ENISA Threat Landscape 2026

TLP:CLEAR

ENISA Threat Landscape 2026

SEPTEMBER 2026 ENISA Threat Landscape 2026

About ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

CONTACT

To contact the authors, please use etl@enisa.europa.eu For media enquiries about this paper, please use press@enisa.europa.eu.

AUTHORS

ENISA

ACKNOWLEDGEMENTS

EEAS STRATCOM

Europol

Automotive Information Sharing and Analysis Center (Auto-ISAC)

Aviation Information Sharing and Analysis Centre (Aviation ISAC)

European Top-Level Domain Information Sharing and Analysis Centre (European TLD ISAC)

LEGAL NOTICE

This publication represents the views and interpretations of ENISA, unless stated otherwise. It does not endorse a regulatory obligation of ENISA or of ENISA bodies pursuant to Regulation (EU) 2019/881. ENISA has the right to alter, update or remove the publication or any of its contents. It is intended for information purposes only and must be accessible free of charge. All references to it or its use as a whole or in part must indicate ENISA as its source. Third-party sources are quoted as appropriate. ENISA is not responsible or liable for the content of the external sources including external websites referenced in this publication. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. ENISA maintains its intellectual property rights in relation to this publication.

COPYRIGHT NOTICE

© European Union Agency for Cybersecurity (ENISA), 2026 Unless otherwise noted, the reuse of this document is authorised under the Creative Commons Attribution 4.0 International (CC BY 4.0) licence (https://creativecommons.org/licenses/by/4.0/).

This means that reuse is allowed, provided appropriate credit is given and any changes are indicated.

ENISA Threat Landscape 2026

Copyright for the image on the cover © Shutterstock For any use or reproduction of elements that are not owned by the European Union Agency for Cybersecurity, permission may need to be sought directly from the respective rightsholders. ISBN 978-92-9204-807-5, DOI 10.2824/0806036

ENISA Threat Landscape 2026 DISCLAIMER

AI was used in a limited capacity to support collection and processing of data used in this report. All outputs were reviewed and validated by subject-matter experts. No AI-generated content was used in this report. All references and external resources cited in this report were accessible at the time of publishing. ENISA cannot guarantee their continued availability and bears no responsibility for subsequent changes to, relocation of, or removal of content hosted by third parties. Where relevant, references to specific channels, forums, and Data Leak Sites (DLS) are provided for informational and evidentiary purposes. Such resources are inherently volatile and may become inaccessible, including as a result of deletion by their operators, account or infrastructure suspension, or law-enforcement action.

ENISA Threat Landscape 2026

Table of Contents

Executive Summary 7 Methodology 9 1. Overview & Trends 11 2. Sectoral Analysis 18 2.1 Public administration 20 2.2 Business services 24 2.3 Transport 27 2.4 Manufacturing 31 2.5 Finance / Banking 34 3. Cybercrime Threats 38 3.1 Key threats 39

3.1.1 Fraud and Impersonation 39

3.1.2 Data breaches 42

3.1.3 Ransomware deployments 46

3.2 Sectoral impact 54 3.3 Geographical impact 54 3.4 Key trends 55 3.5 Tackling cybercrime in the EU 59 4. State-Nexus Threats 60 4.1 Key threats 60 4.2 Sectoral impact 67 4.3 Key TTPs and trends 69 5. Foreign Information Manipulation & Interference (FIMI) 74 5.1 Key threats 74 6. Hacktivist Threats 83 6.1 Key threats 83 ENISA Threat Landscape 2026 6.2 Sectoral impact 85 6.3 Geographical impact 85 6.4 Key trends 88 7. Vulnerabilities 90 8. Outlook and Conclusion 95 Appendix A Law Enforcement Authorities operations in the EU 97 Appendix B Assessment methodology 100 ENISA Threat Landscape 2026

Executive Summary

The 2025 cyber threat landscape affecting the European Union remained shaped by a combination of threats, sometimes driven by geopolitical developments, and the growing interconnectedness of digital ecosystems.

DDoS attacks (51.3%) and unauthorised access (39.5%) continued to account for a large share of the recorded activity affecting EU Member States and EU-based organisations. Social engineering remained a common enabling tactic to abuse trust, particularly through phishing campaigns (77.8%), increasingly supported by phishing kits and service-based ecosystems. The exploitation of vulnerabilities, including N-day and 0-day vulnerabilities, also remained a prevalent intrusion vector to enable unauthorised access (60.4%). At the same time, the targeting of supply chains, third-party providers, cloud environments and other cyber dependencies continued resulting in impactful and large-scale incidents.

Financially motivated activities (29.3% of all recorded incidents), particularly ransomware, remained the most impactful incidents in the short-term. Ransomware, data breaches, phishing and fraud impacted a broad range of sectors, reflecting the continuing adaptability of the cybercrime ecosystem. Manufacturing, business services and public administration were among the sectors most affected by cybercrime-related activities. Across the reporting period, ransomware operators continued relying on extortion and data exposure through public claims shared on Data Leak Sites (DLS) and dark web forums, while fraud and phishing activity highlighted the continued importance of credential compromise, impersonation and social engineering techniques, notably through the increased use of ClickFix and SMS phishing (smishing).

Geopolitical developments such as the continuation of Russia’s war of aggression against Ukraine or the conflict escalation in the Middle East continued influencing cyber activity impacting the EU. Ideology-driven operations represented a significant share of the observed activity (57.3%), particularly through hacktivist-led DDoS campaigns targeting public-facing services, essential entities and organisations associated with political developments or support for countries such as Ukraine or Israel. State-nexus intrusion sets continued conducting cyberespionage activities (5.9%), with Russianexus intrusion sets primarily targeting central governmental and diplomatic entities, and China-nexus intrusion sets showing continuous interest in the transport sector including maritime related entities. A resurgence in State-nexus financially motivated campaigns was observed.

2025 confirmed the continued exposure of sectors to cyber threats, including sectors of high criticality according to NIS2. Public administration remained the most impacted sector (31.8%), followed by business services (8.5%), transport (8%), manufacturing (6.9%) and finance / banking (5.6%). Sectoral analysis further highlighted differences in targeting patterns, threat groups and operational impact across sectors, notably showing the criticality of digital dependencies, sensitive data holdings and operational maturity in shaping exposure to cyber threats.

Another notable development throughout the reporting period was the continued adaptation of threat groups’ operational playbooks. Cybercriminal, hacktivist and State-nexus threat groups increasingly relied on scalable techniques, shared tooling patterns and trusted digital environments to conduct malicious activities. 2025 also observed the continued integration of artificial intelligence into malicious cyber activities, including activities carried out by cybercriminal operators, State-nexus intrusion sets and Information Manipulation Sets (IMS).

Looking ahead, ENISA assess that several of the dynamics observed during 2025 are likely to persist into the next reporting period. Organisations across the EU will continue facing a combination of cybercrime, cyberespionage and hacktivist activity driven by geopolitical developments. While objectives remain distinct, cybercriminal, hacktivist and State-nexus operators increasingly rely on

ENISA Threat Landscape 2026

similar access vectors, tools and operational approaches, making imputation and threat analysis more challenging. Cybercrime is expected to remain one of the most significant sources of disruption to organisations operating in the EU, supported by mature criminal ecosystems, evolving extortion models and the continued availability of specialised services and tooling. The reporting period also reinforced the importance of digital dependencies, as incidents affecting software suppliers, service providers and cloud environments continued demonstrating the potential for broader downstream impact. ENISA assess artificial intelligence will highly likely increasingly support malicious operations, and its use will likely expand beyond the increased speed, scale and adaptability of cyber operations, it is also likely 2026 will see an increased number of the kill chain’s phases being directly enabled by AI, with possible experimentation of Human-out-of-the loop proof of concepts. The growing availability of frontier AI models and specialised malicious or dual-use tooling has already demonstrated its impact in augmenting the development of malicious capabilities and will likely lower barriers to entry into malicious cyber activities and further support scaling, automation and velocity across cyber operations. It is also likely that the use of these new models will increase EU organisations’ exposure to new threats, arising from both accidental and malicious activities.

ENISA Threat Landscape 2026

Methodology

The updated ENISA Cybersecurity Threat Landscape (ENISA CTL) methodology published in September 2026 was used to support the drafting of the ENISA Threat Landscape (ETL).

The ENISA Threat Landscape 2026 report is organised as follows. The first chapter provides an overview of the general threat landscape, highlighting specific trends considered relevant. The second chapter provides a sectoral overview of the incidents recorded in ENISA’s dataset. The following chapters of this document provide a deep dive into four main areas, cybercrime, State-nexus activities, hacktivism, and Foreign Information Manipulation and Interference (FIMI). Incidents documented in the FIMI chapter were drawn from the European External Action Service’s (EEAS) FIMI Threat Landscape 2025. A chapter is dedicated to the analysis of vulnerabilities disclosed during the reporting period, as well as an outlook to conclude this report.

For the ETL 2026 report, ENISA analysts collected and analysed 8 257 incidents, mainly based on information from open sources, as well as anonymised information shared by EU Member States (EU MSs) and members of the ENISA Cyber Partnership Programme . The reporting period of the ETL has been updated to the calendar year, i.e. the analysis takes into consideration incidents recorded from 1 January 2025 to 31 December 2025; hence, this report presents an overlap of six months with the previous ETL, presenting trends already described in the ETL2025.

For this ETL, ENISA also expanded the number of tracked cybercrime activities (including data breaches and fraud). While this was observed to have an impact on the numbers presented in this report, it did not substantially change the trends and rankings observed in the previous iteration. Of note, data breaches, frauds, scams and ransomware are expected to present overlaps (i.e. data exfiltrated through fraud schemes and ransomware deployments are advertised in forums, and data advertised in those forums are subsequently used in fraud schemes and ransomware deployments).

As much as possible, primary sources are referenced in footnotes to substantiate ENISA’s assessments. ENISA appreciates that open sources and information shared voluntarily do not constitute a complete picture of the cyber threat landscape. Moreover, multiple caveats are inherent to open-source reporting. Those notably include reporting granularity and temporality. For instance, vague sectoral or geographic reporting (e.g. ‘private companies’, ‘Europe’) is likely to impact ENISA’s dataset and analysis. Another caveat concerns proper sectoral categorisation, especially when one incident impacts an organisation operating in multiple sectors. To avoid inflating the threat, ENISA analysts undertook a thorough curation of the dataset either by choosing one specific sector or by registering the incident as ’unknown’. While particular attention was paid to the matter, it is highly likely a deviation will remain. Another example is the reporting of a specific number of targeted or impacted EU organisations in one report, whereas other reports will just mention the targeting of an EU MS. This notably affects the ranking of sectors and State-nexus intrusion sets. It should be noted that incidents are not necessarily reported immediately or confirmed in open sources. For instance, while ransomware and DDoS are more immediate ‘visible’ threats often claimed directly by their operators, cyberespionage campaigns are typically documented with a delay often spanning

ENISA Threat Landscape 2026

from six months to more than four years. It should also be noted that, to some extent, increased reporting of a specific threat does not necessarily reflect an increased tempo of activity but rather speaks to the audience’s interest, particularly linked to a specific geopolitical context. Furthermore, while the number of hacktivist claims remain high, the threat of cyberespionage represents a more impactful threat in the long term.

Hence, this report should be seen as an overview of prevailing trends, constituting a snapshot of threats faced by EU MSs and EU-based organisations.

To differentiate between what was reported by other sources and ENISA’s own assessments, words of estimative probability are used, described within a matrix available in the Appendix.

ENISA Threat Landscape 2026

1. Overview & Trends

Based on the analysis of the ENISA dataset, DDoS remain the primary incident type (51.3%), followed by unauthorised access (39.5%). Among social engineering techniques, phishing remains a prevalent intrusion vector (77.8%), followed by malicious spam (malspam), accounting for 13%.

An increasing use of the ClickFix technique, abusing victim into ‘fixing’ an issue, ultimately 3 4 leading to the execution of malicious code , was prevalent in 2025. ENISA also observed the popularisation of phishing kits and Phishing-as-a-Service (PhaaS) platforms to further enable 5 6 financially motivated cyber activities (see cybercrime threats chapter) .

Exploitation of N-day and 0-day vulnerabilities remains a prevalent intrusion vector. Across incidents of unauthorised access for which ENISA was able to identify an intrusion vector (5.2%), 60.4% were seen leveraging a vulnerability, while misconfiguration and accidental exposure remain a concern (20.7%). Unauthorised access by insider threats contributed an increased share compared to the previous ETL, likely due to the threat posed by Famous Chollima, an intrusion set associated to the Democratic People’s Republic of Korea (DPRK)

ENISA Threat Landscape 2026

seeking employment as IT workers globally, including in EU companies, notably defence and

government-related entities (see State-nexus threats chapter).

The targeting of cyber dependencies, including supply-chain attacks and third-party attacks continued to be observed, with several examples of large-scale and/or impactful incidents throughout the reporting period. Cybercriminals increasingly targeted third-party providers, such as digital

services, highly likely as an opportunity to optimise the efficiency of their attacks .

Adversaries were also seen exploiting the digital supply chain, notably by compromising software,

repositories or browser extensions (see sectoral analysis, cybercrime and State-nexus chapters). Of particular concern was the increase in compromises of popular libraries or npm

packages, as seen with the Shai-Hulud campaign . In March 2026, ENISA published a technical

advisory for the secure use of package managers .

The distribution of incident types remains dominated by low-impact DDoS attacks, which make up 51.3% of all recorded incidents, primarily shaped by geopolitical developments and political

ENISA Threat Landscape 2026

statements. The second half of 2025 recorded an increased number of intrusion claims by hacktivist groups, notably pertaining to the targeting of Operational Technology (OT) (see hacktivist threats chapter). Unauthorised access follow with 39.5%, dominated by financially motivated activities (63.9%), followed by ideology driven claims (15.3%), and cyberespionage (13.6%).

Based on assessed objectives, cyber activities targeting or impacting the EU mostly pertained to ideology-driven incidents (57.3%), followed by financially motivated operations (29.2%). Cyberespionage campaigns accounted for 6.3%. As mentioned, despite representing most incidents, ideology-driven claims did not result in large-scale or significant impact. Though accounting for lower numbers, financially motivated activities remain the most impactful threat to EU organisations in the short-term and cyberespionage represents a significant strategic threat in the mid to longerterm. This is also reflected in ENISA's NIS investments report , where DDoS are characterised as ‘noise’ by representatives of EU organisations operating in NIS sectors of high criticality, while ransomware dominate organisational concerns.

ENISA Threat Landscape 2026

As already flagged in ETL 2025, the distinction between threat categories continued to blur. Similar techniques, infrastructures and access mechanisms appeared repeatedly across cybercrime, hacktivist and State-nexus reporting, despite differences in underlying objectives. This was notably exemplified by hacktivist-led DDoS waves by pro-Russia groups around electoral events and geopolitical developments, where increased activity was often observed as typical FIMI-aligned behaviour to associate disruption with aspects of information operations (see hacktivist threats chapter). Another illustration is the leveraging of cybercrime tradecraft or toolsets such as ransomware and infostealers by State-nexus intrusion sets, as seen with Moonstone Sleet’s use of 23 24 25 the Qilin ransomware (see State-nexus threats chapter).

The top five targeted sectors in the EU include public administration (31.8%), business services (8.5%), transport (8%), manufacturing (6.9%) and finance/ banking (5.6%), with essential entities representing 72.9% of the total number of recorded incidents. As in the previous ETL report, public administration remains the most targeted sector, with the threat picture largely impacted by ideology-driven DDoS attacks (see sectoral and hacktivism chapters).

