns.

Pro-Russia NoName057(16) sustained the highest operational tempo, with continuous campaigns throughout the reporting period and a clear ability to mobilise rapidly across multiple EU states, likely due to their crowd-sourced model operationalised through the DDoSia platform. The Dark Storm Team also demonstrated a steady tempo, with frequent medium-scale operations, while Keymous+ displayed a spike-driven tempo, characterised by bursts of activity in specific quarters, notably against France and Estonia, pointing to possible ad-hoc mobilisation. Mr Hamza’s activity remained episodic, with periods of large-scale attacks followed by lulls. Finally, RipperSec exhibited a low but increasing tempo from September 2024 onwards.

ENISA THREAT LANDSCAPE 2025

alongside Lithuania and Germany. This illustrates a particular emphasis on EU MSs possibly being perceived as threats to Russia in that country’s ongoing war of aggression against

with sustained targeting of ministries, parliamentary websites and local municipalities as well as

IMPACT OF

finance, with a focus on banks and payment service providers, and transport, notably air and rail

DDOS

transport websites, with the occasional targeting of telecoms and hosting services.

ACTIVITIES REMAINED

declarations of support for Ukraine by EU MSs and Union entities, as well as socio-

political situations at the EU level. These are illustrated by their DDoS attacks against the MARGINAL.

websites of Europol and the European Parliament in response to EU foreign policy actions in For each most active

393 hacktivist group, September 2024 , and the targeting of Belgian electoral infrastructure for seven consecutive 394 395 analysis shows that days, in retaliation for that EU MS’s commitment to supply military equipment to Ukraine .

explicitly confirmed

396 disruptions are quite Assessed to be a ‘for-hire’ opportunistic group originating from North Africa , Keymous+ limited, with demonstrated a focus on France and Estonia, with activities in Belgium, Denmark and Keymous+ and Mr Germany. Most claims were related to public administration, mostly municipal and regional Hamza appearing government portals, followed by finance, notably insurance firms and regional banks, digital slightly more infrastructure, including domain registrars and cloud providers, education, and disruptive with media/entertainment. approximately 1.5%

of attacks resulting in The pro-Palestine anti-Israel Dark Storm Team primarily targeted Poland and Finland, followed websites slowdowns by France, Lithuania and Germany. The group’s campaigns were particularly prevalent against and/or disruptions. the EU public administration sector, followed by transport, finance and media/entertainment and Interestingly, while manufacturing. The Dark Storm Team focused heavily on Ministries of defence and Ministries of the most prolific in foreign affairs, aviation and airport services, and news outlets. terms of volume,

NoName057(16) The pro-Palestine anti-Israel Mr Hamza claimed attacks against France, Spain, Germany, activities led to Lithuania and Belgium, with attacks focused on public administration, with a notable targeting of almost no confirmed the manufacturing sector. The group was seen to increase its activities after Q4 2024, through outages, further their participation in the Holy League alliance, which reportedly gathered pro-Russia and pro- 397 398 399 400 401 402 corroborating the Palestine groups . Between February and March 2025, Mr Hamza was 403 hypothesis of an particularly involved in coordinated campaigns, including #op_france , #op_italia, #opromania, 404 405 406 information operation #opbelgium, and #opnato . aspect to activities

carried out by this The pro-Russia Rippersec, while relatively less active, demonstrated a slow but steady group. increase in activity against EU MSs throughout the reporting period. This group appeared to

specifically target the public administration and media/entertainment sectors, followed by

transport, with a claimed intent to target operational technology (OT).

ENISA THREAT LANDSCAPE 2025 9.2 HACKTIVISM GEOGRAPHICAL TARGETING

Over the reporting period, hacktivism-related activities in the EU mostly targeted organisations in France,

Italy, Poland, Germany and Lithuania.

While not all of them were necessarily linked with hacktivism, France was reportedly the second most targeted country in the world by DDoS attacks in 2023 . Peaks in activity identified in this EU MS were congruent with potentially divisive issues

relevant to the political and societal national context, as

The top five hacktivist groups targeting Italy included NoName057(16), Dark Storm Team, DXPLOIT, Mr Hamza and Alixsec, notably under the #OPItaly banner which was increasingly used in Q1 2025. While 416 417 418 attacks targeting public administration represented X% of the claimed activities of these groups , NoName057(16) and Dark Storm Team and DXPLOIT were observed targeting the transport sector. It may be noted that Italy reportedly faced increased targeting of OT systems by Z-PENTEST-ALLIANCE from Q4 2024 onwards.

