The European Union Agency for Cybersecurity (ENISA) has released its flagship ENISA Threat Landscape 2026 (ETL 2026) report, analyzing 8,257 cybersecurity incidents recorded across the calendar year 2025. For CISOs, threat intelligence teams, and security practitioners operating across Europe and globally, the report reveals a threat environment defined by two overarching realities: geopolitical friction continues to dictate the volume of attacks, while mature criminal ecosystems and digital dependencies dictate the actual operational impact.

More importantly, the traditional boundaries separating cybercriminals, hacktivists, and state-nexus intrusion sets are eroding. Adversaries with vastly different strategic objectives are converging on the same initial access vectors, commercialized tooling, and cloud/identity attack surfaces—making attribution harder and foundational defense more critical than ever.

Executive Snapshot: The 2025/2026 Threat Matrix by the Numbers

Metric / Category	Top Findings & Breakdown	Primary Operational Takeaway
Total Analyzed Incidents	8,257 incidents (Jan 1, 2025 – Dec 31, 2025)	Expanded tracking of data breaches and fraud highlights deep ecosystem overlaps.
Primary Incident Types	DDoS (51.3%), Unauthorised Access (39.5%), Fraud/Impersonation (7.5%)	DDoS dominates raw volume (“noise”), while unauthorised access drives material business disruption.
Assessed Motivations	Ideology-driven (57.3%), Financially motivated (29.3%), Cyberespionage (5.9%)	Financial attacks cause the sharpest short-term impact; espionage poses the greatest long-term strategic risk.
Unauthorised Access Vectors	Vulnerability Exploitation (60.4%), Misconfiguration/Exposure (20.7%), Insider Threat (10.1%)	Edge device N-days/0-days lead intrusions, while DPRK fraudulent IT workers drove a spike in insider threats.
Social Engineering Breakdown	Phishing (77.8%), Malspam (13.0%), BEC (3.7%), Smishing/Vishing/Quishing (1.9% each)	Heavy shift toward Adversary-in-the-Middle (AiTM) PhaaS kits (Tycoon 2FA), ClickFix lures, and device code phishing.
Top 5 Targeted EU Sectors	Public Administration (31.8%), Business Services (8.5%), Transport (8.0%), Manufacturing (6.9%), Finance/Banking (5.6%)	Essential and important entities under NIS2 represent 73% of all recorded events.

1. Attack Vectors & Tradecraft: The Trust & Dependency Shift

While zero-day and N-day vulnerability exploitation remains the dominant technical pathway for unauthorized access (60.4%), the most notable evolution in 2025–2026 tradecraft is how adversaries abuse human workflows, legitimate authentication mechanisms, and upstream software dependencies.

• The Rise of “ClickFix” and Device Code Phishing: Traditional link-based phishing is increasingly supplemented by interactive social engineering. The ClickFix technique—which deceives users via fake human-verification CAPTCHAs or error prompts into copying and executing malicious PowerShell commands directly from their clipboard—was heavily adopted across both cybercrime (deploying StealC and Qilin ransomware) and state-nexus campaigns. Simultaneously, multiple Russian and state-aligned threat groups weaponized device code phishing and OAuth workflows across trusted messaging apps like Signal, WhatsApp, and Microsoft Teams to hijack session tokens and bypass Multi-Factor Authentication (MFA).
• Industrialized Phishing-as-a-Service (PhaaS): Credential harvesting is now dominated by turnkey AiTM frameworks. Tycoon 2FA emerged as the most widely observed phishing kit globally in 2025, alongside Lucid PhaaS (developed by the XinXin Group) and Lighthouse (leveraged by the China-based Smishing Triad, which rotates roughly 25,000 active phishing domains every eight days).
• Supply Chain & Package Manager Compromises: Attackers systematically targeted third-party Managed Service Providers (MSPs), SaaS/CRM platforms, and open-source code repositories to maximize downstream impact. High-profile incidents included the Shai-Hulud campaign compromising npm packages to target cloud and developer systems, alongside Lazarus-linked malicious npm packages and VS Code extensions aimed at software engineers.
• Infiltrating the Payroll (The 10.1% Insider Threat): Insider threats rose to 10.1% of identified unauthorized access vectors, largely driven by Famous Chollima (DPRK IT workers). Operating under synthetic identities generated with AI, these operatives secured remote employment inside European technology, consultancy, defense, and government-adjacent firms to generate state revenue and enable follow-on data extortion.