ENISA Threat Landscape 2026

ENISA continued to observe an increasing use of Artificial Intelligence (AI) by malicious cyber threat groups, including cybercriminals, State-nexus and Information Manipulation Sets (IMS), primarily to facilitate or enhance their activities to optimise the speed and success rates of their operations overall. The integration of AI systems into enterprise environments creates a new attack surface. Threat groups, including State-nexus intrusion sets, IMS and cybercriminals demonstrate consistent interest

in AI systems both as tools to facilitate malicious activity and as targets for exploitation

. Despite this activity, reporting over 2025 indicates that attackers primarily use consumer-grade AI tools to augment existing skills and adapt attack vectors rather than to achieve breakthrough capabilities.

While attackers primarily use AI to augment existing skills, model improvements have already

been seen accelerating vulnerability discovery and exploitation. In 2025, Frontier AI labs continued to assess that threat groups are primarily leveraging closed AI models to augment existing

skills rather than achieve novel breakthrough capabilities . Prior efforts spanned basic applications such as the use of LLMs to craft and distribute tailored phishing messages at scale, develop text and media for deployment in influence campaigns and generate synthetic identities for remote-worker

schemes . Threat groups continue to experiment with methods for bypassing closed model

ENISA Threat Landscape 2026

safeguards and constraints, including steganography and indirect prompt injection . 2025 also saw the development of more industrialised methods for ensuring reliable, affordable and anonymised access to premium LLM tiers. The reporting period saw further proliferation of likely AI-generated malware leveraged in real-world operational contexts, as seen with an LLM-produced sample

reportedly exploiting the React2Shell vulnerability . AI was also used to conduct reconnaissance, script development and post-exploitation, often supported by ‘turnkey’ AI-assisted toolkits resold via

underground marketplaces .

Another relevant trend to highlight throughout the reporting period includes the increased abuse of

messaging applications and the leveraging of device code phishing by multiple intrusion sets

. 2025 saw large scale campaigns targeting multiple EU MSs and sectors leveraging trusted communications platforms such as Signal or WhatsApp to initiate personalised contact and steering targets toward authentication through legitimate workflows to gain full access to

compromised devices .

ENISA Threat Landscape 2026 AI THREAT

While outside the reporting period, ENISA cannot overlook the evolution and emergence of advanced AI models in 2026, which have already shaped the threat landscape, notably through Proof of Concept (PoC) research related to AI-powered malware, and the first signs of malware using generative AI at runtime . The most established trend remains the use of AI to support and accelerate existing techniques leveraged by malicious operators. Microsoft reported the operationalisation of AI by threat groups across different stages of cyber activity , while Anthropic reported that a state-nexus group used an agentic AI system during a campaign against unidentified international targets, with a limited number of successful compromises .

AI continued to be reported for phishing, fraud and malware development, including through impersonation of legitimate AI services. A fake Claude AI website, for example, was used to distribute malware , while cybercriminal forums continued discussing generative AI for phishing, fraud and malware development . Analysis of the Gentlemen ransomware group, particularly active in the EU, also documented how their operators used AI coding assistants to develop the group's Ransomware- As-A-Service (RaaS) panel . Of particular interest is the potential for AI to increase the speed and scale of cyber malicious operations. An AI-assisted cloud intrusion reportedly achieved administrative access within 8 minutes . AI-assisted discovery and living-off-the-land activity has also been reported . This reinforces concerns around faster PoC development, scanning and vulnerability exploitation. Reporting also shows AI becoming more directly integrated into attack workflows, as illustrated with the "AI in the Middle" technique, demonstrating how web-based AI services could potentially be abused to ensure stealthy operations and resilience of adversary infrastructure . AI-linked developer environments and software supply chains are another area of 64 65 concern . AI applications and their ecosystems are increasingly becoming targets, particularly where they have access to files, credentials, browser sessions or development 66 67 68 69 70 71 environments , and AI services may also provide a path into trusted environments .

In this context, the European Commission published their EU Action Plan on Cybersecurity and Artificial Intelligence , building on the AI Act, the Cyber Resilience Act, NIS 2 and the Cyber Solidarity Act, to address cybersecurity risks and opportunities linked to Artificial Intelligence. On the same day, ENISA published their view on cybersecurity in the Frontier AI Era to provide a set of recommendations when developing operational capabilities .

ENISA Threat Landscape 2026

2. Sectoral Analysis

This chapter provides a sectoral analysis of incidents identified by ENISA, looking at how cyber activity has impacted sectors covered by the NIS2 Directive , as well as additional categories needed to capture relevant activity outside the strict scope of NIS2. Where relevant it is compared with other reports, including reporting by EU MSs under the NIS2 Directive as well as ENISA's NIS360 report, to identify targeting patterns and assessments .

The top five targeted sectors in the EU include public administration (31.8%), business services (8.5%), transport (8%), manufacturing (6.9%) and finance/ banking (5.6%). While recorded events include non-NIS2 sectors, essential and important entities represent 73% of the total number of recorded events, confirming the relevance of the NIS2 approach . In this context, ENISA published their NIS2 technical implementation guidance to ultimately support a common cyber defence posture across the EU for concerned entities .

ENISA Threat Landscape 2026

To complement the open-source-based reporting, figure 7 presents the sectoral distribution of events 78 79 80 reported by EU MSs under NIS2 for 2025 . Based on the latter, the top five affected sectors include public administration, health, digital infrastructure, banking and transport. Overall, malicious

actions accounted for the largest share of reported root causes across the most impacted

sectors. Public administration appeared as the most affected sector in both cases, while transport and banking/finance were also present among the top five. However, health and digital infrastructure appeared among the top five sectors in Member State reporting. These discrepancies notably stem from different scopes, thresholds and reporting conditions.

ENISA Threat Landscape 2026 2.1 Public administration

As in the previous ETL, public administration remains the most targeted sector, accounting for 31.8% of all recorded events. The distribution of incidents affecting public administration over the reporting period shows that events primarily impacted central (35.1%) and local entities (33.8%). Regional level entities accounted for 10.1% of events. Based on the ENISA NIS360 report, the EU public administration sector remains in the cyber risk zone, where criticality exceeds observed cybersecurity maturity.

The threat picture is largely impacted by ideology-driven DDoS attacks which accounted for 81.8% of the recorded incidents (see hacktivist threats chapter). Public-facing websites and portals of public administration entities were repeatedly targeted around specific events, such as lawenforcement takedowns and arrests, electoral processes, high visibility events and general geopolitical tensions including Russia’s war of aggression against Ukraine and developments linked 81 82 to the ongoing conflicts in the Middle East .

ENISA Threat Landscape 2026

NoName057(16), Dark Storm Team, and Mr. Hamza were the most active hacktivist groups targeting public administration in the EU (see hacktivist threats chapter). Groups such as Keymous+ and Server Killers further contributed to the sustained tempo of claimed DDoS attacks targeting the websites and web portals of public administrations in EU MSs, in the context of Russia’s war of aggression against Ukraine. Other claims made by these alliances targeted public services, including visa and migration-related portals, as well as government targets framed by the groups as support for EU domestic protest movements. The reported impact remained largely limited to claimed or 83 84 85 temporary disruption of public-facing websites .

ENISA Threat Landscape 2026

Among financially motivated incidents (8%) impacting the public administration sector in the EU, ransomware claims accounted for 36%, primarily affecting municipalities (see cybercrime chapter). The most deployed strains against the EU public administration sector included Qilin, followed by SafePay and Stormous. Despite their limited share, several ransomware-related incidents resulted in operational disruptions. A notable example was the ransomware attack against a Swedish IT supplier, which affected around 200 municipalities and regional authorities and 86 87 disrupted systems used for HR reporting . Data breaches affecting the EU public administration sector accounted for 38.4%. Observed cases included the Pajemploi/URSSAF data theft in France, potentially affecting 1.2 million individuals, unauthorised access to a Slovenian public administration system exposing the records of 873 201 individuals, and a breach affecting several municipalities through an external appointment-service provider, reportedly exposing the data of around 100 000 88 89 90 individuals .

ENISA Threat Landscape 2026

State-nexus intrusion sets targeting the public administration in the EU showed a sustained focus on diplomatic and governmental entities for cyberespionage purposes. Multiple intrusion sets were reported to be targeting a broader set of public administration organisations, including diplomatic entities, ministries, law enforcement agencies, political parties and core government institutions, as seen with Russia-nexus APT29 targeting diplomatic entities in the EU, or activities associated with 91 92 APT28, Turla, and GoldenJackal (see State-nexus chapter).

ENISA Threat Landscape 2026 2.2 Business services

The business services sector was the second most impacted sector in the EU (8.45%), primarily impacted by unauthorised accesses (56.7%), followed by DDoS attacks (38%). Among recorded unauthorised accesses against business services organisations, ransomware deployments accounted for 54%, followed by data breaches (26.5%).

The business services sector captures a broad set of entities that fall outside the scope of the NIS2 Directive, notably including consultancy firms, legal services, broadcast media, real estate services and other professional or commercial service providers. Hospitality, consultancy and broadcast media together accounted for 55.3% of events impacting business services, showing that the sector’s heterogeneous profile was partly shaped by concentrated activity in three highly visible subsectors.

Hospitality entities were impacted by several types of incidents, including DDoS attacks, ransomware claims and data breaches, as illustrated by a data breach impacting a Polish travel agency , whereas broadcast media was mostly impacted by hacktivist-led disruptions against public-facing communication platforms, as seen in the targeting of a Lithuanian public broadcaster’s news website . A ransomware incident against a French wealth management software provider showed the cascading effects of attacks against specialised services providers, with disruption reportedly affecting banks and wealth advisers for several days .

ENISA Threat Landscape 2026

Among all ideology-driven incidents impacting business services (47.3%), the highest number of claimed incidents originated from NoName057(16) (35.8%), followed by Mr Hamza (6.4%), Keymous+ (5.8%), Hezi Rash (4.2%) and TwoNet (3.9%). Z-Pentest Alliance and Akatsuki Cyber Team stood out for the number of their claimed intrusions affecting smaller commercial entities, such as media, marketing, hospitality and consultancy-related entities.

ENISA Threat Landscape 2026

Within the financially motivated incidents targeting business services (46.8%), ransomware deployments represented most events (65.4%), followed by data breaches (28.4%). Most deployed ransomware strains against the sector include Qilin (15.4%), SafePay (8.4%), and INC ransomware (6%).

Business services were also impacted by the activities of State-nexus intrusion sets, mainly through DPRK-nexus job-themed campaigns targeting software developers and consultancy-related profiles. Famous Chollima (DPRK IT workers) and Lazarus were associated with activity involving fake or fraudulent IT-worker profiles, while Contagious Interview was linked to job-themed socialengineering campaigns using fake recruiter approaches and coding-test lures to deliver malware to freelance developers. Similar LinkedIn-based lures targeting developers in Czechia to steal credentials and cryptocurrency-wallet data, while reporting on Famous Chollima activity showed how developers operating under false identities attempted to infiltrate Western companies, including in 96 97 98 France, to generate revenue for the North Korean state or enable follow-on extortion .

ENISA Threat Landscape 2026 2.3 Transport

The EU transport sector accounted for 8% of all events across sectors. The sector also accounted for 8% of events with significant impact reported under the NIS2 Directive in 2025, placing it among the top five impacted sectors .Targeting was concentrated on railway (31.9%) and air (30.4%), followed by road (17.9%) and water transport (16.4%). A notable change compared with the previous ETL is the increased prominence of railway-related events, which once accounted for only 2% of events in the transport sector, as the second most affected transport subsector. This increase was mainly driven by repeated DDoS claims against operators of railways, metros and tramways services during H2 2025. Based on ENISA NIS360 report, railway and maritime transport are categorised as being in the risk zone, notably due to their reliance on heterogenous systems and their strategic importance in the global supply chain.

The transport sector remained largely impacted by DDoS claims (83.1%), followed by

unauthorised access (16.3%).

ENISA Threat Landscape 2026

DDoS attacks conducted for ideology-driven purposes (98.6%) were notably linked to specific

events at the EU national level and/or support for Ukraine. DDoS claims against this sector primarily originated from NoName057(16) (58%), Dark Storm Team (12.1%) and Server Killers (11.2%). In June 2025, around the time of the NATO Summit in The Hague, NoName057(16) claimed 100 101 102 103 104 attacks against Dutch transport-related targets, including transport operators , as well as Schiphol, the Netherlands’ main international airport and a key travel hub for summit-related transport. Of note, the European Union Aviation Safety Agency (EASA) reported on a 43.56% increase of hacktivist claims against European aviation websites, notably led by NoName057(16) and Dark Storm Team. In November 2025, NoName057(16) referred to Denmark’s announcement of its th 28 Ukraine-support package in its claims and/or threats against the Danish Ministry of Transport, 105 106 107 DSB, public-transport portals, road-toll infrastructure and airport-related websites . Several DDoS waves coincided with specific geopolitical developments, including the renewed German airdefence support discussions for Ukraine, Spain’s November 2025 aid package for Ukraine, and the 108 109 public condemnation of sabotage against a Polish railway line used for aid deliveries to Ukraine .

ENISA Threat Landscape 2026

Financially motivated incidents against the transport sector accounted for 10.2% of all attacks on that sector, with data breaches accounting for 56.7% and ransomware deployments for

37.3%. Data breaches incidents were notably driven by the exploitation of managed file-transfer software used in logistics and supply-chain environments, and data-theft campaigns affecting cloud, Customer Relationship Management (CRM), customer-service and third-party provider 111 112 environments . Based on information shared by the European Union Aviation Safety Agency, the aviation sector saw at least 10 ransomware attacks in the EU in 2025, with Akira being the most deployed strain.

ENISA Threat Landscape 2026

Ransomware deployments against the transport sector notably include Akira, Qilin, and Cl0p (12% each) and resulted in disruptive impact in a few cases. The most significant case was the September 2025 ransomware incident affecting US-based Collins Aerospace’s passenger-processing software, which disrupted automated check-in systems at several EU airports, including Brussels and 113 114 Berlin, causing delays, cancellations and the use of manual check-in procedures . Two prominent examples of data breaches due to attacks against third-party provider environments were the confirmed unauthorised access to an external customer-service platform used by Air France-KLM, and the disclosure by Iberia of a third-party attack targeting one of their suppliers and affecting 115 116 Iberia’s customers .

In 2025, the State-nexus activity recorded against the transport sector was largely linked to cyberespionage and strategic intelligence collection. Maritime-related organisations were primarily targeted by China-nexus Mustang Panda, with continuous campaigns impacting at least seven EU MSs. Iran-nexus group Chafer was also reported active against the sector, with a demonstrated interest in air transport related entities, with leaked material indicating the reconnaissance and targeting of global airlines, including European carriers .

Although logistics is treated separately from the transport sector for the purposes of this report, the two sectors remain operationally connected. Logistics entities support freight movement, warehousing, courier services and supply-chain continuity, and therefore share several exposure points observed in transport, including reliance on third-party platforms, managed file-transfer systems, customer and shipment data and public-facing service portals. Logistics entities were

primarily affected by cybercrime activity, with ransomware representing around half of the

recorded incidents, followed by DDoS claims, which accounted for approximately a quarter of the recorded incidents. Ransomware activity affected freight, warehousing, cold-chain, postal and courier, and third-party logistics providers, with Akira being the most frequently recorded ransomware group, followed by Cl0p, DragonForce and SafePay. DDoS activities were largely linked to NoName057(16) and targeted logistics and logistics-adjacent entities, including courier, freight and transport-service providers.