Poland was, in particular, targeted by NoName057(16), Dark Storm Team, SERVER KILLERS, OverFlame, and Keymous+. More than half of hacktivist claims pertained to the public administration sector, followed by the finance sector, transport, and energy verticals. Of note, the energy sector in Poland appears to be of particular interest to NoName057(16) and OverFlame, both part of the Z-PENTEST-ALLIANCE, which demonstrated intent and capability to target OT systems.

In Germany, most active groups included NoName057(16), Keymous+, Dark Storm Team, Mr Hamza and Mysterious Team Bangladesh. Offensive cyber activities targeting the public administration remained prevalent, with one outlier identified as Mysterious Team Bangladesh seemingly focused on targeting the transport and energy sectors. Of interest also is the sustained targeting of finance and manufacturing entities by NoName057(16).

ENISA THREAT LANDSCAPE 2025

Accounting for approximately 70% of the claims against Lithuania, NoName057(16) was followed by Dark Storm Team, Mr Hamza, OverFlame, and Z-PENTEST-ALLIANCE. While NoName057(16), Dark Storm Team and Mr Hamza demonstrated a focus on targeting the public administration and transport sectors, NoName057(16) was also observed targeting the finance vertical.

A more granular analysis of our dataset shows some level of focus against specific EU MSs, with clear outliers being the activities of Keymous+ in Estonia and France, and Dark Storm Team activities against Poland and Finland. While it is not possible to establish a clear connection, it is plausible some hacktivist groups might have specific geographic assignments to support and/or complement activities against specific EU MSs.

As previously mentioned, peaks of hacktivist activity are typically observed following announcements 419 420 421 related to Ukraine , as notably exemplified by the launch of the #OPBelgium campaign following 422 423 424 Belgium’s announcement of €1B in military aid . A few outliers further illustrating this observation were identified in ENISA’s dataset. Between the end of April and May 2025, Anonymous VNLBN claimed at least 27 attacks against France, following announcements of support for Ukraine and the freezing of Russian assets . Fredens of Security’s targeting of Italy, Germany, Denmark and Poland between 12 and 15 December 427 428 429 2024 followed declarations of assistance and equipment deliveries to Ukraine . The targeting of Belgium by INDOHAXSEC TEAM from 10 December to 12 December 2024 may be viewed in the context of the European Council’s approval of the second payment under the EU’s Ukraine Facility . It may be noted that these groups were only active for these very short-lived, highly focused operations.

Finally, EU MSs electoral processes over the reporting period were particularly targeted by hacktivist-led 431 432 433 DDoS claims .

9.3 HACKTIVISM SECTORIAL TARGETING

Across the EU, targeting patterns reveal both common sectorial focuses and country-specific nuances, with public

administration, finance, transport and digital infrastructure remaining the

prime targets across all EU MSs. The targeting of manufacturing and energy sectors is prevalent in Poland, Czechia and Romania, all three being heavily involved in supply-chain support for Ukraine. Over the reporting period, the most impacted sectors by hacktivist activities in the EU included public administration (63.1%), transport (12%), finance (11.7%), digital infrastructure (5.4%), and manufacturing and media/entertainment (4% each).

ENISA THREAT LANDSCAPE 2025

Consistently targeted over the reporting period and across all EU MSs, public administration was the most targeted sector, specifically governmental websites (51.5%) and municipalities (34%). The most impacted EU MSs overall were Italy, France, Spain, Poland and Germany, and the most active hacktivist groups targeting this sector were NoName057(16), Dark Storm Team, Mr Hamza, Keymous+ and Mysterious Team Bangladesh. As an EU MS supporting Ukraine and the host country of several EU and international organisations, the targeting of public administration in Belgium remains prevalent, with incidents related to this sector representing a disproportionately high share of Belgium’s overall targeting, often accounting for more than half of all incidents. This iteration also saw an increased targeting of intelligence and security services, with incidents concentrated in a few EU Member States in Eastern and Northern Europe where law enforcement has taken high-profile actions against hacktivist groups. These attacks tend to occur as retaliatory spikes rather than sustained campaigns, reflecting hacktivist attempts to signal against domestic security institutions.