2. Sectoral Deep Dive: Where Criticality Meets Exposure

Essential and important entities covered under the EU’s NIS2 Directive accounted for 73% of all recorded incidents. Furthermore, cross-referencing ENISA’s open-source dataset with official EU Member State NIS2 incident notifications highlights Health (18% of NIS2 reports) and Digital Infrastructure (12% of NIS2 reports) as critical high-impact verticals alongside the top five open-source targets.

• Public Administration (31.8%): Situated squarely in ENISA’s “cyber risk zone” (where criticality outpaces cybersecurity maturity), public administration absorbed the brunt of geopolitical hacktivism, with DDoS accounting for 81.8% of incidents. However, financially motivated attacks (8%) caused severe downstream disruption—most notably a ransomware attack on a Swedish IT supplier that crippled HR reporting across 200 municipalities, and major data breaches exposing citizen records in France (Pajemploi/URSSAF, 1.2M individuals) and Slovenia (873,000 individuals).
• Business Services (8.5%): Falling largely outside strict NIS2 scope, consultancy, hospitality, broadcast media, and legal/wealth management firms suffered predominantly from unauthorized access (56.7%), over half of which involved ransomware deployments. A ransomware strike against a French wealth management software vendor paralyzed operations for downstream banks and advisers for over 10 days.
• Transport & Logistics (8.0%): Railway (31.9%) and aviation (30.4%) led sector targeting, with rail incidents surging from just 2% in the prior period due to sustained hacktivist DDoS waves in H2 2025. On the criminal front, the September 2025 Everest Group ransomware attack against Collins Aerospace’s passenger-processing software (vMUSE) disrupted automated check-in across major EU airports (including Brussels and Berlin) and exfiltrated over 1.5 million passenger records. Air France-KLM and Iberia also disclosed customer data breaches stemming from third-party supplier compromises.
• Manufacturing (6.9%): Unlike public administration or transport, manufacturing was overwhelmingly hit by unauthorized access (80.4%) and financially motivated attacks (61.1%), with ransomware accounting for 82.8% of financial incidents. Machinery, construction, automotive, and defense contractors were prime targets, with several attacks cascading across international subsidiaries (such as German manufacturer Thermofin and Okuma Europe).
• Finance & Banking (5.6%): Credit institutions (61.9%), insurance providers (17.8%), and crypto-asset service providers (7.7%) faced a dual onslaught of data breaches (60.1% of financial incidents) and targeted fraud/impersonation. Major insurance exposures hit customers of Generali Tranquilidade and Generali España.

3. The Cybercrime Ecosystem: Extortion Over Encryption and Physical Convergence

Financially motivated crime accounted for 29.3% of all EU cyber incidents—led by ransomware deployments (47.3%), data breaches (36.0%), and fraud/impersonation (13.3%)—Concentrated heavily in Europe’s largest economies: Germany (18.1%), Spain (17.7%), France (17.6%), and Italy (12.6%).

The New Ransomware Guard & Tradecraft

Following law enforcement takedowns and internal implosions that sidelined legacy giants like LockBit, BlackBasta (shut down February 2025), and RansomHub (shut down April 2025 amid a hostile takeover dispute with DragonForce), the EU ransomware landscape fragmented and coalesced around cinco dominant operators:

1. Qilin (7.7%): The most active RaaS in the EU (hitting France, Spain, and Germany heavily). Qilin popularized ClickFix initial access, FortiGate vulnerability exploitation (CVE-2024-55591), and an aggressive “Call Lawyer” feature on its negotiation portal designed to weaponize GDPR and NIS2 regulatory fines to coerce rapid payouts.
2. SafePay (4.9%): Suspected of utilizing a modified LockBit 3.0 builder, SafePay surged in Germany (16.2% of top-5 EU claims) by impersonating IT staff over Microsoft Teams and Quick Assist to load Remote Monitoring and Management (RMM) tools.
3. Akira (4.5%): Heavily targeted manufacturing, aviation, and finance via SonicWall and Cisco VPN exploits (CVE-2024-40766, CVE-2023-20269).
4. INC Ransom (3.1%) & Hunters International (2.5%): Maintained steady operational tempo across education (e.g., Roma Tre University), healthcare, and industrial targets.