ENISA Threat Landscape 2026 2.4 Manufacturing

Manufacturing ranked fourth among the most targeted sectors, accounting for 6.9% of all recorded events. The distribution of incidents affecting the sector over the reporting period shows a clear focus on machinery and equipment (23.3%) and construction (21.8%).

The manufacturing sector was primarily impacted by unauthorised access (80.4%), followed by

DDoS attacks (14.6%).

ENISA Threat Landscape 2026

Financially motivated incidents against the manufacturing sector accounted for 61.1% of all

incidents targeting this sector, with ransomware deployments accounting for 82.8%, followed by data breaches (14.1%). Among ransomware deployments, the most deployed ransomware strains include Qilin (17.4%), Akira (11.5%) and SafePay (8%). Ransomware was particularly prevalent among machinery and equipment, construction, automotive, electronics and electrical-equipment manufacturers. In terms of impact, publicly reported cases show that incidents continued to affect 118 119 core IT systems, the most notable resulting in service degradation and operational disruption , with a few identified cases impacting cross-site operations. For instance, an incident impacting a 120 121 German heat-exchanger manufacturer reportedly disrupted its subsidiaries in Poland and China . Another example is a ransomware incident that targeted Japan-based Okuma Corporation and affected its German subsidiary, Okuma Europe GmbH .

Ideology-driven incidents (24.2%) against the manufacturing sector primarily involved DDoS (60.1%), followed by intrusion and defacements claims (24.6% and 10.1% respectively).

Similarly to the targeting of previously documented sectors, hacktivist activities against this sector

were primarily grounded in the context of the support for Ukraine from EU MSs. DDoS claims

ENISA Threat Landscape 2026

announced EUR 1 billion military aid package for Ukraine . The higher volume of unverified intrusion claims against the sector notably pertained to the increased targeting of operational

technology (OT) .

Reports mentioning the targeting of the manufacturing sector by State-nexus intrusion sets in the EU (8.4%) primarily pertained to the targeting of defence-related organisations, as illustrated by campaigns associated to DPRK-nexus Lazarus, Russia-nexus DragonFly and Storm-2372 and Iran-

nexus Nimbus Manticore . Another large-scale campaign aligned with China-nexus interests involving PurpleHaze and ShadowPad ran from July 2024 to March 2025 and impacted over 70 global

targets, including multiple entities in manufacturing . It is plausible that part of these activities

pertained to the theft of intellectual property.

ENISA Threat Landscape 2026 2.5 Finance / Banking

The finance / banking sector accounted for 5.6% of all events collected primarily impacted by unauthorised access (46%) and DDoS attacks (38.9%), followed by fraud and impersonation (14.8%). Of note, EU MSs reported that 10% of incidents with a significant impact in 2025 impacted the banking sector .

As they process a significant amount of valuable data, financial institutions represent high value targets for cybercriminals; financially motivated incidents primarily involved unauthorised access (81.6%) followed by fraud/impersonation (17.9%). Data breaches were particularly relevant in the insurance, banking and credit-institutions subsectors. In the insurance subsector, reported cases included the cyberattack affecting Generali Tranquilidade, where the personal data of customers was reportedly exposed, and the data breach that impacted former customers of Liberty and BBVA 135 136 Seguros through Generali España . Ransomware deployments against the finance sectors notably included Akira (20%), Lynx, Qilin and INC Ransom (8% each).

ENISA Threat Landscape 2026

The distribution of incidents affecting finance / banking shows a clear concentration in credit institutions (61.9%), followed by insurance with 17.8%, while crypto-asset service providers represented 7.7%.

ENISA Threat Landscape 2026

Ideology-driven attacks represented 40.6% of incidents targeting the finance/banking sector,

with a prevalence of DDoS claims (95.8%) followed by defacements (2.1%) and intrusion claims (1.6%). Ideology-driven DDoS attacks against the finance/banking sector were primarily claimed by NoName057(16) with 40.7%, followed by Keymous+ (9.5%) and Dark Storm Team (8.5%). DDoS claims identified by ENISA indicated a particular focus on public-facing banking and insurance portals . It is highly likely finance/banking would represent a valuable target for hacktivist groups as a temporary interruption of website availability would impact several thousand customers and would also be reported by mainstream media, creating a second layer of disruption to business continuity, in addition to reputational damage. As was often the case throughout the reporting period, these claims were part of multi-sector hacktivist campaigns as illustrated in NoName057(16)’s targeting of Germany in April 2025, that notably involved the targeting of finance/banking alongside municipalities, manufacturers and other companies, in a campaign framed around geopolitical developments and 138 139 support for Ukraine .

Based on reports mentioning the targeting of the finance/banking sector by State-nexus activities in

the EU (2.8%), activities that were recorded primarily pertained to crypto-asset service

providers and high-value financial-sector personnel. DPRK-nexus activity, including campaigns associated with BlueNoroff and Famous Chollima, targeted cryptocurrency foundations, developers and IT professionals, likely in support of financially motivated operations and cryptocurrency theft 141 142 . Separately, Graphite spyware was reportedly used against a high-profile banking executive,

ENISA Threat Landscape 2026

indicating that senior financial-sector personnel may also represent targets of interest for surveillance activity .

HEALTH & DIGITAL INFRASTRUCTURE

As previously mentioned, the health and digital infrastructure sectors appeared in the top five of impacted sectors according to EU MSs NIS2 reporting. Given their critical role in the provision of essential services and the potential impact of cyber incidents on their operations and dependent sectors, selected highlights from ENISA’s OSINT monitoring are presented below.

The health sector threat picture was primarily shaped by unauthorised access, led by

financially motivated attacks (46%). Out of these, ransomware deployments accounted for 26.8%; the most deployed ransomware strains include Qilin, INC ransom and SafePay. Ransomware continued to have direct operational consequences for healthcare delivery, as illustrated by the Stell 144 145 146 Hospital and the Gers Hospital Centre cases . Data breaches were mainly recorded against healthcare providers (63.6%) as seen for the Hôpital Privé de la Loire . DDoS attacks primarily targeted healthcare providers, which observed 85.5% of DDoS claims, with the most active groups including Hezi Rash, Dark Storm Team, and Keymous+. In 2025, ENISA published a cyber hygiene guide for the health sector, providing practical steps to strengthen the sector's resilience .

Digital infrastructure was primarily targeted by DDoS (50.6%), followed by unauthorised access

(40.4%) for financially motivated (20.3%) and cyberespionage (10.5%) purposes. 70.9% of financially motivated unauthorised accesses involved data breaches, followed by ransomware deployments (25.3%), with Qilin, Kraken, Lynx, Babuk2, Akira and Hunters International being the most deployed strains. Providers of publicly available electronic communications services was the most targeted subsector (53.5%), with the highest count of DDoS attacks (32.1%), notably carried out by NoName057(16) and Keymous+.

ENISA Threat Landscape 2026

3. Cybercrime Threats

Cybercrime remained a main threat across the EU during the reporting period, representing 29.3% of the total number of events identified, resulting in the disruption of business continuity in several instances and ultimately resulting in financial loss to the Single Market. In 2025, the European Banking Authority reported that online investment fraud alone reportedly cost an estimated €4.2 billion across the European Economic Area (EEA) in 2024 .

This section focuses on financially motivated activities including data breaches, ransomware claims and fraud schemes. Data breaches continued to affect organisations across multiple sectors, exposing personal, financial and corporate information that could be further exploited in malicious cyber operations. Ransomware deployments continued disrupting operations, notably through data encryption. Fraud schemes, including business email compromises, payment diversions, scams and investment fraud, also remained widespread.

In 2025, ransomware (47.3%) and data breaches (36%) formed most of the recorded financially

motivated claims, followed by fraud and Impersonation (13.3%).

ENISA Threat Landscape 2026 3.1 Key threats

The next three sections provide details about the main type of events related to cybercrime and analysed by ENISA, namely fraud and impersonation, data breaches and ransomware.

3.1.1 Fraud and Impersonation

This section focuses on fraud and impersonation schemes impacting the EU. Fraud and scams are deceptive practices for financial purposes. ENISA's collection stems from sources such as underground forums and open-source reporting. In addition, ENISA also collected information pertaining to phishing campaigns involving impersonation attempts, notably through warnings issued by national cyber authorities.

The data collected data shows that out of the known groups seen conducting fraud and impersonation in the EU (24.4%), Smishing Triad, mydocs and Hazy Hawk were identified as the most active.

Active since at least 2024, China-based Smishing Triad notably conducted large-scale smishing campaigns targeting logistics providers and public administration services, using automated 150 151 infrastructure to distribute messages and monetise stolen data, especially in Germany .

Mydocs, an operator that emerged during a campaign against luxury hotels in Italy, appears to facilitate fraud and impersonation-related activity through underground forums where it advertises data such as personally identifiable information (PII) . Such data is commonly used to support phishing, identity fraud and social engineering operations.

Hazy Hawk, active since at least December 2023 , hijacked cloud resources and abandoned subdomains belonging to government agencies, universities and private organisations to host malicious URLs linked to scams and malware delivery. In February 2025, the operator was notably observed conducting impersonation-related activity targeting high-profile organisations in France, Sweden and Czechia since at least December 2023 .

ENISA Threat Landscape 2026

Email-based phishing methods formed the majority of phishing activity during the reporting period. Other publicly reported activity included SMS-phishing (smishing), voice phishing (vishing) and Quick Response (QR) code phishing (quishing). Additional techniques included ClickFix , malvertising, Business Email Compromise (BEC), malspam and FileFix . Public reporting also highlighted a range of phishing campaigns masquerading as trusted brands, government and legitimate software to increase credibility. In regard to the popularisation of the PhaaS framework, XinXin Group (aka Black Technology), the developer of the Lucid PhaaS, has been active since 2023. While initially operating at a local level, its geographical reach has expanded .

Fraud and impersonation-related activity in 2025 was particularly identified in Italy (7.5%),

followed by Spain with 6.3% and France with 4.7%. Of note, fraud and impersonation was primarily documented at a regional level in open sources, with Europe (including the EU) accounting for 24.7%.

ENISA Threat Landscape 2026

Smishing Triad notably targeted France, Ireland, Poland, Germany and Lithuania, whereas Hazy Hawk focused on Italy, France, Czechia and Sweden. The collected data further indicates that Italy and France were targeted by multiple intrusion sets during the reporting period.

Fraud and impersonation-related activity during the reporting period primarily affected digital

providers with 16.6%, followed by public administration with 13.4%, and finance/banking (12.5%). Civil Society accounted for 9.4%, followed by business services (5.9%). The observed distribution

ENISA Threat Landscape 2026

indicates that fraud schemes mainly targeted sectors involved in financial transactions, digital services and the handling of high value data such as financial and personal information. The concentration of activity affecting banking institutions and citizen-facing services highlights the continued use of financially motivated fraud and social engineering operations during the reporting period.

Fraud and scam related incidents were notably carried out through websites designed to attract and deceive individuals by promising easy profits and appearing as legitimate, known as Baiting News 158 159 Sites (BNS) thus contributing to enabling fraud . The use of AI further facilitates and increases 160 161 the tempo of these activities, as they allow for better customisation of deceitful content .

3.1.2 Data breaches

Data breaches remained a concern, exposing personal, financial and corporate information to be used for further malicious cyber activities. This section focuses on data breaches claims advertised for sale on cybercriminal forums; the authenticity or currency of these claims could not be verified.

ENISA Threat Landscape 2026

Out of the collected events categorised as data breaches and associated to a specific operator, ShinyHunters and mydocs accounted for the highest share of observed activity with 3.1% and

Data breach activity in 2025 continued to involve the exploitation of third-party platforms, sales of unauthorised access and the targeting of public services. A major trend involved the compromise of shared platforms and service providers affecting multiple organisations. The activities observed included attacks affecting Software-as-a-Service (SaaS) and CRM environments, third-party providers 164 165 166 and developer infrastructure . Intrusion sets also continued to advertise credentials, VPN and 167 168 RDP access, database access and compromised backend environments on underground forums .

Large-scale theft of identity and financial data remained common during the reporting period. Identified examples included underground forums claiming the sale of Spanish citizen databases and identity records . Additional listings advertised the sale of financial data such as IBAN information from various banks across the EU .

ENISA Threat Landscape 2026

Source code breaches were primarily observed on underground forums advertising stolen proprietary

application code and compromised development repositories . Examples of such observed

activity included references to confirmed breaches affecting Europcar, RedHat and ENEA

.

Data breach claims were primarily related to organisations based in Spain, France, Italy,

Germany and the Netherlands, which accounted for the highest volume of observed activity, with incidents linked to multiple groups, particularly ShinyHunters, Lapsus$, R0m4nce and CLOBELSECTEAM. In France, data breaches were primarily claimed by ShinyHunters, as well as Lapsus$ and breach3d. Claims relevant to organisations in Spain originated from operators that

included Perro, BreachParty, and paysiano .

In May 2025, R0m4nce, reportedly linked to the Hexorcist group, advertised the bulk sale of the

source code for more than 1 100 gambling websites on the underground forum DarkForums . The group claimed the package consisted of 4.1 GB of uncompressed PHP code compiled from data dumps dated 15 August 2024 and 30 November 2024. Based on the domains identified, at least 12 EU MSs were allegedly impacted.

ENISA Threat Landscape 2026

During the reporting period finance/banking accounted for the largest share of observed data breach activity (15.4%), followed by other sectors (14.6%), business services (10.7%), public administration (9.3%) and digital providers (8.3%). Overall, data breach activity mainly affected sectors handling sensitive financial operations and personal data, as well as organisations providing digital and public-facing services.

Particularly observed on underground forums and cybercriminal marketplaces used to advertise, leak, or trade compromised data, data breach claims identified by ENISA primarily originated from the Breached Forums ecosystem with darkforums.st accounting for 58% and breachforums.st for 11%. The presence of multiple BreachForums domains reflects the resilience of such platforms to law enforcement disruptions, seizures and closures . Additional activity was identified on leakbase.la (8.1%), xss.is (6.3%), and breachforums.bf (4.3%).

ENISA Threat Landscape 2026 DATA BREACHES

Data breaches are often claimed as outcomes, providing limited visibility into the Tactics, Techniques and Procedures (TTPs) that led to the compromise. In contrast, ShinyHunters’ activities have been documented across the full kill chain, from reconnaissance to the exfiltration, followed by claims, offering a more complete view of this group's tradecraft (see table below) . ShinyHunters (aka ShinyCorp) is a financially motivated group that emerged in 2020, focused on data theft and extortion, targeting cloud and SaaS environments. The group primarily targeted organisations holding sensitive financial, personal and corporate data. Over the reporting period, ShinyHunters used phishing, vishing, credential harvesting, Multi Factor Authentication (MFA) abuse and stolen Open Authentication (OAuth) tokens (T1528 – Steal Application Access Token) to compromise enterprise cloud environments . Observed activity affected platforms including Salesforce, Microsoft 365, SharePoint, Slack, and Google BigQuery (Cloud Infrastructure Discovery (T1580)). They commonly gained access through vishing campaigns impersonating IT personnel to steal Single-Sign-On (SSO) credentials and MFA codes. Following compromise, operators accessed connected SaaS services (Exploitation of Remote Services (T1210) and Software Deployment Tools (T1072)), exfiltrated 195 196 197 198 sensitive data and conducted extortion through their DLS, as well as ransom demands .