Accounting for 6.1% of all recorded hacktivist-led incidents, the transport sector was particularly targeted in Poland, Germany and Italy, with a prevalence of attacks on air and rail transport entities. NoName057(16), Dark Storm Team, Mr Hamza, Keymous+ and RipperSec were reportedly the most active groups in targeting this sector.

The same group of hacktivists were also recorded targeting the finance sector, with a focus on the publicfacing portals of banks, particularly in Italy, Spain and France.

While less prevalent and quite volatile from one month to the next, the targeting of digital infrastructure by hacktivist groups is of particular concern due to its potential for systemic, cross-border impact. This sector was seen targeted by NoName057(16), RipperSec, Dark Storm Team, Keymous+ and Mr Hamza, with the most targeted EU MSs being Germany, the Netherlands and France.

Interestingly, the manufacturing sector, especially defence-related and automotive-related entities, were seen particularly targeted by RipperSec, followed by NoName057(16), Dark Storm Team, Keymous+ and Mr Hamza; these attacks were most prevalent in Germany and Poland.

Finally, the French and German media/entertainment sector, specifically news outlets and broadcasters, were in particular targeted over the reporting period, with the most active groups including Mr Hamza, NoName057(16), Dark Storm Team, Keymous+ and RipperSec.

9.4 KEY HACKTIVISM TRENDS 9.4.1 Tactics, Techniques and Procedures (TTPs)

In addition to adopting allegedly advanced TTPs for DDoS attacks, hacktivist groups were increasingly reported leveraging ransomware, as well as targeting OT.

Multiple open-source reports notably documented the use of carpet bombing or routers leveraging as well as AI to increase intensity and the potential impact of their DDoS attacks. According to a report by Netscout related to the first semester of 2024, bot-infected devices rose by 50%, largely due to the emergence of the Zergeca botnet alongside the evolving DDoSia botnet used by NoName057(16), which employs DNS over HTTPS (DoH) for Command and Control (C2) activities. Leveraging or transitioning to ransomware is particularly prevalent among pro-Russia groups, as illustrated by the launch of their own RaaS by the 435 436 437 CyberVolk’s, Azzasec, Funksec and Lapsus$ groups . KillSecurity, originally a pro-Russia hacktivist group aligned with Anonymous, transitioned into a notable player in the ransomware landscape following the

ENISA THREAT LANDSCAPE 2025

launch of its RaaS platform in June 2024 , and has targeted multiple EU MSs ever since, with increased

activity reported in April 2025.

Hacktivist groups continued displaying intent, capacity and opportunity to target OT systems, as illustrated by Z-PENTEST-ALLIANCE’s claimed targeting of Internet-accessible OT management interfaces

reportedly did not result in significant operational impact, the sharing of videos showing Z-PENTEST-

ALLIANCE operators tampering with OT systems is assessed to aim at amplifying the threat for psychological

impact. Z-PENTEST-ALLIANCE reportedly became the leading hacktivist group targeting critical

infrastructure, with a focus on energy infrastructure in the EU, with Italy documented as the most frequently

targeted EU MS in OT attacks by hacktivists, followed by the Czechia, France, and Spain . Z-PENTEST-

ALLIANCE has increasingly proclaimed its intention to target OT since Q1 2025, notably through their alleged

association to Russia-nexus intrusion set Sandworm. While Sandworm was previously documented operating

the Cyber Army of Russia Reborn (CARR) faketivist group, this claim cannot be verified and is assessed as

doubtful at the time of reporting. Emerging in June 2025, the Infrastructure Destruction Squad (IDS)

reportedly developed the VoltRuptor ICS specific malware, reportedly offering advanced multi-protocol support

and advanced persistence and anti-forensics capabilities to enable cross-platform operations. On 30, June

2025, IDS reportedly compromised an Italian smart building automation company. Of note VoltRuptor is

documented as being available for sale on the dark web. As this threat is too recent to assess, the leveraging

of the IDS persona by a Russia-nexus intrusion set is a realistic working hypothesis.

9.4.2 Evolution of the ecosystem

In addition to previously mentioned hacktivist activities overlapping with cybercrime TTPs and ecosystems,

newly formed alliances gathering together hacktivist groups with seemingly distinct ideologies were

announced during the reporting period.

formation of The Holy League, announced in July 2024 , reportedly gathering 70 groups, including pro-

supporting Ukraine and Israel, as well as NATO Allies, including EU MSs. The Holy League notably targeted Spain in retaliation for the arrest of individuals linked to NoName057(16)’s DDoSia, which led to

ENISA THREAT LANDSCAPE 2025

websites of French governmental entities and financial systems , in the context of the Ukrainian President’s visit to Paris to hold a ‘Trilateral meeting’ with the French President and the then US presidentelect.