Across these groups, ENISA mapped a decisive shift in MITRE ATT&CK TTPs: Exfiltration Over C2 Channels (T1041) was observed in 73.3% of analyzed operations (using tools like Rclone, FileZilla, and Cyberduck to push data to MEGA or Backblaze), whereas Data Encrypted for Impact (T1486) appeared in just 13.7%. Simultaneously, RaaS affiliates widely integrated EDRKillShifter, HRSword, and Bring Your Own Vulnerable Driver (BYOVD) techniques to blind endpoint detection agents prior to rapid data theft.

Cloud Data Breaches & The “Wrench Attack” Escalation

In the data breach arena, ShinyHunters (3.1%) and mydocs (2.8%) led attributed activity, with underground trading heavily concentrated on the resilient BreachForums/DarkForums ecosystem (darkforums.st accounted for 58.6% of tracked listings). ShinyHunters demonstrated mastery of the cloud kill chain—using vishing to harvest SSO credentials and OAuth tokens (T1528) to pillage Salesforce, Snowflake, Microsoft 365, and Google BigQuery environments.

Crucially, ENISA flagged two alarming trends in victimology:

• Repeat Victimisation: 33 EU organizations were compromised multiple times in 2025 (44% via ransomware, 40% via data breaches), pointing to incomplete eradication and poor post-incident restoration hygiene.
• Physical Kidnappings (“Wrench Attacks”): Cybercrime crossed into violent physical crime across Belgium, France, and Spain, where threat actors leveraged PII and home addresses leaked from centralized cryptocurrency exchanges to kidnap crypto executives, investors, and their family members for ransom.

4. State-Nexus Operations: Edge Infrastructure, Routers, and Wipers

State-nexus activity accounted for 5.9% of recorded incidents, driven overwhelmingly by Russia (47.6%), China (15.5%), DPRK (14.1%), and Iran (9.0%), alongside Private Sector Offensive Actors (PSOAs, 6.5%). Where initial access vectors were identified, 70% relied on vulnerability exploitation.

• Russia-Nexus (Storm-2372, APT28, Callisto, Sandworm, DragonFly): Accounted for the top two most active intrusion sets in the EU: Storm-2372 (17.4%) and APT28 (11.9%). While Storm-2372 executed massive device-code phishing waves across European governments and energy sectors, APT28 targeted ministries, defense contractors, and logistics firms supporting aid to Ukraine—deploying custom backdoors (HEADLACE, MASEPIE, BEARDSHELL) and abusing Signal to deliver NotDoor malware. In December 2025, DragonFly escalated beyond espionage, executing a coordinated attack using wiper malware against the EU energy sector.
• China-Nexus (Salt Typhoon, Mustang Panda, UNC5221, APT31): Focused heavily on telecommunications, maritime transport, semiconductors, and government ministries. Salt Typhoon compromised European telecom and satellite infrastructure (including Viasat and Cisco IOS XE devices). In mid-2025, China-nexus actors (notably APT27, APT31, and Storm-2603) spearheaded a massive zero-day exploitation wave against on-premises Microsoft SharePoint servers (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771) across 80 countries. China-nexus groups also pioneered a cooperative “Premier Pass-as-a-Service” (PPaaS) model—where one group maintains initial access and hands off privileged sessions to secondary espionage units—while hijacking consumer and SOHO routers across 20 EU Member States (e.g., Operation WrtHug and Vicious Trap) to build covert Operational Relay Box (ORB) networks.
• Iran-Nexus & Commercial Spyware (PSOAs): Following the 12-day war between Israel and Iran in 2025, Iranian groups (MuddyWater, Charming Kitten, Nimbus Manticore) intensified targeting against EU lawmakers, financial executives, and aerospace/defense firms. Meanwhile, commercial spyware from PSOAs (Paragon Solutions’ Graphite, Pegasus, Predator, and Candiru) continued to be deployed via zero-click/zero-day exploits on WhatsApp and iMessage against European journalists, civil society activists, government officials, and even a senior European banking executive.