3.1.3 Ransomware deployments

Ransomware operators continued to disrupt organisations across multiple sectors, through encryption, data theft and extortion-based operations. The most active ransomware operators in the EU include Qilin, SafePay, Akira, INC Ransom and Hunters International.

ENISA Threat Landscape 2026

Activity during the reporting period showed fluctuations across the different groups. Akira entered 2025 with a high tempo of activity, followed by a slight decline in the following months. By contrast Qilin maintained moderate activity levels before recording a significant increase in October 2025. The reason behind this spike could not be identified. Safepay displayed two notable peaks of activity in May 2025 and December 2025, with 22 and 26 claims respectively.

One notable observation concerns Hunters International. One claim was recorded in February 2025, followed by a significant increase to 52 claims in April 2025. While the observed trend towards extortion-only operations may have indicated a transition to Word Leaks ransomware at the time, this hypothesis was not confirmed in the medium-term . Lastly, INC Ransom kept a lower but steady tempo throughout 2025 with monthly claims ranging from 2 to 13.

ENISA Threat Landscape 2026

Based on identified ransomware claims, most targeted EU MSs include Germany (26.5%), France (14.7%), Italy (13.6%), Spain (12.2%) and the Netherlands (4.7%).While the least targeted EU MSs include Croatia (0,5%), Estonia, Latvia, Bulgaria Slovakia (0,3%) and Lithuania (0,1%).

While primarily impacting US organisations, SafePay deployments were claimed in the EU, primarily in Germany. Qilin presented more heterogeneous claims against targets located mainly in France, Spain and Italy.

ENISA Threat Landscape 2026

Ransomware deployment for the reporting period covered 47.3% of overall financially

motivated activity. The highest share of claimed ransomware deployments was recorded against the manufacturing sector (25.2%) followed by business services (18.7%), and other (10.7%). It is worth noting that within the other sector, most claims were related to the retail/consumer goods subsector. While public administration followed with 6.7%, the heath sector and the production, processing and distribution of food sector ranked next, each accounting for a comparable share of reported claims and completing the list of the most impacted sectors.

ENISA Threat Landscape 2026

Hereafter is a table showcasing a few ransomware incidents for which an impact was documented to illustrate how ransomware deployments continue to have an impact on operational continuity across sectors and EU MSs over the reporting period.

ENISA Threat Landscape 2026

To assess the operational behaviour of the most active ransomware operators, ENISA analysed 212 213 214 215 216 publicly reported TTPs . The most frequently observed technique was exfiltration over C2 channels (T1041), representing 73.3%. Techniques related to data encryption for impact, such as T1486, were reported less often (13.7%). This distribution is likely to confirm a broader

operational shift in ransomware activity from encryption-based activity towards data

exfiltration and extortion-focused operations. Ransomware operators were also seen exploiting vulnerabilities in VPN and firewall appliances, such as Fortinet (CVE-2024-55591 exploited by 217 218 Qilin, INC Ransom) and SonicWall or Cisco (CVE-2024-40766 and CVE-2023-20269 exploited by Akira) .

While infostealers continued to be delivered through cracked software, phishing pages and public code repositories, new delivery mechanisms to evade detection were also observed, such as fake CAPTCHA verification pages, cloud-based file hosting services and embedded links in video platforms. A primary initial access vector used by Qilin was the ClickFix tactic, using fake human verification prompts to trick users into installing NetSupport Manager or StealC infostealers, while in some instances they leveraged stolen credentials or conducted brute-force attacks against VPNs 220 221 222 (particularly Fortinet devices) . Safepay continued to use a social engineering tactic similar to the one used by Black Basta, during which they impersonate IT staff to load Remote Management 223 224 225 226 227 Tools (RMMs) .

Reuse of leaked builders (malware creation tools) continued to be observed, as illustrated by SafePay ransomware, suspected of being derived from a modified LockBit3 builder . It is likely that publication of the VanHelsing RaaS source code in May 2025 will be leveraged by other ransomware operators and contribute to the lowering of barriers of entry to the cybercriminal market for newcomers .

Cybercrime groups also continued using tools designed to disable Endpoint Detection and Response (EDR) solutions, enabling them to conduct stealthier intrusions focused on rapid data exfiltration. In June 2025, variants of EDRKillShifter started to be incorporated in multiple RaaS 230 231 232 233 toolsets, including Medusa, Qilin, Dragonforce, Lynx, Blacksuit, RansomHub and INC . Another technique illustrating this trend is the exploitation of vulnerable drivers (Bring Your Own

ENISA Threat Landscape 2026

Vulnerable Drivers - BYOD) to disable EDR systems . Of particular concern in this regard is the reported abuse of the legitimate tool HRSword , used to disable EDR/antivirus agents.

As part of their opsec and stealth efforts, cybercriminals were seen leveraging legitimate services

for C2 purposes, challenging detection and disruption efforts for cyber defenders .

Qilin relied on aggressive pressure tactics, including a new ‘call lawyer’ feature, which mimics legal

escalation, pressuring victims to act quickly under the illusion of legal consequences . This technique is particularly relevant in the EU, where cyber incident reporting and GDPR obligations are likely to represent a driver for victims to pay the ransom and avoid reputational damage. In several campaigns, priority was given to complexifying the system recovery process, with the deletion of

Volume Shadow Copies or the targeting of Virtual Machine infrastructure .

Data exfiltration is typically performed using legitimate file transfer tools such as Rclone , FileZilla and Cyberduck to send stolen data to legitimate cloud-storage providers such as

Backblaze or MEGA . The table and graphs below present the most commonly seen TTPs mapped with the MITRE ATT&CK framework of most commonly seen ransomware in the EU.

ENISA Threat Landscape 2026

The first half of 2025 saw several RaaS shutdowns, including BlackBasta in February and

RansomHub in April 2025 . In March 2025, DragonForce's announcement that RansomHub was joining its cartel was identified by researchers as a hostile takeover, rejected by RansomHub operators. Of note, DragonForce was operating its own RansomBay white-label service to allow

affiliates to rebrand the ransomware under a different name . LockBit operations were impacted by the compromise, defacement and leaking of their affiliate management panel, and since May 2025 the

group seems to have ceased its activities . Whether the newly documented LockBit4 operator

Syrphid is a former LockBit affiliate is not known at the time of reporting .

The Babuk2 (aka Bjorka ) ransomware operators claimed attacks against military, law enforcement

and defence organisations, including in the EU . Through the claimed attacks, it was observed that since mid-March, Babuk2 has been increasingly targeting the defence sector with victims around

the globe . Since resurfacing in January 2025, Babuk2 is assessed to be a copycat of Babuk,

notably fabricating or recycling ransomware claims made by other ransomware operators

. Additionally, Babuk2 shifted towards selling access to compromised enterprise networks on

ENISA Threat Landscape 2026

underground forums, functioning partly as an Initial Access Broker (IAB), sometimes repurposing previously published data, hindering the trustworthiness of this group .

3.2 Sectoral impact

Cybercrime activity over the reporting period remained opportunistic and affected a broad range of sectors across the EU. Financially motivated operators primarily targeted sectors handling monetizable data. Across all cybercrime incidents, manufacturing was the most impacted sector

(14.4%), followed by business services (13.5%), and other (11%). Finance/banking represented

9.2%, and public administration 8.7%. It is likely that this ranking stems from multiple factors, possibly including cybersecurity maturity level, opportunity to collect large amounts of data, notably through downstream targeting (third-party attacks) .

3.3 Geographical impact

Throughout 2025, cybercrime impacted organisations across multiple EU MSs, with the highest number of identified financially motivated events observed in Germany with 18.1%, Spain (17.7%), closely followed by France (17.6%), Italy (12.6%) and the Netherlands (4.6%). While this ranking could stem from multiple factors, it is likely these EU MSs would be seen as major economic players within the EU and thus represent high value targets, as analysed by CCB .

ENISA Threat Landscape 2026 3.4 Key trends

Credential theft activity in 2025 continued to rely on infostealers, which were commonly used to support phishing, fraud, ransomware operations and access brokerage. Public reporting documented continued use of malware families including Lumma, Vidar, Rhadamanthys, Redline, VenomStealer, Stealc and Strela, often delivered through phishing campaigns, ClickFix lures, fake software updates 268 269 270 271 and compromised cloud services . Several campaigns specifically targeted EU users and organisations, including a malspam campaign targeting the Italian pension sector that redirected victims to a fake webmail portal to distribute FormBook, and the ThunderKitty phishing campaign, 272 273 which used phishing emails as the initial vector to deploy infostealer malware . Reports showed continued use of infostealers to steal credentials, browser data, MFA tokens and session cookies, 274 275 enabling account takeover and unauthorised access .

Leaked Black Basta communications also showed how credentials obtained through infostealer

infections and access brokerage supported ransomware deployment and lateral movement

ENISA Threat Landscape 2026

smishing campaigns . The main outcome of these operations remained financial gain through fraud, scams, credential resale and the sale of unauthorised access.

Phishing campaigns continued being seasonal. The impersonation of tax authorities and

government digital services were observed in at least nine EU MSs during the reporting period. Operators impersonated national tax agencies and e-government platforms to distribute phishing emails, SMS messages and fraudulent tax refund notifications. Common lures included tax reimbursement claims, overdue payment notices and requests to update identity or banking information. Multiple national authorities issued public warnings regarding ongoing phishing and

smishing activities targeting citizens . Italy notably saw several phishing campaigns impersonating government institutions, including the Ministry of Defence, to collect user

credentials , phishing campaigns abusing trusted financial brands such as PayPal as well as

administrative issues such as alleged traffic code violations . Public reporting further highlighted

adaptive phishing campaigns employing encrypted payloads and victim profiling mechanisms

to selectively identify targets, while other campaigns used fake Zoom invitations to deliver

ScreenConnect-based RATs .

Tycoon 2FA was reportedly the most widely observed phishing kit globally in 2025 . The framework operated as an Adversary-in-the-Middle (AiTM) phishing kit designed to bypass multi-factor authentication. Activity linked to Salty 2FA declined from October 2025, while newer samples showed overlapping indicators associated with both Salty 2FA and Tycoon 2FA, potentially indicating

operational overlap or shared use linked to the Storm-1747 cluster . Xworm was also deployed as a phishing payload through emails using AI-themed lures, including fake video conferencing invitations

and links to compromised cloud storage services targeting corporate environments . In parallel, the Lighthouse phishing framework, linked to the Smishing Triad, enabled large-scale credential harvesting operations. A significant surge in Halloween-themed scams was also reportedly observed

during the period between 15 September and 15 October .

Domain name registration serves as the primary infrastructure for modern cybercrime, with 77% of phishing domains reportedly being registered specifically to facilitate attacks. It enables highvolume threats such as phishing kits and ClickFix campaigns, large-scale smishing operations among

ENISA Threat Landscape 2026

which Smishing Triad reportedly manages approximately 25 000 active phishing domains in any given eight-day period. Moreover, Hazy Hawk weaponizes misconfigured ‘dangling’ CNAME records to hijack the reputable subdomains of organisations such as the CDC and various state governments. The frequency of bulk registration services and free dynamic DNS subdomains—which require minimal identity verification—allows criminals to generate disposable, untraceable infrastructure that contributed to a 38% increase in phishing domains over the past year. Consequently, registries and 300 301 302 303 registrars bear a significant responsibility in detecting and mitigating this abuse . Additional TTPs of interest over the reporting period include the increase of generative AI and deepfake videos, to impersonate trusted contacts as part of social-engineering efforts. In late 2024, over two million accounts linked to pig-butchering activity were taken down, much of it originating 304 305 306 from criminal centres in Southeast Asia and, increasingly, in Eastern Europe and Africa .

The theft of cryptocurrencies also keeps on maturing into a highly professionalised system, with cryptocurrency drainers delivered through phishing campaigns, seen increasingly offered as a service (Drainer-as-a-Service) , allowing cybercriminals to gain control of victims’ digital wallets and steal funds. The theft of digital assets via cryptocurrency drainers fluctuated in line with market volatility but remained a persistent and scalable threat, maturing into a CaaS system, particularly as decentralised finance (DeFi) adoption continue growing across the EU. 2025 saw the emergence of Albiriox, an Android trojan seen targeting over 400 global financial and cryptocurrency applications to facilitate on-device fraud, primarily focusing on users in Austria . The Jingle Thief campaign uses phishing and smishing to steal credentials after conducting extensive reconnaissance operations allowing them to create highly convincing phishing content . A novel Android malware named SuperCard X enabling NFC relay attacks for fraudulent cash-outs was also observed. The malware intercepts and relays NFC communication from compromised devices . Fraudsters on several occasions contacted victims via Messenger or WhatsApp sharing links to download an application or request payment for a sign-up fee on the same website, leading to phishing and card detail theft . The use of SIM boxes to enable fraud further increased. The abuse of SIM boxes provided the hardware for large-scale attacks, enabling online fraud-related crimes such as phishing smishing, and fraudulent account creation .

ENISA Threat Landscape 2026

Thirty-three EU organisations were identified as targets of repeat victimisation, with activities

involving ransomware (44%) and data breaches (40%). It is likely that part of these activities is operationally linked, and that the repeated targeting was enabled by a lack of restoration practices following incident response.

Of rising and significant concern is the physical targeting, including kidnapping, of individuals 313 314 involved in the crypto industry, as well as their families . These events have been linked to data leaks from centralised crypto exchanges, which often contain PII, including, in some cases, home addresses . Such physical attacks were publicly reported in multiple EU MSs, with several 316 317 318 high-profile cases in Belgium , France and Spain .

ENISA Threat Landscape 2026 3.5 Tackling cybercrime in the EU

Activities carried out by law enforcement authorities continued to play a role in the dynamics of the cybercrime environment throughout the reporting period. Joint law enforcement efforts aimed at takedowns of ransomware groups, criminal infrastructure, online marketplaces and services used for assisting malicious activities have been taken as measures for disrupting cybercriminal operations and hindering their capabilities. While the direct impact of such law enforcement activities can vary greatly and is rarely quantified, they often affect the operating environment by forcing cybercriminals to adjust their business models in the short term. Below is a table of a few law enforcement operations notably led by EU MSs authorities in 2025, expanded in the Appendix.

ENISA Threat Landscape 2026

4. State-Nexus Threats

Over the reporting period, the activities of State-nexus intrusion sets targeting EU MSs remained

primarily focused on cyberespionage, strategic intelligence collection and, possibly,

intellectual property theft, notably through the compromise of digital infrastructure and the targeting of public administrations. State-nexus operational activity throughout 2025 was characterised by sustained exploitation of edge infrastructure, the rapid weaponisation of newly disclosed vulnerabilities, the abuse of cloud and identity systems, and the leveraging of social engineering techniques. Civil society within the EU continued being impacted by spyware-enabled targeted surveillance and information operations.

4.1 Key threats

State-nexus intrusion sets were mostly reported to be relying on unauthorised access (81.7%)

as well as phishing campaigns (12%). ENISA was able to identify an initial intrusion vector in only 20% of the recorded incidents. Within this subset, vulnerability exploitation was the most frequently observed intrusion vector, accounting for 70% of identified cases. The increase in insider threats (5%) represents a particular concern.

Approximately 1.5% of State-nexus intrusion sets assessed to be carrying out cyberespionage activities against the EU were not imputed to a known nexus. Intrusion sets reportedly associated to Russia accounted for 47.6%, followed by China (15.5%), DPRK (14.1%) and Iran (9%).