The hacktivist ecosystem was also impacted by disruptions to their tools and means, as seen with Telegram’s increased cooperation with law enforcement, operationalised through the ban or take downs of more than 60

hacktivist-linked aliases in Q1 2025 . This notably resulted in hacktivist groups migrating to private Telegram

rooms , X , Element , and dark web forums . In October 2024, Operation PowerOFF saw LEAs from

15 countries shut down 27 DDoS-for-hire platforms and arrest three administrators . This effort was expanded in February 2025, when a follow-up operation took six more DDoS-for-hire platforms offline and

resulted in four arrests and nine domain seizures .

Examples of potential identity spoofing were also reported for the first time, with the claimed reappearance of

ENISA THREAT LANDSCAPE 2025

10. TTPS & VULNERABILITIES

This section discusses the technical coverage of adversary behaviours across the attack lifecycle, mapped directly to MITRE ATT&CK IDs to provide an actionable foundation for SOC teams, detection engineers and threat hunters seeking to prioritise coverage of common attacker techniques and align their defensive strategies with relevant mitigations. The MITRE ATT&CK framework organises real-world observations into a matrix of tactics and techniques, offering detailed examples, detection guidance and mitigations . The structured mapping highlights a strong defence-in-depth posture, with an emphasis on access controls, privilege restrictions, endpoint visibility and proactive detection of stealthy malicious behaviours.

10.1 OBSERVED TACTICS, TECHNIQUES & PROCEDURES (TTPS)

TTPs describe how adversaries operate, with Tactics describing their objectives, Techniques documenting the general methods they use and Procedures detailing the specific steps or tools they employ. Based on opensource reports, ENISA’s dataset focuses heavily on post-compromise activities, particularly reconnaissance conducted by adversaries and methods to maintain access or execute malicious payloads after initial intrusion. Documented tactics associated with TA0040: Impact, TA0010: Exfiltration and TA0009: Collection are less frequent. At the technique level, the dataset highlights the recurring tradecraft of adversaries

around specific tactics.

Figure 42 represents a clustered visualisation of common TTPs based on ENISA’s dataset.

ENISA THREAT LANDSCAPE 2025

A cluster appears around the discovery techniques (e.g., T1057 Process discovery, T1016 System network configuration discovery, T1082 System information discovery, T1083 File and directory discovery, T1135 Network share discovery), indicating they are frequently enumerated together under the discovery tactic, which is typical when adversaries inventory systems and networks.

A second cluster centres on execution techniques — notably the command and scripting interpreter family (T1059 and sub-techniques T1059.001/.003/.005) and related execution vectors (T1047 WMI, T1106 Native API, T1569.002 Service Execution, T1204.* User Execution). Persistence shows its own block (T1543.003 Windows Service, T1112 Modify Registry, T1547.* logon/registry autostart, T1136 Create Account, T1078.* Valid/Domain/Local Accounts), Persistence techniques like Windows Services (T1543.003), registry changes (T1112, T1547.) and account creation or abuse (T1136, T1078.) often appear together, showing how adversaries are able to layer multiple foothold methods. Smaller but coherent blocks appear for Exfiltration (T1041, T1048., T1052.001, T1567.) and Impact (T1485/86/89/90/91.001/1529).

A more detailed version of TTPs is available in the Appendix.

10.2 VULNERABILITIES

When documenting tactics, techniques and procedures (TTPs), it is important to recognise that vulnerabilities are part of the picture. Exploitation of vulnerabilities remains a prevalent intrusion vector (21.3%). Vulnerabilities are commonly assigned identifiers and, when included in TTP documentation and thoroughly documented, these connect adversary behaviour to the precise weaknesses they exploit. Tracking vulnerabilities with the surrounding TTP context supports effective prioritisation. By embedding vulnerabilities within the broader structure of TTPs, defenders gain both the technical detail needed for patching and the operational context needed to assess risk and allocate resources effectively.

In line with Coordinated Vulnerability Disclosure practices in the EU and complementary to its role as a CVE 479 480 Numbering Authority (CNA) , ENISA maintains the European Vulnerability Database (EUVD) to further support the cybersecurity community by providing reliable and timely information related to vulnerabilities.

