The latest ENISA Threat Landscape 2025 report confirms that Europe remains under crossfire from opportunistic cybercrime, state-backed espionage, ideological hacktivism, and AI-driven disinformation.
First comes an increasingly industrialized cybercrime ecosystem, where ransomware and vulnerability exploitation have become full-fledged business models. Then, enduring espionage operations conducted by Russian and Chinese state-linked actors continue to infiltrate European diplomatic, technological, and strategic networks. Added to this is loud, instrumentalized hacktivism — straddling the line between digital activism and cybercrime — whose media resonance often outweighs its technical impact. Finally, a sophisticated wave of information manipulation (FIMI), now fueled by generative AI and large-scale disinformation campaigns, aims to undermine democratic cohesion.
This explosive mix is reshaping the threat landscape for EU Member States, European institutions, and critical enterprises, according to the European Union Agency for Cybersecurity (ENISA).
Key Trends
Phishing remains the primary entry vector (around 60%), but vulnerability exploitation proves far more destructive: nearly 70% lead to network intrusion, and 68% result in malware deployment.
The public sector remains the most targeted vertical, accounting for 38.2% of incidents (out of 4,875 reported). It faces both hacktivist campaigns and state-linked espionage operations, which now represent 7.2% of all recorded attacks.
In sheer volume, Distributed Denial of Service (DDoS) attacks dominate (nearly 77%), mostly claimed by hacktivist groups driven by political or geopolitical motives. Their operational impact is limited — only about 2% cause actual service disruption — yet they flood government networks through low-cost, high-visibility campaigns.
Conversely, ransomware remains the most damaging threat. ENISA identified 82 variants and notes a growing industrialization of the Ransomware-as-a-Service (RaaS) model, where low-skilled affiliates rent malware kits from professional operators and share the ransom profits.
Attack surfaces follow a consistent hierarchy: mobile (42.4%), web (27.3%), operational technology (18.2%), and supply chain (10.6%).
Emerging threats include Phishing-as-a-Service platforms, adversary-in-the-middle (AitM) kits, ClickFix/ClearFake campaigns, QR-phishing, and WordPress website compromises.
Groups such as UNC5221 and Salt Typhoon illustrate a rising pattern: compromising edge devices — routers, VPNs, or connected gateways — to establish persistent, stealthy access.
Meanwhile, the boundaries between cybercrime, hacktivism, and state espionage are blurring. European infrastructure is increasingly reused to disguise the true origin of attacks and amplify coordinated disinformation campaigns — a phenomenon ENISA dubs “faketivism,” where digital propaganda and technical disruption intertwine.
TTPs and Vulnerabilities: SOC Focus
On the technical front, adversaries rely on well-established yet efficient tradecraft. They begin with system and network discovery (MITRE ATT&CK T1057, T1016, T1082), proceed to execution via interpreters, scripts, or native APIs (T1059, T1106), establish persistence through Windows services, registry modifications, or rogue accounts, then move to data exfiltration (T1041) and impact (T1485–T1490).
Across the reporting period, 42,595 vulnerabilities were recorded — a 27% increase — with 7% rated critical and 64% remotely exploitable. The most frequent weaknesses align with well-known CWEs: cross-site scripting (XSS), buffer overflows, SQL injections, CSRF, path traversal, command injection, and use-after-free flaws.
At least 245 Known Exploited Vulnerabilities (KEV) were actively targeted across critical environments, including Microsoft Exchange, Citrix, Fortinet, Zimbra, VMware vCenter, and TeamCity. Privilege escalation (T1068) and client-side execution (T1203) remain major attack vectors, often coupled with phishing or drive-by compromises, where victims unknowingly trigger malware execution during fake human-verification prompts.
Operational Priorities (SOC / Blue Team)
For SOC and Blue Team leaders, the roadmap is clear.
Systemic hardening must come first — from Active Directory and operating systems to OT environments. Disable unnecessary services, segment networks, and restrict DLL and library loading to minimize exposure.
Next comes behavioral detection: correlating EDR, SIEM, and CTI telemetry to identify persistence and lateral movement, rather than chasing fleeting indicators of compromise.
Vulnerability management must be unified and risk-prioritized. Align patching with the CISA Known Exploited Vulnerabilities (KEV) catalog to remediate what is truly exploited, while continuously monitoring exposed assets.
Identity protection is now a frontline defense — enforce PAM and MFA, apply strict access policies, and detect token abuse to break privilege-escalation chains.
Resilience must extend beyond production: offline backups, encryption, DLP, and regular restoration drills to transform theoretical plans into actionable recovery capability.
Cyber threat intelligence (CTI) monitoring should integrate zero-day exploitation, hacktivist campaigns, and FIMI signals directly into operational dashboards.
Above all, success requires cross-functional orchestration — aligning intelligence, compliance, and incident response so that SOC, GRC, and crisis teams act as a unified defense front.
The ENISA Threat Landscape 2025 is based on 4,875 analyzed incidents occurring between July 1, 2024, and June 30, 2025, and includes detailed annexes describing the attack types and methods observed.
Source: ENISA