ENISA Threat Landscape 2026

Russia-nexus intrusion sets continued carrying out cyberespionage campaigns against the public administration, defence and energy sectors in EU MSs, notably through the exploitation

of known vulnerabilities and the deployment of bespoke malware. Public administration organisations in multiple EU MSs were targeted, with a specific focus on Ministries of Foreign Affairs and diplomatic entities, as illustrated by campaigns associated to APT29 or UAC-0063 . APT28 was seen focusing on the EU public administration sector, particularly central governments (please see the top five intrusion sets section). The targeting of defence-related and defence-adjacent organisations was also prevalent throughout the reporting period, with phishing campaigns 330 331 332 impersonating defence organisations . A particularly concerning development in Russia-nexus targeting of the EU occurred in December 2025 with a coordinated attack against the energy sector associated to DragonFly, notably involving the use of a wiper .

China-nexus intrusion sets continued targeting the EU in 2025, with a consistent focus on telecommunications, maritime, semiconductors, manufacturing and public administration

organisations. They also continued their leveraging of vulnerabilities to constitute Operational Relay Boxes (ORBs), including in the EU . Of particular interest is the leveraging of European victims to launch follow-up activities against additional European organisations, as well as against targets in Africa and Southeast Asia .

In terms of targeting, open-source reports confirmed that Salt Typhoon’s targeting of EU organisations started appearing in early 2025 . In June, a compromise by the intrusion set was confirmed by Viasat, a global satellite communication company operating across the EU . In August, a joint advisory by multiple EU, US and UK national authorities described operations overlapping with Salt Typhoon against telecommunications, government, transportation and military systems in over 80 338 339 340 341 countries, including EU MSs . In October, a campaign against an unnamed European telecommunications organisation was associated to Salt Typhoon with moderate confidence . Additional intrusion sets active against the EU notably include Mustang Panda, Liminal Panda, 343 344 345 APT31, Ke3chang, PurpleHaze and ShadowPad , RedNovember and UNC6384 . EU victimology was also noted in the reporting on a wave of exploitations targeting on-premises Microsoft SharePoint servers zero-days , marking it one of the largest zero-day exploitation campaigns in

ENISA Threat Landscape 2026

recent years, with up to eighty countries impacted globally including in the EU by multiple intrusion

sets, notably APT31 .

In May 2025, Forescout imputed exploitation of a critical SAP NetWeaver vulnerability CVE-2025-

31324 (EUVD-2025-11987) in the EU to Chaya_004 . Interestingly, the SAP NetWeaver vulnerability

was also leveraged by UNC5221 to target critical infrastructure in the UK, US and Saudi Arabia . In the EU, UNC5221 was separately reported leveraging an exploit chaining two critical Ivanti vulnerabilities to extract sensitive information—such as Office 365 tokens, mobile device credentials,

and email configuration files .

Throughout 2025, DPRK-nexus intrusion sets remained particularly active across the EU, conducting cyberespionage and financially motivated employment-themed campaigns to target organisations with a particular focus on digital infrastructure organisations. This is notably illustrated through the DeceptiveDevelopment campaign, which targeted freelance software developers on jobhunting websites globally, including in the EU, as well as the increased number of reported activities associated to Famous Chollima, notably seeking employment within Western companies operating in the technology, services, defence and government sectors in EU MSs. Lazarus was also reported

conducting campaigns related to employment notably targeting EU MSs . The same group also showed an interest in targeting aerospace and defence companies in central and south-eastern

Europe, likely as a continuation of their long-running DreamJob campaign .

Reports on the activities of Iran-nexus intrusion sets against EU MSs steadily increased in the second and third quarters of 2025. While it is not clear whether this is related to an actual increased tempo of activity or increased numbers of publications in open sources, it is likely related to the 12-day

war between Israel and Iran, and the subsequent geopolitical instability in the region . MuddyWater reportedly conducted a campaign targeting financial executives across multiple sectors globally,

including in the EU , and was further noted targeting government and non-profit organisations,

including by the use of lures impersonating an EU government . Charming Kitten reportedly

targeted a Member of the European Parliament (MEP), who acts as chair of the EU–Iran delegation ,

and the Senator of Justice to the city of Berlin . Nimbus Manticore was noted in multiple

instances targeting defence, telecommunications and aviation sectors in the EU , with the

ENISA Threat Landscape 2026

latter also allegedly targeted by Chafer . Finally, Homeland Justice was documented targeting the diplomatic missions of at least 10 EU MSs in what was assessed as a broader regional cyberespionage effort aimed at diplomatic and governmental entities during a time of heightened

geopolitical tensions .

2025 continued seeing the targeting of EU citizens and EU-based individuals through the abuse

of tools commercialised by Private Sector Offensive Actors (PSOA). This is notably illustrated by the deployment of Paragon Solutions’ Graphite spyware through the use of zero-day vulnerabilities to

target individuals globally, including in the EU . Infections involving the abuse of

Candiru were also reported . Another prevalent highlight was the continuous involvement of EU based organisations and EU individuals with PSOA, as reflected through the activities of Intellexa and

Altamides . Multiple EU MSs continued actively investigating and prosecuting the

abuse of commercial government-grade spyware .

Among State-nexus adversaries, 52 distinct intrusion sets were observed to be active in the EU over the reporting period. The top five identifiable intrusion sets throughout the reporting period included Storm-2372, APT28, Famous Chollima, Calisto and Patchwork, based on the number of EU MSs targeted. Of note, this ranking is highly likely inflated by the breakdown of victimology breakdown accessible to ENISA at the time of writing and mostly speaks to a lack of stealth from listed intrusion sets rather than the long-term strategic threat they pose to EU MS organisations.

ENISA Threat Landscape 2026

In February 2025, Microsoft reported on a large-scale phishing campaign carried out by Russianexus Storm-2372 targeting government, non-governmental organisations (NGOs), information technology (IT) services and technology, defence, telecommunications, health, education, and energy or oil and gas notably in the EU . This campaign was characterised by the use of the device code phishing technique, notably leveraging phishing lures masquerading as WhatsApp, Signal and Microsoft Teams, to entice targeted victims to log into apps, enabling token exfiltration to gain access to compromised accounts. This campaign was aligned with activities carried out by UTA0307 masquerading as a member of the European Parliament on the Committee on Foreign Affairs, reaching out to individuals with personalised emails, requesting a Microsoft Teams meeting to discuss relations between the US and the EU. Whether these two intrusion sets are congruent is not known at the time of writing, as they were handled as two different groups.

Throughout 2025, Russia-nexus APT28 was seen conducting sustained cyberespionage activities against EU MSs. The intrusion set displayed particular interest in targeting public administration and defence related organisations . Linked to APT28 with moderate confidence, UAC-0063 was seen 390 391 392 shifting its initial focus on Central Asian targets to EU-based embassies . In May 2025, a joint advisory from national cybersecurity authorities in Czechia, France, Denmark, Estonia, Germany, and the Netherlands confirmed targeted logistics companies and IT suppliers focused on supply chains, defence contractors and communications infrastructure across the EU since at least 2022, with multiple confirmed targets being involved in providing humanitarian or military assistance to Ukraine . In campaigns targeting EU MSs, APT28 was seen leveraging spear phishing, impersonating or

ENISA Threat Landscape 2026

masquerading as originating from public administration and defence related organisations , as well as credential brute-forcing. The intrusion set was also documented leveraging several high-severity vulnerabilities, including CVE-2023-23397 (EUVD-2023-27497) in Outlook, CVE-2020-12641 (EUVD- 2020-4942), CVE-2020-35730 (EUVD-2020-23386) and CVE-2021-44026 (EUVD-2021-30885) to gain higher privileges and deploy custom malware HEADLACE and MASEPIE backdoors. Another illustration of APT28 TTPs is the use of NATO-themed spear phishing messages to deliver malware variants BEARDSHELL and SlimAgent . The group was also seen leveraging the Signal messaging 397 398 399 application to deploy the recent NotDoor malware .

Russia-nexus Callisto targeted at least five EU MSs. The intrusion set was notably seen leveraging a 400 401 malware named LOSTKEYS designed to extract documents and system data from NGOs, journalists, and Ukraine-aligned individuals and advisors. Additional activities observed in the EU include a phishing and a credential harvesting campaign, targeting government, aerospace and defence, telecom and scientific research industries. In December 2025, Callisto was reported targeting the French NGO Reporters Sans Frontieres through spearphishing in March of that same year . Three GRU officers suspected to have been Calisto operators were included in the European Council list of sanctions announced in December 2025 .

DPRK-nexus Famous Chollima remained one of the most active intrusion sets in the EU, with activities blending cyber-enabled operations and physical access through employment fraud and was assessed to be pursuing a dual objective of revenue generation and cyberespionage. The intrusion set was seen becoming more active in Europe likely due to increased scrutiny and sanctions by US 404 405 406 407 authorities . The group was active against the digital services provider sector, government and defence-related organisations and the finance vertical. Famous Chollima notably conducted AIenabled social engineering with fictitious LinkedIn profiles with generative AI-created text and fake 408 409 410 profile images . In addition to job applications notably impersonating EU nationals, Famous 411 412 Chollima was reported leveraging fictitious companies . In terms of TTPs, Famous Chollima reportedly updated their toolset with OtterCookie (v5) implementing JavaScript-based keylogging and screenshotting, reducing the threat actor's reliance on Python distributions . Additionally, they continued the exploitation of the developer ecosystem by using malicious VS Code extensions and trojanized NPM packages, such as Chessfi. The intrusion set was also seen leveraging fictitious companies, as well as C2 infrastructure administered through VPN proxies, and RDP sessions from 414 415 416 Russian IP ranges .

ENISA Threat Landscape 2026

India-nexus Patchwork activity in 2025 focused on large-scale yet temporary spear phishing campaigns targeting diplomatic entities. The intrusion set was notably seen leveraging lures pertaining to China and defence and military topics.

While not included in the top five, China-nexus Mustang Panda still represents a significant threat to EU MS organisations, based on their advanced capabilities and sustained tempo of

activity against maritime transportation and public administration. Mustang Panda was notably seen targeting maritime entities in at least four EU MSs and was reported targeting EU MS governmental 417 418 organisations . In terms of TTPs, the intrusion set was seen leveraging spear phishing as well as 419 420 421 422 compromised USB devices as initial intrusion vectors, as well as DLL sideloading . The intrusion set’s malware toolset seen in the EU includes DOPLUGS, Korplug loader, and customized 423 424 PlugX variants , as well as advanced defence evasion and persistence mechanisms . Of note, Mustang Panda was reportedly seen leveraging RA ransomware in Asia, as well as the NailaoLocker 425 426 427 in Europe .

Of note also is DPRK-nexus intrusion set Kimsuky, active since at least 2012, and seen conducting spear phishing attempts targeting EU MS embassies, particularly in Q2 and Q3, likely in the context of the expansion of the intrusion set’s targeting documented in early 2025 . Masquerading as diplomatic entities, the intrusion set demonstrated a particular focus on targeting EU MS diplomatic missions, by notably impersonating a secretary of an EU delegation, as well as leveraging documents mimicking correspondence from the embassy of an EU MS. The intrusion set leveraged GitHub as a C2 channel and distributed a variant of XenoRAT relying on cloud storage solutions such as Dropbox and Daum .

ENISA Threat Landscape 2026 4.2 Sectoral impact

As mentioned in the previous section, State-nexus activities in the EU continued being prevalent against public administration (29.4%), followed by the targeting of manufacturing (9.8%), digital infrastructure (8.2%) civil society (7%) and transport (5.5%) sectors.

As it provides access to strategic data, including policy positions, foreign relations, security and defence related matters, public administration represents a high value target for State-nexus cyberespionage activities. During 2025 there was a sustained targeting of central and local government entities, as well as diplomatic missions. The latter is particularly exemplified by APT29 targeting EU Ministries of Foreign Affairs through wine-tasting invitations masquerading as diplomatic correspondence , as well as UAC-0063 reportedly expanding from Central Asia into European embassy targeting, notably affecting Germany, Greece, Hungary, the Netherlands and Romania, and reusing legitimate documents exfiltrated from Kazakh embassies as lures against further targets . APT31 activity also impacted governmental entities in at least four EU MSs. Czech authorities formally attributed a multiyear cyberespionage campaign targeting the Czech Ministry of 432 433 Foreign Affairs to the same intrusion set .

As previously mentioned, multiple State-nexus intrusion sets including APT28, Lazarus, Storm-2372, and Nimbus Manticore were seen targeting the EU manufacturing sector, particularly the defence 434 435 436 437 industry . ENISA assess it is plausible that part of these activities would pertain to the

theft of intellectual property, in the context of sanctions evasion or to secure a competitive advantage in international markets.

ENISA Threat Landscape 2026

The targeting of digital infrastructure providers by State-nexus intrusion sets notably enables upstream collection and downstream targeting of strategic data. Salt Typhoon was mentioned in public reports to be targeting Cisco devices vulnerable to CVE-2023-20198 (EUVD-2023-24377) to target Italian ISP infrastructure and TU Delft, while follow-up reporting described the use of valid stolen credentials and JumbledPath for configuration exfiltration and pivoting through compromised 438 439 440 infrastructure . Liminal Panda was reported to be active against the telecommunications sector in the EU . As it provides anonymization and enables stealth and persistence, the targeting of digital infrastructure also extended to the appliances and platforms that sit on the boundary between public networks and enterprise environments. UNC5221 targeted telecommunications providers, manufacturing, legal and insurance services, aerospace and municipal governance through the exploitation of Ivanti vulnerabilities, including CVE-2025-0282 (EUVD-2025-1580) and chained Ivanti Endpoint Manager Mobile vulnerabilities CVE-2025-4427 (EUVD-2025-14388) and CVE-2025-4428 442 443 (EUVD-2025-14387) . The actor’s extraction of Office 365 tokens, mobile device credentials and email configuration files highlights why digital infrastructure providers and management platforms are attractive: they compress many sensitive trust relationships into a small number of exposed systems. A related pattern was the use of compromised network infrastructure as part of obfuscation efforts. UNC3886 targeted Juniper routers, while ViciousTrap compromised D-Link, Linksys, ASUS, QNAP 444 445 446 and Araknis devices globally to create operational relay infrastructure .

Transport, including maritime, and logistics targeting is particularly interesting as it pertains to economic and political considerations, especially when contextualised within geopolitical developments involving EU MSs. Joint reporting by European and Allied authorities described the targeting of logistics firms, IT suppliers focused on supply chains, defence contractors and 447 448 communications infrastructure across Europe by APT28 since at least 2022 . The report links this victimology to the role of affected Member States in providing logistical support to Ukraine and reinforcing NATO’s eastern flank. Mustang Panda primarily focused their cyberespionage activities against the maritime industry, targeting several EU MSs maritime related entities throughout 2025, notably through the use of compromised USB media .

Finance-related victimology throughout 2025 is assessed to combine strategic intelligence

collection with revenue generation. Operations linked to Lazarus and Famous Chollima notably resumed targeting cryptocurrency ecosystems and are documented to also have generated revenues through the DPRK IT workers scheme, which likely contributed to the estimated USD 2.2 billion in 450 451 digital assets stolen in 2024 .The DeceptiveDevelopment campaign targeted freelance software developers through job-hunting and freelancing websites, with assessed objectives that included cryptocurrency theft and possible secondary espionage . Lazarus-linked ClickFake Interview later affected European HR infrastructure and applicants, particularly in France and Belgium, through job boards and corporate portals .