Overall, 42 595 new vulnerabilities were disclosed over the reporting period — a 27% increase from the previous year. A break-down of the vulnerabilities in the Common Vulnerability Scoring System (CVSS) shows that 7% were Critical, 26% High, 43% Medium and 3% Low, while 21% remained unscored, likely reflecting delays or gaps in CVSS assignments.

ENISA THREAT LANDSCAPE 2025

When considering the attack surface, 64% of documented vulnerabilities use the network as the attack vector, in accordance with the definition of the CVSS Attack vector metric . This underscores the potential risk of remote exploitation, especially for Internet-facing systems.

Based on the Common Weakness Enumeration (CWE) list, 2024 most commonly saw the following top 25 weaknesses in hardware and software, that could have security ramifications.

Fig. 45, Top 25 commonly seen CWEs. Source : CWE list

ENISA THREAT LANDSCAPE 2025

The top 20 vendors whose solutions were reported as vulnerable accounted for 29% of all newly disclosed documented vulnerabilities over the reporting period, with top three vendors with the highest count of vulnerabilities disclosed as high and critical being Microsoft, Adobe, and Qualcomm Inc.

It should be noted that this distribution is likely to be inflated by CVE assignment policies, as is the case for Linux-related vulnerabilities, which also include bug fixes .

ENISA THREAT LANDSCAPE 2025

Based on CISA’s catalogue of Known Exploited Vulnerabilities (KEV) , 245 vulnerabilities were added over the reporting period, for which the top ten mentioned vendors concerned are displayed in Figure 47.

The top three Common Weakness Enumeration related to known exploited vulnerabilities in the reporting period are: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), and CWE- 416: Use After Free. All these weaknesses can cause vulnerabilities that allows in memory modification, code execution which could lead to take full control of the impacted system, as well crashes and denial of service, impacting the availability of the services run on or through the impacted system.

ENISA THREAT LANDSCAPE 2025

From an EU vantage point and based on ENISA’s open-source collection, at least 115 exploited vulnerabilities were reported impacting and/or targeting EU MSs organisations .

This includes vulnerabilities that were subject to a coordinated publication of advisories by the European 485 486 Union CSIRTs Network (CNW) members and confirmed to be exploited in open sources. While not the only factor, vulnerability distribution also speaks to the equipment rate in the EU. For instance, Microsoft largely dominates across the environments of consumers and public and private organisations .

Further analysis of the ENISA dataset with vulnerabilities matched against MITRE ATT&CK IDs confirms that

attackers consistently exploit Internet-facing

applications (T1190). Vulnerabilities impacting Confluence, Exchange (ProxyLogon/ProxyShell), Citrix NetScaler, Fortinet/Check Point/Palo Alto VPN appliances, PaperCut, TeamCity, ActiveMQ, vCenter and Zimbra dominate the set — typical of mass-exploitation waves where perimeter services are scanned and compromised within hours of disclosure.

A smaller but critical part consists of local privilege-escalation (T1068) under which vulnerabilities such as PwnKit and Windows CLFS were exploited, which enable webshell footholds into SYSTEM/Domain Admin and facilitate lateral movement. On the end-user side, client execution (T1203) remains prevalent (Office Equation Editor, WinRAR, browser zero-days), almost always appearing alongside phishing (T1566.001) or drive-by compromise (T1189) as the delivery vector.

These TTPs reflect a combination of opportunistic exploitation of exposed services and targeted postexploitation to maintain persistence, escalate privileges and exfiltrate data.

10.3 RECOMMENDATIONS

Based on identified TTPs, including the vulnerabilities listed hereabove, all identified malware types stress

execution prevention, endpoint behaviour monitoring, privilege control, network filtering, auditing and

user training, forming the baseline of cyber hygiene. Together, the three categories illustrate the need for an evolving defensive posture: from preventing initial compromise, to containing impact, to safeguarding

against long-term remote access.

For loaders, mitigations focus heavily on blocking initial execution and persistence. Restricting registry, DLLs and software installation are central, reflecting loaders’ role as initial footholds. Mitigation against ransomware build on the loader baseline but emphasise the need for resilience and business continuity. Backup, remote storage, data loss prevention and network segmentation are critical. Identity management (password policies, MFA implementation) is reinforced since ransomware operators rely on credential abuse during lateral spread. Sharing ransomware’s depth mitigation measures against RAT also include controls against long-term persistence (library loading restrictions, account use policies). RAT mitigations reflect both stealthy footholds and

ENISA THREAT LANDSCAPE 2025

extended command-and-control activity, blending loader-style entry controls with ransomware-style resilience measures.