Civil society was particularly impacted by surveillance activities and information operations. NGOs, journalists, activists, academics, opposition figures, policy experts and individuals linked to Ukraine were repeatedly targeted because they shape public debate, document abuses, influence

ENISA Threat Landscape 2026

policy or provide insight into sanctions, defence, human rights and foreign policy networks. Calisto deployed LOSTKEYS against Western NGOs, journalists, Ukraine-aligned individuals and advisors through fake CAPTCHA pages, while UNC6293 targeted academics and policy experts by

manipulating them into creating App-Specific Passwords .

Graphite spyware was used against journalists and activists across Europe through WhatsApp and later iMessage exploitation, including Italian journalists, activists and a Sweden-based Libyan

activist . Pegasus infections were identified in Czechia, Poland and Spain, including professionals

in logistics and finance and one European government official .

4.3 Key TTPs and trends

In terms of overall trends, State-nexus intrusion sets were seen continuing to leverage tailored lures impersonating EU institutions, officials and affiliated entities to capitalise on the perceived

legitimacy of EU branding . 2025 saw the continued targeting of EU entities outside EU territory, focusing on diplomatic missions, development programmes, commercial operations and cultural

institutions abroad .

In terms of TTPs, Russia-nexus intrusion sets continued exploiting known vulnerabilities, as

illustrated by the BadPilot campaign , phishing campaigns delivering malicious PDFs exploiting CVE-

2024-38213 (EUVD-2024-37180) , the targeting of webmail platforms (CVE-2024-42009 - EUVD-

2024-39391, CVE-2025-49113 - EUVD-2025-16605) and vulnerabilities identified in software

and infrastructure such as CVE-2018-0171 (EUVD-2018-0994) or CVE-2025-8088 (EUVD-2025-

23983) . Russia-nexus groups also continued developing their offensive capabilities, with variants of previously known malware or the use of newly developed malicious code. Notable examples include APT29’s GRAPELOADER, APT28’s use of BEARDSHELL and Slim Agent, or Callisto’s LOSTKEYS

malware . Of particular interest was increased reporting of Russia-nexus actors targeting messaging applications, as well as their abuse of device code phishing and authentication workflows

in large-scale campaigns .

China-nexus intrusion sets continued exhibiting the use of living-off-the-land techniques and the

abuse of legitimate tools for infrastructure purposes . Google Calendar was reportedly used for

C2 purposes by APT41 leveraging the TOUGHPROGRESS malware , and in a separate campaign

ENISA Threat Landscape 2026

legitimate cloud storage (Zoho WorkDrive, Dropbox, OpenDrive) was used to stage a Microsoft LNKto-Python loader chain called WhirlCoil, that ultimately established Visual Studio Code Remote

Tunnels . Multiple China-nexus intrusion sets continued operationalising 0-day and N-day vulnerabilities rapidly, including Ivanti Endpoint Manager Mobile CVE-2025-4427 (EUVD-2025-

14388) and CVE-2025-4428 (EUVD-2025-14387) vulnerabilities , Ivanti Connect Secure VPN CVE-

2025-0282 (EUVD-2025-1580) vulnerability , SharePoint CVE-2025-49706 (EUVD-2025-20552), CVE-2025-49704 (EUVD-2025-20554), CVE-2025-53770 (EUVD-2025-21981), and CVE-2025-53771

(EUVD-2025-22040) vulnerabilities , Windows shortcut handling vulnerability CVE-2025-

9491(EUVD-2025-28860) , React2Shell CVE-2025-55182 (EUVD-2025-200983)

vulnerability , and CVE-2025-30333 and CVE-2025-20362 (EUVD-2025-31139) vulnerabilities in

Cisco firewalls . While still exploiting 0-day vulnerabilities, Hafnium was documented shifting to

supply chain attacks, targeting remote management tools and cloud applications for initial access .

Open-source reporting in 2025 further detailed the role of private contractors in China’s offensive

cyber doctrine , with the alleged KnownSec leak in November deserving particular attention. Moreover, in Q4 2025 China-nexus intrusion sets reportedly adopted a cooperative

operational model referred to as Premier Pass-as-a-Service (PPaaS) where one group would provide privileged access while another leverages it to conduct follow-on espionage, making imputation, detection and response much more complex. Finally, China-nexus intrusion sets continued

leveraging compromised routers, including in the EU , as part of their ORB infrastructure to carry out malicious activities, as illustrated by Operation WrtHug that reportedly impacted at least 20 EU

MSs . Unsurprisingly, reports also indicate the misuse of ChatGPT , Gemini and AI in general .

In the context of the Twelve-Day war, MuddyWater was seen leveraging a new version of the DCHSpy Android spyware, with infrastructure overlaps identified between DCHSpy and the SandStrike Android

malware ; also noted was the use of legitimate remote-access tools, such as NetBird and

OpenSSH . In keeping with its documented TTPs , Nimbus Manticore was observed using fake career portals to deliver malware through a multi-stage DLL side-loading technique, as well as leveraging the MiniJunk backdoor and the MiniBrowse stealer. Its targeting of defence and aviation

ENISA Threat Landscape 2026

sectors in the EU is congruent with other documented campaigns , and it is possible specific victimology was used for the supply chain compromise of third-party partners. Intrusion sets from Iran were publicly reported using AI products, notably Google's Gemini, as research assistants to boost

productivity as well as reconnaissance and for generating phishing content .

The table below displays a few examples of vulnerabilities exploited by State-nexus intrusion sets against EU MS organisations over the reporting period, based on information available in open sources and data shared by trusted partners with ENISA.

ENISA Threat Landscape 2026 ENISA Threat Landscape 2026

Tackling State-nexus threats

In 2025, the EU and national authorities in EU MSs continued discouraging malicious behaviours in the cyber domain, including through public attribution and sanctions. In January, the EU imposed restrictive measures on three individuals affiliated with Russia's GRU Unit 29155 for their involvement 541 542 in the 2020 cyberattacks against Estonia . In April, France publicly attributed cyber campaigns targeting entities linked to the Paris 2024 Olympic and Paralympic Games to GRU affiliated APT28 , while Czechia attributed the compromise of its Ministry of Foreign Affairs' unclassified network to MSS linked APT31 in May . Following the Czechia attribution, the European Union issued a solidarity statement condemning the malicious cyber campaign against Czechia and calling on China to prevent malicious cyber activities originating from its territory, in a Council statement by the High Representative on behalf of the European Union . In July 2025, UN Member States reached consensus on the Final Report of the Open-ended Working Group (OEWG) on Security of and in the Use of ICTs (2021–2025), reaffirming the UN framework for responsible State behaviour in cyberspace, and agreeing to establish a permanent Global Mechanism under the UN General Assembly to continue discussions on international cyber stability in 2026 .

ENISA Threat Landscape 2026

5. Foreign Information Manipulation & Interference (FIMI)

This section was directly drawn from the EEAS 4th report on Foreign Information Manipulation and Interference, published in March 2026 .

5.1 Key threats

Between 1 January and 31 December 2025, the EEAS, the European External Action Service, detected and analysed 540 FIMI incidents. Of these, 65% were unattributed, 29% attributed to Russia and 6% connected to China, with some instances in which Russian and Chinese FIMI infrastructures were jointly active in opportunistic amplification of one another.

A total of 10 500 unique channels were involved in the incidents detected, from fabricated news websites to social media accounts, resulting in cross-platform activities and coordination between multiple assets of the FIMI ecosystem. Approximately 43 000 observables were recorded on 19 unique platforms. Social media and messaging platforms such as X (88%) remain the most costeffective means to reach large audiences globally, including in the EU. FIMI incidents targeting Ukraine and Eastern Europe also were identified on Telegram (3%).

In 2025, continuous monitoring and efforts in data analysis refined the assessment by EEAS of the global FIMI threat landscape.

By focusing on patterns and the mapping of behaviours and infrastructures, the EEAS was able to identify several overarching trends.

• FIMI continues to evolve in tandem with technological progress, particularly in the field of artificial intelligence (AI). This evolution is visible in the content itself: synthetic audio and video, as well as AI-generated text, have become a daily and cost-effective tool in the arsenals of threat actors. AI also enables the mass distribution of content as well as translations across multiple languages, significantly expanding reach and potential impact. • FIMI operations are becoming increasingly covert and are combining different fields (information space, physical space, cyber space). State threat actors and their proxies are scaling up and expanding existing networks of deceptive assets designed to conceal their real origin. This is reflected in the near-continuous creation of inauthentic ‘news’ outlets, fabricated social media profiles, and online personas. • While this arena is often framed as mainly virtual, FIMI remains deeply anchored to a physical dimension - through concrete events, such as elections, and shaped by the targeting of specific socio-demographic groups and individuals. Besides the information environment itself, FIMI aims at shaping perceptions and influencing behaviour towards very concrete events, actions or individuals.

Overall, FIMI is deliberate and pursues clear strategic objectives on a broader scale. The recurring patterns and the TTPs observed reveal how Information Manipulation Sets (IMS) keep weaponising information as a key component of their wider hybrid arsenal. The choice of targets - whether countries, key events or specific individuals - is a sign of deliberate and structural planning.

ENISA Threat Landscape 2026

It demonstrates a high level of adaptability, with campaigns tailored to specific regional contexts while serving global strategic objectives. One illustrative case of 2025 is the pivot of the Russian FIMI infrastructure focus on the Moldova parliamentary elections towards the Armenia parliamentary elections scheduled for June 2026, which will be analysed further in this report.

Figure 4935 - Top 15 countries targeted by FIMI in 2025

In 2025, FIMI remained a global threat attempting to influence and destabilize all regions in the world. In Eastern Europe, while Ukraine remains at the heart of Russia’s hybrid warfare efforts, Moldova appeared as one of the key priorities in the Kremlin influence strategy in the context of the parliamentary elections held in October 2025. Following a similar pattern, Armenia was increasingly targeted by FIMI incidents in the context of the parliamentary elections held in June 2026. Many EU MSs, including France, Germany, Poland, Belgium, Italy and Spain were frequently targeted too, with topics such as Russia’s war of aggression against Ukraine, major electoral events and transatlantic relationships being strategically exploited by IMS.

Russia continues to use FIMI as one of its core instruments of state power, fully integrated into

its broader strategic and hybrid toolkit. In 2025, Russia’s central priorities continued to be its war of aggression against Ukraine and the targeting of Ukraine’s international partners. Significant FIMI activities were accompanied by escalatory hybrid actions including drone incursions, acts of sabotage and attacks on critical infrastructure in EU countries such as Poland, Romania, Lithuania and Estonia. These incidents were accompanied by FIMI designed to manage public perception and test responses. Over the past year, Russian FIMI campaigns underwent a strategic recalibration, shifting from a parallel focus on the EU and the United States to a more concentrated emphasis on Europe. The Kremlin’s FIMI apparatus combines overt and covert means that rely heavily on tailoring their operations to specific audiences. The main approach remains consistent – to sow new or deepen existing divisions. Russian FIMI actors also try to mobilise anti-establishment sentiments, by undermining trust in the EU, portraying it as either undemocratic and aggressive or too weak. EU

ENISA Threat Landscape 2026

leaders and institutions are frequently targeted, while initiatives such as the EU Democracy Shield are portrayed as authoritarian.

Elections remained a primary target, using country-specific FIMI narratives. For instance, in Czechia, hundreds of anonymous TikTok accounts spread pro-Kremlin narratives ahead of the parliamentary elections, while the Moldovan parliamentary elections faced an unprecedented wave of hybrid threats and FIMI .

To counter Russian FIMI, the EU expanded its hybrid sanctions regime to target the networks, assets and enablers behind such activities. This shift reflects a more coordinated effort to disrupt operational capacity , while EUvsDisinfo continued to expose and debunk Russian FIMI narratives.

Domestically, the Kremlin continues its efforts to reinforce regime legitimacy and military

support for Russia’s war of aggression against Ukraine. Expanded foreign agent, extremist, treason and terrorism legislation is systematically used to suppress independent journalism and 551 552 dissent . Russian state institutions continue to play a key part in FIMI activities. The Foreign Intelligence Service (SVR) has taken on a more visible role, issuing official statements containing false or unsubstantiated claims that are later amplified across FIMI networks. In 2025, this included false allegations of EU and NATO‑backed plots to destabilise Moldova, Serbia, and Georgia.

Other observed trends, such as the reliance on AI-enabled content, the continuous use of FIMI alongside other hybrid tactics, and even the further tightening of domestic censorship are expected to continue.

ENISA Threat Landscape 2026

Based on EEAS monitoring during the reporting period, elections once again emerged as primary targets of Russian FIMI activity. Within the scope of the analysis, Russia targeted electoral processes in Germany, Poland, Romania, Moldova, the Czech Republic, and Côte d’Ivoire. The threat actor mobilised its full media infrastructure (including official channels, state-controlled media, Information Manipulation Sets , and local proxies) to target elections in line with its geopolitical objectives.

The cases analysed in 2025 confirm patterns documented over the years in previous elections and consolidate the phased logic described in the 2nd EEAS Report on FIMI Threats . These patterns

have become the playbook used for Russian FIMI in elections, a repeatable and predictable

playbook that can be anticipated and addressed in advance. Despite contextual differences and varying levels of advancement, Russia repeatedly followed a three-stage operational logic:

• Phase 1: Control of the information space and delegitimization of political leadership months before the elections, • Phase 2: Weaponising domestic divisions during electoral campaigns, • Phase 3: Late-stage undermining of electoral integrity.

ENISA Threat Landscape 2026

In the current geopolitical and geo-economic context, China aims to present itself as a reliable global power, while simultaneously reducing Western global influence (e.g. in international relations, global governance norms and technology standards). Throughout 2025, China continued its multifaceted FIMI activities, deploying a broad range of tactics. These consisted in not only spreading conspiracy narratives and the expansion of its global FIMI infrastructure, but also more aggressive measures such as the intimidation and harassment of critical voices to suppress information even outside of its borders. Different tactics are often used in combination and can be connected to wider hybrid campaigns.

China’s FIMI infrastructure continued to strengthen the use of tools such as AI to obfuscate the origin of content, amplify its reach and to distance content from its state-linked origins while increasing its distribution, credibility and visibility.

Transnational Information Suppression (TIS) remains a key concern in detecting and

responding to Chinese FIMI. Often overlooked and difficult to track, as both threats and incentives aim to induce wide-spread self-censorship, information suppression manipulates the information environment by silencing authentic critical voices. Instead, China fills that space with content considered favourable and in alignment with its strategic objectives. Due to its cross-domain and often clandestine nature, identifying the main TTPs of TIS as well as understanding their scope and impact remains a challenge.

The most common narratives in 2025 remained largely similar to those observed in 2024. Chinese efforts to project a positive image abroad intensified, aiming to position China as a force for peace, a reliable and consistent diplomatic and trading partner, especially for the Global South. While promoting Chinese concepts and diplomatic efforts, these narratives were often coupled with offensive elements, such as criticism of ‘the West’, for example, as cynical and or aggressive. The narrative portraying the EU as subservient to the US in terms of foreign policy (e.g. on Gaza, Ukraine) remained, but this year also included criticism of the EU leadership as hawkish on China, as well as on Russia, Iran and the DPRK.

The change in US trade policy was used to deploy narratives calling for closer cooperation between the EU and China in setting up a new multilateral order. This narrative was particularly prominent around the EU-China Leaders’ Summit in July 2025. The so-called big four topics (Taiwan, Hong Kong, Xinjiang and Tibet) featured heavily, primarily through a defensive posture on human rights abuses in Xinjiang and Tibet. Hong Kong, Taiwan and the situation in the South China Sea were used in conjunction with promoting China’s concepts and views on sovereignty and territorial claims. The ecosystem continued presenting Russia’s war against Ukraine and Ukraine's accession to the EU as a source of division.

China’s FIMI activities operated alongside other threat actors, including Russian. While there have been several reports about the extent of convergence and mutual learning between the Russian

and Chinese ecosystems, the cross-pollination between the two seems to remain largely

opportunistic. For instance, several Chinese outlets provided a platform for Russian voices in the context of the Shanghai Cooperation Organisation summit and the Victory Day commemorations.

ENISA Threat Landscape 2026

In 2025, 27% of the incidents detected by the EEAS involved AI-related TTPs. This marks a significant rise compared to 2024, increasing from 41 to 147 cases — a growth of approximately 259%. Russian and Chinese FIMI actors have fully embedded AI tools into their FIMI operations, to accelerate their content production and scale up influencing activities with fewer resources. The growing quality, scale and apparent credibility of AI-powered information manipulation challenge the abilities of audiences to distinguish reliable information from fabricated content. By repeatedly exposing users to emotionally charged AI visuals, threat actors amplify cognitive chaos and erode the very principle of trust in the information environment. Some widely used AI tools are themselves becoming targets. For example, one of the most prolific Russian FIMI infrastructure, Portal Kombat is suspected of conducting Large Language Model (LLM) grooming , flooding the information space with low-quality multilingual content to influence AI training data and inject false or manipulative claims disguised as sources of reliable information. Despite this expansion, much of the AI-generated material in 2025 remains low-quality. IMSs prioritise quantity over quality, resulting in limited overall impact as organic engagement remains low. For example, Storm-1516 and Overload use AI-generated videos easily identifiable as inauthentic by average viewers, resulting in low overall impact and limited engagement metrics.

In the past years, the EEAS has focused on monitoring FIMI infrastructures and IMS to streamline responses that target the enablers of FIMI and their supply chains . Key IMS (such as Storm-1516, Doppelganger, RRN Media brands, Overload and Spamouflage) as well as infrastructures (such as Portal Kombat, Paperwall, HaiEnergy and Falsos Amigos) are described below.

ENISA Threat Landscape 2026

DOPPELGÄNGER

This IMS, operated by the EU-sanctioned entities Social Design Agency (SDA) and Struktura, focuses on impersonating legitimate media outlets . In 2025, it expanded its target audience to include Hebrew-speaking communities, while the rest of its activities remained mostly consistent with previous years. Doppelgänger activity remained quite stable, if not decreasing slightly, with fewer typo-squatted domains. Second, unlike other IMS such as Operation Overload, it did not show a surge in content production following major strategic events. Third, while Doppelgänger continued to rely on its well-established patterns on X, it appears to have discontinued this practice on Meta platforms. As observed in previous years, this amplification method inflated the number of views on Doppelgänger content but failed to generate authentic engagement. The cluster associated with Doppelgänger — which also includes RRN Media brands — appears largely isolated and does not interact with other IMS in the incidents analysed. This reflects a consistent pattern of the IMS, which seeks to build legitimacy by impersonating established outlets such as Der Spiegel, Le Point or Die Welt.

RRN/MEDIA BRANDS

Another SDA-run IMS, centred on the creation of inauthentic media brands and managing around five websites targeting Germany, France, Italy, Poland, Turkey, the United States (US), the Middle East and North Africa underwent significant changes. First, its most prolific outlet, RRN experienced a second rebranding presenting as ‘Researchers and Reporters Network’ since December, while maintaining its presence on the domain rrn.com.tr. As seen in previous years, Media Brands continued to prioritise quantity over quality, pushing so-called expert interview videos and articles via websites and social media. Media Brands often opportunistically align their content with that of other IMS when targeting strategic events, even when the topic has limited relevance for the intended audience. However, they do not directly interact with other IMS. Additionally, Media Brands published an estimated average of 15 articles per week, many AI-generated and others written by individuals affiliated with the Moscow State Institute of International Relations (MGIMO). This content frequently exploited domestic vulnerabilities to undermine the EU and the leadership of targeted countries. While there is evidence that this type of content generated slight organic engagement in very rare occurrences, an overwhelming majority of the interaction metrics remains

inauthentically inflated.

OPERATION OVERLOAD

Also known as Matryoshka , this non-attributed Russia-aligned IMS, which primarily relies on video content, significantly increased its activity in 2025, especially in the wake of relevant events, primarily focusing on posting fake content such as impersonation videos and deceptively redirecting to inauthentic articles aligned with Russian interests. In 2025, the IMS published content daily, peaking at 20 videos a day, and producing an estimated 700+ videos over the course of the year. In the case of large-scale events, such as the Moldovan elections, content was distributed months in advance. Overload’s event-driven activity is also reflected in its target audience. First, it expanded to Poland and Romania ahead of their elections, as well as expanding to Armenia and Moldova with nearly half of the impersonation videos directed at these two countries. Although France, Germany and Ukraine remained targets, their share decreased compared to previous years. The IMS adapts its content to each of the targeted countries, localising narratives that all revolve around a core set of themes including anti-Ukrainian rhetoric, election interference, security threats and leadership delegitimization. While Overload continues to rely primarily on Coordinated Inauthentic

ENISA Threat Landscape 2026

Behaviour (CIB) channels on X, distribution via Telegram increased noticeably in 2025. This IMS demonstrated a certain ability to segment audiences across platforms: Western European-language content is disseminated on X, while Eastern-European language content is concentrated on Telegram, where the platform is more popular.

STORM-1516

Also known as CopyCop or False Façade , this non-attributed Russia-aligned IMS consolidated its infrastructure in 2025 and emerged as the IMS most actively seeking to infiltrate authentic public discourse. Content from Storm-1516 reaches between 5,000 and 4 million views. This IMS uses fabricated websites, legitimate media platforms, online influencers and various amplification accounts to spread Russian narratives. In 2025, Storm-1516 sources almost doubled their output compared to 2024. It continued to expand its infrastructure with three types of domains hosting its video content (fictional news outlets, websites spoofing authentic media or other entities and websites impersonating official political campaigns or government platforms). These are sometimes created in bulk according to target audiences and strategic events with five networks created in 2025. The networks are

dedicated to German, American, French, Moldovan or general audiences and comprise 453

websites. Storm-1516 has also consolidated its amplification scheme: while it previously relied on Telegram channels, in 2025 this IMS increasingly relied on a network of contracted influencers, which also consistently amplified content by the Russian Foundation to Battle Injustice (R-FBI) which has demonstrated significant target overlap with the IMS, notably regarding the Moldovan, Ukrainian, German and Armenian leaderships.

PORTAL KOMBAT

Also known as Pravda network, it is one of the most prolific Russia-aligned infrastructures pretending to be a media content aggregator. It increased its output in 2025 and developed a strategic focus on specific cultural, ethnic and regional communities. On average, this IMS disseminated around 10 000 articles a day across 101 websites operating under the primary domain news.pravda.com. At the very end of 2024, Portal Kombat registered 26 new sub-domains dedicated to countries and regions, such as the Basque Country via basque.news-pravda.com, Republika Srpska in Bosnia and Herzegovina via srpska.new-pravda.com and the Balkans with balkan.newspravda.com. The IMS targeted these audiences with narratives centred on autonomy, identity and regional nationalism, exploiting existing societal divisions. However, its actual capability to reach

those audiences remains doubtful.

SPAMOUFLAGE

The Chinese-aligned IMS is only partially represented in the graph for illustrative purposes, as it comprises many inauthentic accounts that would otherwise overcrowd the visualisation. This IMS is mostly active on X, where its activity is organised around clusters of accounts. These clusters are characterised by their own behavioural patterns and are mobilised for specific purposes, such as responding to breaking news events, targeting dissidents or advancing Chinese propaganda points. As a result, this IMS does not follow a single, consistent operational model. One prominent pattern of Spamouflage involves a first cluster of seeder accounts impersonating dissidents, which post a video or an image containing false allegations. Then, a second cluster of amplifier accounts that disseminate the content by posting it as a reply to relevant entities, such as the accounts of government bodies. Finally, a third cluster of accounts that also post replies to similar entities, a screenshot of the initial video and hashtags to criticise and call for action against the dissident who

ENISA Threat Landscape 2026

allegedly published the content. A later section of the report examines Spamouflage’s emerging use of AI-generated impersonation videos.

SHARED ‘FOR-HIRE’ INFRASTRUCTURES

To illustrate how IMSs sometimes use the same ‘for-hire’ infrastructures for different purposes, as seen on X which has been leveraged both for the amplification of Spamouflage and Overload content. The amplification of Overload and Spamouflage content by the same CIB network is striking, especially since there is no evidence of systematic amplification by accounts outside those already linked to these IMSs. In the case of Overload, the content is almost exclusively amplified by known accounts through the seeder-amplifier scheme. In the case of Spamouflage, content is typically posted in high volume by many accounts, receiving limited engagement from other Spamouflagelinked accounts. This pattern suggests that the accounts receive a list of posts to boost rather than selecting material organically. In practice, this suggests that the same amplification networks can be mobilised by different actors if they are contracted by different customers.

HAIENERGY AND PAPERWALL

These Chinese State-nexus for-hire infrastructures continued their content dissemination activities in 2025. Paperwall recorded its largest infrastructural expansion since 2023, aiming to reach new audiences, mostly in Africa and the Middle East but also Southeast Asia and Australia. The operation likely uses automated processes to populate its websites with filler content. Additionally, a small infrastructure called Falsos Amigos linked to Chinese state-controlled media CGTN, has been quite prolific in its content production and dissemination in 2025.

The analysis and operational instruments presented in this chapter demonstrate that a purely defensive or reactive posture is insufficient in the face of a threat shaped and dictated by IMS. While it is neither realistic nor feasible to completely stop IMS from using FIMI, the impact and sustainability of these activities can be significantly reduced. Through disruption, cost imposition and the limitation of operational space, FIMI operators can be compelled to adapt, reassess and reconsider the viability of their campaigns. At the same time, strengthening societal resilience diminishes the effectiveness and legitimacy of manipulation efforts. A proactive and deterrenceoriented approach is therefore essential. By acting not only against individual incidents but against the enabling conditions that sustain them, the EU can reduce the space in which FIMI operates.

ENISA Threat Landscape 2026

6. Hacktivist Threats

This chapter analyses claimed ideology-driven malicious cyber activities associated with hacktivist groups affecting EU MSs in 2025 (57.3% of overall incidents). The chapter examines the scale and nature of hacktivist operations, targeted and impacted sectors and EU MSs, and the evolution of TTPs, with emphasis on Distributed Denial-of-Services (DDoS) and intrusion claims pertaining to the targeting of operational technology (OT). Hacktivism remains relevant as it combines claims of disruption and intrusion with a FIMI component directly tied to political and societal events, to amplify the reach of political messaging and create a sentiment of instability, ultimately resulting in reputational and operational pressure on public and private entities across the EU.

The targeting of EU MSs in 2025 by hacktivist groups was notable not only in regard to the volume of incidents but for the concentration of such activities among a finite number of groups. There was also a continuous correlation between geopolitical events in 2025, and the victims targeted by DDoS in this period. ENISA recorded 4 709 hacktivist claims against EU MSs during the year, of which more than 89% involved DDoS. Activities were driven by several groups, particularly pro-Russia NoName057(16), and were organised under operation-labelled campaigns (e.g. #Op Country X). Most of these campaigns were aligned with political developments, including elections, protests, geopolitical tensions and the support of Member States for Ukraine. Across the year, hacktivist incidents remained concentrated against public administration, transport and business services, with Germany, France, Italy, Spain and Poland among the most targeted Member States. In parallel, a subset of groups claimed intrusions involving operational technology (OT) or industrial environments, although verified disruption remained limited, as also reported from Member States. Monitored activity in 2025 showed that hacktivism cannot be assessed in isolation from the geopolitical environment. Many campaigns were branded, coordinated across channels and timed to reinforce messaging, often in connection with narratives such as, for example, the support of EU Member States for Ukraine or the use of frozen Russian assets in Belgium . Some observed hacktivist activity created both a disruptive effect, although generally considered of low impact and bound in time, and an informationoperation effect by amplifying visibility, retaliation narratives and perceptions of instability.

6.1 Key threats

The hacktivism threat landscape saw a rise from Q1 to Q3, followed by a slight reduction in Q4. Distributed Denial-of-Service (DDoS) claims accounted for 89.5% of all ideology-driven activity, with unauthorised access accounting for 10.5%. Of these, intrusion claims were 5.7%, followed by NoName057(16) was defacements claims (3%) and data breaches (1.9%). the central actor in the 2025 EU Pro-Russia NoName057(16) accounted for 48% of the overall total of ideology-driven activities and hacktivism remained active throughout the year. Other groups included pro-Palestine groups such as Dark Storm landscape. The Pro- Team (8.2%), Keymous+ (6.5%), Mr Hamza (5.4%), and pro-Russia Server Killers (4.3%). Hacktivist Russia group accounted for nearly half of recorded incidents and remained active across all quarters.

ENISA Threat Landscape 2026

activity remained aligned with political developments , elections , protests , geopolitical

tensions and notably with the support of EU MSs for Ukraine .

An increase in intrusion claims against operational technology (OT) and industrial

environments was noted in 2025. In Q2 2025, the pro-Russia Z-Pentest Alliance claimed intrusions

against infrastructure, including energy - and water-related environments . Q3

recorded 37 OT-related claims, by Z-Pentest Alliance and Infrastructure Destruction Squad (IDS)

groups . Q4 recorded 124 such claims. In most of the cases, claims did not identify either the TTPs or names of affected entities that would enable an assessment of potential impact. What is noteworthy, however, is an upward trend in 2025 in OT attacks by pro-Russia groups and the rise of

ENISA Threat Landscape 2026 6.2 Sectoral impact

Sectoral targeting remained concentrated in certain sectors. Public administration accounted for 45.8%, followed by transport (11.7%) and business services (7%). Digital infrastructure and the energy sector accounted for 4.8% respectively.

6.3 Geographical impact

Hacktivist operations across the EU were organised under operation-labelled campaigns such as 591 592 593 594 595 596 597 598 #OpGermany , #OpFrance , #OpSpain , and #OpPoland . However, not all attacks targeting EU MSs were conducted under an #Op-labelled banner, with a portion of activity occurring outside formally defined campaigns such as, for instance, attacks against Poland by 599 600 NoName057(16) .

Geographically, hacktivist incidents were not distributed uniformly across EU MSs. In 2025, 16% of

claims were recorded in Germany, and 14.8% against France, followed by Italy (10.5%), Spain

(10.1%), and Poland (8.9%). The most impacted EU MSs shifted across the year, with France leading in Q1, Italy in Q2, Germany in Q3 and Denmark in Q4.

ENISA Threat Landscape 2026

France, Italy, Lithuania, and Spain have been the most targeted Member States by hacktivists in Q1, often under named operation banners. The first surge of hacktivism attacks occurred in late February and early March, when Q1 activity rose above Q4 2024 levels. The surge was mainly on incidents claimed against Spain following their political support for Ukraine . Q1 also showed signs of ecosystem disruption and adaptation, as hacktivist groups responded to Telegram takedowns with alias changes and migration away from the platform. ENISA saw that more than 60 hacktivist groups were removed from the Telegram platform by Telegram administrators between January and March following the arrest of Telegram’s CEO in 2024 .