10.4 SYSTEM HARDENING

Strengthening the foundation of operating environments is central for prevention. Measures include Execution Prevention (M1038) and Behaviour Prevention on Endpoint (M1040). Baseline controls such as Operating System Configuration (M1028), Software Configuration (M1054), Active Directory Configuration (M1015) reduce the attack surface. Additional safeguards include Restrict Registry Permissions (M1024), Restrict File and Directory Permissions (M1022), Restrict Library Loading (M1044). Validation mechanisms such as Code Signing (M1045), Disable or Remove Feature or Program (M1042) further reduce exposure by ensuring only trusted components and essential features are present.

10.5 ACCESS & PRIVILEGE

Identity and access controls form a critical line of defence. These include User Account Management (M1018), Privileged Account Management (M1026), User Account Control (M1052), which enforce least-privilege principles. Limit Software Installation (M1033) reduces unauthorised application deployment. To counter credential misuse, Password Policies (M1027) and Multi-Factor Authentication (M1032) strengthen identity assurance, while Account Use Policies (M1035) ensure proper oversight of account activity.

10.6 NETWORK PROTECTIONS

Preventing malicious communication and lateral spread relies on layered network defences. Network Intrusion Prevention (M1031) and Filter Network Traffic (M1037) provide frontline detection and blocking. Network Segmentation (M1030) contains threats within isolated zones, while Restrict Web-Based Content (M1021) reduces exposure to drive-by downloads and malicious sites. To further limit unauthorised communications, Limit Access to Resource Over Network (M1048) enforces strict control over resource availability across the network.

10.7 MONITORING

Effective oversight ensures early detection of malicious activity. Audit (M1047) provides system and activity logging, while Application Developer Guidance (M1013) reduces exploitable flaws through secure design. Complementary policies such as Account Use Policies (M1035) and Limit Access to Resource Over Network (M1048) enforce consistent monitoring of identity and network activity to detect anomalies.

10.8 RESILIENCE

Assuming that some attacks may succeed, resilience controls minimize impact and accelerate recovery. Data Backup (M1053) and Remote Data Storage (M1029) ensure continuity of operations. Data Loss Prevention (M1057) and Encrypt Sensitive Information (M1041) protect confidentiality and integrity even under compromise. Preventive measures such as Update Software (M1051) and Antivirus/Antimalware (M1049) reduce exploitable weaknesses, while User Training (M1017) equips staff to recognise and resist social engineering attempts.

ENISA THREAT LANDSCAPE 2025

11. OUTLOOK & CONCLUSION

In the near-term, it is highly likely public and private organisations in EU MSs will continue to face hacktivistassociated threats with periodic peaks, stable cyberespionage activities with a continued prevalence of Russia-nexus and China-nexus intrusion sets, and an even more mature yet further fragmented cybercriminal ecosystem.

In terms of impact, the EU threat picture will remain dominated by opportunistic cybercriminal activities involving the use of ransomware and information-stealers, despite the achievements of law-enforcement. Displaced or disrupted RaaS brands will continue being promptly replaced by emerging programmes. The criminal marketplace will continue formalising around skills to further scale campaigns, notably through AI integration, IoT and large-scale exploitations of vulnerabilities and the targeting of critical sectors, notably hosting companies and IT providers. The rising use of EDR-kill tooling (e.g., AvNeutralizer, EDRKillShifter) and BYOVD, as well as legal-pressure features in extortion playbooks, will sharpen both the speed and leverage of intrusions. Hacktivist-led DDoS will persist as a nuisance, both in terms of the disruption of business continuity and in the information operation sphere, highly likely with spikes around high visibility events and announcements by EU MSs and EU entities and authorities. State-nexus intrusion sets will continue to blend espionage, supply-chain access and IO, increasingly leaning on compromised EU-hosted infrastructure.

Looking forward, cyber threat activity is likely to further intensify along three dimensions: convergence, automation and industrialisation. AI will accelerate cycles of offensive innovation, enabling rapid campaign development and more effective deception techniques. Abuse of cyber dependencies will remain a strategic priority, while the persistence of hacktivism and disinformation campaigns will continue to influence public perception and policy debates.