Germany, Poland and Lithuania were the most targeted EU MSs. Hacktivist activity was observed to

be concurrent with political or geopolitical triggers such as the new security bill in Italy , the political Poland were the most situation in France , and legal actions from Lithuania against Belarus at the International Court of targeted Member Justice over illegal immigration . Q2 also showed retaliatory framing, including operations linked to States, while public

support for Ukraine and the NATO Summit held in The Hague in June 2025. administration

Hacktivist activity reached its highest level in Q3. This quarter was marked by a surge between mid- largest share of July and mid-August, shortly after the announcement of Operation Eastwood against incidents. Campaigns NoName057(16) . Germany became the main target, particularly under #OpGermany, while France, closely related to

ENISA Threat Landscape 2026

Spain and Italy also remained targets. Public administration continued to be the primary target sector, but activity against transport increased compared with Q2.

Q4 activity declined from the Q3 peak but remained above early-year levels with NoName057(16) continuing to dominate the hacktivist landscape followed at a distance by Pro-Russia Server Killers and Pro-Palestine Dark Storm team. Denmark emerged as the most targeted Member State. The country demonstrated a strong willingness to support Ukraine that caused repeated campaigns by Pro-Russia groups, notably in the context of the Danish elections . Other EU MSs that were particularly targeted by hacktivists in Q4 were Belgium, France and Spain.

For the reporting period, the participation of hacktivist groups to coordinated campaigns, typically under the #op banner, is shown in Figure 56.

Pro-Russia NoName057(16) and pro-Palestine Hezi-rash, Mr Hamza and Dark Storm Team have been the most active groups regarding their participation to such campaigns against EU Member States.

ENISA Threat Landscape 2026 6.4 Key trends

In 2025, Distributed Denial of Service (DDoS) remained the primary tactic, technique and

DDOS

procedure (TTP) for hacktivist activities affecting the EU. ENISA’s analysis of DDoS activity linked to 613 DOMINANCE AND NoName057(16) and the DDoSia project between July and November 2025 showed how hacktivist activity combined disruption, mobilisation and influence operations. DDoSia tasking relied on HTTP RISING OT GET, SYN, ACK, POST, SYN-ACK, UDP flood, and ICMP ping methods, with concentration on TCP CLAIMS ports 443 and 80, consistent with targeting web services. However, in the case of NoName057(16) and the associated infrastructure of the DDoSia botnet, the combination of activities and narratives DDoS remained the showed that hacktivist DDoS activity should not be assessed only through technical disruption. main hacktivist tool in ENISA's analysis showed that NoName057(16)'s public claims generally aligned with intended 2025, with activity focused on public targeting by DDoSia. Nevertheless, only 23.8% of the claims assessed were validated through web services and independent third-party availability checks. This disparity suggests that some claims may have served increasingly an influence objective by inflating perceptions of operational impact, including instances where supported by disruption could not be verified. accessible attack infrastructure. The Another important finding, beyond NoName057(16) and the DDoSia infrastructure, is the growing use growth of DDoS-as-aof DDoS-as-a-Service (DDoSaaS) models by hacktivist groups, likely driven by a lack of technical Service, shortcapability or infrastructure to independently conduct large-scale attacks and/or increase the intensity duration attacks, and scope of DDoS attacks by enrolling additional hacktivist groups. This reflects a broader shift multivector toward the commoditisation of DDoS capabilities, where attack tools, botnets and operational support techniques, and are increasingly outsourced or shared across loosely affiliated operators. Commercially available application-layer services—often referred to as ‘booters’ or ‘stressers’ such as Elite stress —provide on-demand disruption increased DDoS capabilities through user-friendly interfaces, enabling low-skilled groups to launch more pressure on advanced attacks by simply selecting a target and paying a fee. Originally marketed as legitimate mitigation, especially network testing tools, these platforms are widely abused for malicious purposes, offering features such for APIs, login flows, as scalable traffic generation, multiple attack vectors and subscription-based access models. As a payment services, result, the technical and financial barriers to entry for conducting disruptive cyber operations has been and other user-facing significantly reduced, enabling hacktivist groups to participate in high-impact campaigns without services. At the same owning or managing dedicated infrastructure . time, OT-related claims became more Other examples of the commoditisation of ideology-driven capabilities include the Pro-Palestine visible in the EU, Keymous+ and Mr Hamza groups. In addition to their hacktivist operations, Keymous+ has been suggesting growing assessed to potentially operating as a DDoSaaS, offering attack capabilities to aligned groups or interest in industrial partners. Keymous+ leverages a combination of infrastructure sources to deliver coordinated environments, campaigns, while also collaborating with other groups to amplify scale and impact. Mr Hamza although limited operates under the Hacktivism-As-A-Service (HaaS) model, where individuals or groups package verification restricts confidence in actual cyber operations—particularly DDoS attacks—into accessible services for politically motivated and 616 617 disruption. ideology driven clients or affiliates .

The 2025 landscape indicates that hacktivism has remained a predominantly reputational pressure point, mainly against public administration in the EU with some instances of operational impact also observed. In parallel, a subset of groups continued to claim access to industrial or Internet-exposed systems . Although OT disruption remained largely unverified, the focus on these environments indicates that adversaries have a rising interest in exploiting configurations, interfaces, and credentials for operational effect or signalling.

ENISA Threat Landscape 2026

At a global level and not necessarily related to ideology driven attacks, DDoS activity in 2025

increased in scale and frequency and became a means of exerting pressure against Internet-facing services and infrastructure. In 2025, 47.1 million DDoS attacks were mitigated globally, more than double the volume in 2024, equivalent to an average of 5 376 attacks every hour. Growth occurred at the network layer, where 34.4 million attacks were mitigated in 2025, compared with 11.4 million in 2024 .

Attack size increased during the year. In mid-May 2025, a 7.3 Tbps multi-vector attack delivered 37.4 TB in 45 seconds and targeted tens of thousands of destination ports on a single IP address . By Q3, the Aisuru botnet, assessed at 1–4 million infected hosts, launched attacks above 1 Tbps and 1 Bpps, with peaks of 29.7 Tbps and 14.1 Bpps . In Q4, activity was linked to Aisuru-Kimwolf, including a 31.4 Tbps attack lasting 35 seconds, while in late 2025 attack sizes were more than 700% above those observed in late 2024 .

Attack patterns and targeting also changed over the reporting period. In Q3, 71% of HTTP DDoS attacks and 89% of network-layer attacks globally ended in under 10 minutes, reducing the effectiveness of mitigation and response models. In the second half of 2025, more than 8 million DDoS attacks were recorded across 203 countries and territories, with EMEA accounting for 3.3 million events. More than half of observed attacks were multi-vector, combining bandwidth-exhaustion and state-exhaustion techniques , while attacks against DNS root servers and Network Time Protocol (NTP) services showed activity against core internet services . In 2025, application layer (Layer 7) DDoS attacks reportedly exhibited an increase of 128% over the previous year. These attacks can generate disruption where traffic volumes appear modest. This is particularly relevant for services, Application Programming Interfaces (APIs), login flows, payment services and other user journeys where availability can be degraded without high traffic volumes .

ENISA Threat Landscape 2026

7. Vulnerabilities

The exploitation of vulnerabilities remains one of the most prevalent intrusion vectors. Specifically, the threat landscape in 2025 was characterised by confirmed attacks against enterprise infrastructure, edge devices and developer tooling as well as unpatched legacy IoT and edge devices (impacting among others D-Link, Zyxel, DASAN, Huawei, Realtek and Netgear devices) that have left many exposed . Overall, attackers continued to successfully manage to achieve the weaponisation of newly disclosed vulnerabilities within a constantly decreasing time span .

ENISA as a CVE Program-Root

In line with Coordinated Vulnerability Disclosure practices in the EU and complementary to its role as a Common Vulnerability and Exposure Numbering Authority (CNA) , ENISA maintains the European Vulnerability Database (EUVD) to further support the cybersecurity community by providing reliable and timely information related to vulnerabilities. Since November 2025 ENISA has expanded its role in vulnerability management by becoming a Root CVE thus becoming a central point of contact within the CVE programme for national and EU authorities, EU CSIRTs network members and cooperative partners falling under ENISA’s mandate.

Overall, more than 48 thousand new vulnerabilities were published in 2025 with assigned Common Vulnerability and Exposure (CVE) Identifiers, a programme with the purpose of identifying, defining and cataloguing publicly disclosed cybersecurity vulnerabilities — a 22% increase from the previous year.

ENISA Threat Landscape 2026

A breakdown of the vulnerabilities in the Common Vulnerability Scoring System (CVSS ), a framework for rating the severity of software and hardware vulnerabilities, shows that 9% were Critical, 30% High, 49% Medium and 3% Low, while 9% remained unscored.

When considering the attack surface, 71% of documented vulnerabilities mentioned Network as the attack vector, in accordance with the definition of the CVSS Attack vector metric . This underscores the potential risk of remote exploitation, especially for internet-facing systems.

Based on the Common Weakness Enumeration (CWE) list, a community-developed category system for hardware and software weaknesses and vulnerabilities calculated by analysing public vulnerability

ENISA Threat Landscape 2026

information in CVE Records for CWE root cause mappings , the top 10 most common weaknesses in hardware and software in 2025 were the following:

The CWE 2025 list uses a scoring mechanism that indicates which weaknesses are common, have caused significant harm and could consequently have security ramifications. Building upon it, the top

25 most relevant weaknesses in hardware and software were the following:

ENISA Threat Landscape 2026

The top 20 vendors whose solutions were reported as vulnerable accounted for 34% of all newly disclosed documented vulnerabilities over the reporting period.

The CISA’s Known Exploited Vulnerabilities (KEV) Catalogue added 245 vulnerabilities over the reporting period, of which the top ten affected vendors are displayed in figure 62 below.

ENISA Threat Landscape 2026

The top three most Common Weakness Enumeration (CWE) related to Known Exploited Vulnerabilities in the reporting period are:

• CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), • CWE-502: Deserialization of Untrusted Data.

All these weaknesses can allow memory modification and code execution (which could lead to taking full control of the impacted system) as well as crashes and denials of service impacting the availability of the services run on or through the impacted systems.

A dynamic list of knowingly exploited vulnerabilities is accessible via the ENISA EUVD . It notably merges EU and CISA KEV Catalogues.

ENISA Threat Landscape 2026

8. Outlook and conclusion

Current observations indicate that several of the dynamics documented during the reporting period are likely to persist. In the near-term, it is highly likely public and private organisations in EU MSs will continue to face hacktivist-associated threats with periodic peaks, stable cyberespionage activities with a continued prevalence of Russia-nexus and China-nexus intrusion sets, and an even more mature yet further fragmented and resilient cybercriminal ecosystem.

The activity observed during 2025 suggests that the cyber threat landscape affecting the EU is becoming increasingly shaped by the interaction between established threats, as well as the emergence of new groups. Cybercriminal, hacktivist and State-nexus groups continued pursuing different objectives, yet frequently relied on similar access vectors, tools and operational approaches. Still, new groups will likely continue emerging. Of note, the frequent updates and convergence of TTPs by well-known State-nexus and cybercriminal groups increasingly hinder tracking and consistent imputation, ultimately leading to a virtually inflated and scattered threat landscape.

Cybercrime will highly likely remain one of the most impactful threats to business continuity for organisations operating in the EU as well as EU organisations operating abroad, ultimately having an economic impact on the EU market. Displaced or disrupted RaaS brands will continue being rapidly replaced by emerging programmes. Extortion schemes and breaches will likely continue evolving in line with changing technologies (including but not limited to AI) and monetisation opportunities. The continued availability of cybercriminal services, including tooling and operational support will further contribute to lowering barriers of entry to the cybercriminal ecosystem.

Another development is the continued convergence of operational practices across different threat group types. While assessed objectives appear distinct, the practical differences between cybercrime, hacktivist and State-nexus activity are likely to further converge. The same vulnerabilities, platforms and toolsets are likely to be leveraged regardless of the groups’ motivation. As a result, organisations may increasingly face different threats gaining unauthorised access through similar pathways, reinforcing the importance of addressing common weaknesses in addition to efforts to increase collective situational awareness.

Several incidents documented during the reporting period also confirmed the well-established critical importance of digital dependencies. Software suppliers, developers, managed service providers, cloud platforms and customer-service environments continued to appear as high-value targets to enable upstream and downstream impact. As organisations continue integrating third-party services into their operations, opportunities for threat groups to achieve broader impact through a single compromise are likely to increase.

2025 also showed that social engineering continues to evolve. While large-scale phishing and spearphishing remain common threats, campaigns increasingly relied on trusted communication platforms and bypassing or abusing legitimate authentication mechanisms. Device-code phishing and ClickFix illustrate a broader shift towards techniques designed to further capitalise on abusing trust rather than technical weaknesses alone.

Geopolitical developments are also likely to remain a major driver of cyber activity affecting the EU. Throughout the reporting period, disruptive and cyberespionage campaigns frequently coincided with political developments, public statements or high-visibility events. Similar patterns are likely to persist. Cyber operations continue to offer a relatively low-cost means of signalling intent, attracting

ENISA Threat Landscape 2026

attention and exerting pressure without crossing the threshold of conventional conflict. While Statenexus groups are likely to maintain a sustained interest in public administration and other high value targets across the EU, hacktivist-led DDoS will persist as a nuisance, both in terms of the potential disruption of business continuity and in the information operation sphere, highly likely with spikes around high visibility events and announcements by EU MSs and Union entities and authorities. While claims pertaining to the targeting of Operational Technology by hacktivist groups will likely increase, confirmed incidents resulting in operational impact are likely to remain stable.

Looking ahead, ENISA’s assessment is that Artificial Intelligence is likely to further accelerate several of these developments. During 2025, ENISA observed AI being incorporated into the playbooks of cybercriminal, State-nexus and information manipulation sets, although often in a supporting role rather than as a primary capability. This is highly likely to change as so-called ‘frontier models’ would become more widely available. While AI will highly likely continue to primarily act as a force

multiplier, it is also likely 2026 will see an increased number of the kill chain’s phases being

directly enabled by AI, with possible experimentation of Human-out-of-the loop proof of concepts, which would be likely to hinder detection and imputation for networks defenders.

ENISA Threat Landscape 2026

Appendix A Law Enforcement Authorities operations in the EU

ENISA Threat Landscape 2026 ENISA Threat Landscape 2026 ENISA Threat Landscape 2026

Appendix B Assessment methodology

CONFIDENCE LEVEL SYNONYMS

ABOUT ENISA

The European Union Agency for Cybersecurity, ENISA, is the Union’s agency dedicated to achieving a high common level of cybersecurity across Europe. Established in 2004 and strengthened by the EU Cybersecurity Act, the European Union Agency for Cybersecurity contributes to EU cyber policy, enhances the trustworthiness of ICT products, services and processes with cybersecurity certification schemes, cooperates with Member States and EU bodies, and helps Europe prepare for the cyber challenges of tomorrow. Through knowledge sharing, capacity building and awareness raising, the Agency works together with its key stakeholders to strengthen trust in the connected economy, to boost resilience of the Union’s infrastructure and, ultimately, to keep Europe’s society and citizens digitally secure. More information about ENISA and its work can be found here: www.enisa.europa.eu.

ENISA

European Union Agency for Cybersecurity

Athens Office

Agamemnonos 14 Chalandri 15231, Attiki, Greece

Brussels Office

Rue de la Loi 107 1049 Brussels, Belgium

enisa.europa.eu