The highlights of this report underscore how defensive strategies must become intelligence-driven and systemic, emphasising proactive threat hunting, behavioural detection and the integration of cyber risk management into broader operational and policy frameworks. Organisations should prioritise comprehensive asset discovery, automated vulnerability management and resilience planning for interconnected systems and services. Collaboration between Member States, EU institutions and private industry is essential for countering the threats.

In parallel, the European policy landscape is evolving to address these challenges. The Cyber Resilience Act (CRA) introduces mandatory security requirements for digital products and services, aimed at reducing systemic vulnerabilities by embedding security-by-design practices and formalising vulnerability disclosure obligations. The Cyber Solidarity Act (CSoA) strengthens Europe’s collective defence by improving mechanisms for cross-border incident response and the coordinated sharing of threat intelligence. The updated Cybersecurity Blueprint further supports these efforts by creating structured escalation paths and standardised response procedures for large-scale incidents. Together, these frameworks provide the foundation for a more unified and proactive cybersecurity posture across the EU.

In close cooperation with Union entities, ENISA is central to translating these policy measures into tangible outcomes. Its work on situational awareness, operational cooperation, support for critical sectors, certification schemes, capacity building and policy monitoring ensures that regulatory initiatives are supported by strategic and operational expertise. Through coordination of the CSIRT Network, support to CyCLONe, and the development of taxonomies and reporting frameworks, ENISA helps to harmonise reporting obligations and improve the visibility of systemic risks. Annual threat assessments, red-teaming exercises and sector-specific guidance further reinforce the EU’s readiness, enabling organisations and Member States to operationalise regulatory requirements.

ENISA THREAT LANDSCAPE 2025

12. APPENDIX

12.1 TACTICS, TECHNIQUES & PROCEDURES (TTPS)

MITRE ATT&CK Enterprise TTPs identified for loaders reportedly seen in the EU

ENISA THREAT LANDSCAPE 2025

MITRE ATT&CK Enterprise TTPs identified for RATs reportedly seen in the EU

ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025

MITRE ATT&CK Enterprise TTPs identified for ransomware reportedly seen in the EU

ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025

MITRE ATT&CK Mobile TTPs identified for RATs reportedly seen in the EU

ENISA THREAT LANDSCAPE 2025 12.2 VULNERABILITIES

Concepts and frameworks used to document vulnerabilities:

CVE Numbering Authority : An authorised entity with specific scope and responsibility to regularly assign CVE IDs and publish corresponding CVE Records. ENISA is a CVE Numbering Authority.

CVE Identifier: The CVE (Common Vulnerabilities and Exposures) programme is an international, community-driven effort to identify and catalogue publicly disclosed vulnerabilities. Each disclosed vulnerability is catalogued within a CVE Record, which includes information about the vulnerability, and is assigned an alphanumeric string that identifies a publicly disclosed vulnerability, called a CVE Identifier (ID). Individual CVE Records are catalogued via the list of CVEs.

EUVD Identifier: Similar to CVE, ENISA assigns and records a unique identifier to each publicly disclosed vulnerability which is catalogued within the EU Vulnerability Database.

CVSS: Common Vulnerability Scoring System , is an open framework for communicating the characteristics and severity of vulnerabilities. In the current version (4.0) it uses 4 metrics with numbers between 0 and 10. CVSS adopts the following severity rating based on the score:

CWE: The Common Weakness Enumeration is a community-developed list of common software and hardware weakness types that could have security ramifications. A weakness is a condition in a software, firmware, hardware or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities. A CWE is assigned an ID. In many cases, a CWE ID is included in a vulnerability description to enrich the information. This information helps developers to understand common weakness and improve secure development practices.

ENISA THREAT LANDSCAPE 2025

Known Exploited Vulnerability: A KVE is a vulnerability that is officially known as having been exploited

during an attack or incident. The US Cybersecurity and Infrastructure Agency (CISA) maintains a catalogue of known exploited vulnerabilities. Organisations should use the KEV catalogue as an input to their vulnerability management prioritisation framework.

Hereunder is a list of vulnerabilities documented as having been exploited in order to target EU organisations in open sources.

ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025 12.3 LEXICON ENISA THREAT LANDSCAPE 2025 ENISA THREAT LANDSCAPE 2025

13. LOG HISTORY

Date Edit

December 2025 References edited January 2026 References edited

-X -XX 0 0 -0 -00 -00 XX

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure, and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ISBN 978-92-9204-723-8 DOI: 10.2824/1946374

ISBN: 978- 92- 9204- 723-8