5. FIMI & Hacktivism: The Hybrid Megaphone

Drawing on the European External Action Service (EEAS) dataset of 540 Foreign Information Manipulation and Interference (FIMI) incidents alongside 4,709 hacktivist claims, ETL 2026 illustrates how technical disruption and narrative manipulation operate as a unified hybrid weapon.

• AI-Accelerated FIMI & “LLM Grooming”: AI-related TTPs in FIMI surged by 259% in 2025 (appearing in 27% of all EEAS-detected cases). While Russia (using Operation Overload, Storm-1516, and Doppelgänger) focused on “Distorting and Dividing” around European elections (targeting Germany, Poland, Romania, Czechia, and Moldova via a repeatable 3-phase playbook), China (via Spamouflage, Paperwall, and HaEnergy) focused on “Dismissing” criticism and executing Transnational Information Suppression (TIS). Remarkably, the Russian Portal Kombat (Pravda) network—pushing 10,000 articles a day across 101 domains—was observed conducting LLM grooming, flooding the web with multilingual propaganda specifically designed to poison the training data and web-search grounding of frontier AI models.
• Hacktivism-as-a-Service & The OT Mirage: Pro-Russia NoName057(16) accounted for nearly half (48.0%) of all hacktivist claims in the EU, trailed by pro-Palestine collectives Dark Storm Team (8.2%), Keymous+ (6.5%), and Mr Hamza (5.4%). While ENISA’s validation of NoName057(16)’s DDoSia botnet tasking revealed that only 23.8% of claimed attacks caused verifiable availability disruption, the primary goal remains media amplification and psychological pressure. Groups like Keymous+ and Mr Hamza have commercialized this into Hacktivism-as-a-Service (HaaS). Additionally, H2 2025 saw a sharp rise in hacktivist claims targeting Operational Technology (OT) in water and energy utilities (161 claims in Q3–Q4 by Z-Pentest Alliance and Infrastructure Destruction Squad), though verified physical disruption remained minimal.
• The Global Terabit DDoS Surge: Beyond ideological noise, raw DDoS capacity exploded in 2025. Globally, 47.1 million DDoS attacks were mitigated (more than double 2024), while the Aisuru and Aisuru-Kimwolf botnets unleashed record-shattering multi-vector floods peaking at 29.7 Tbps and 31.4 Tbps. Crucially for defenders, 89% of network-layer DDoS attacks ended in under 10 minutes, rendering manual mitigation workflows obsolete.

6. The Vulnerability Landscape: 48,000 CVEs and Shrinking Time-to-Exploit

In 2025, published vulnerabilities jumped 22% year-over-year to over 48,000 CVEs (39% rated Critical or High, and 71% exploitable remotely over a Network). To strengthen European resilience, ENISA expanded its mandate in November 2025 by becoming a Root CVE Numbering Authority (CNA) alongside maintaining the European Vulnerability Database (EUVD).

Across the 245 vulnerabilities added to the CISA Known Exploited Vulnerabilities (KEV) catalog during the reporting period, Microsoft (39), Apple (9), Cisco (8), Fortinet (8), Google (7), Ivanti (7), and Linux (7) led exploited vendor technologies. Three specific weakness classes dominated real-world exploitation:

1. CWE-78: OS Command Injection (20 CVEs in KEV)
2. CWE-22: Path Traversal (10 CVEs in KEV)
3. CWE-502: Deserialization of Untrusted Data (11 CVEs in KEV)

Edge appliances (VPNs, firewalls, load balancers) and enterprise file-transfer/collaboration suites (SharePoint, Oracle E-Business Suite CVE-2025-61882, SAP NetWeaver CVE-2025-31324, Cleo) remained the highest-priority targets for both zero-day extortionists (like Cl0p) and state-sponsored espionage teams.

7. The 2026 Frontier AI Inflection Point

Looking beyond the 2025 dataset into early 2026 developments, ENISA highlights a critical shift in how Artificial Intelligence shapes the threat landscape:

• From Productivity Aid to Runtime & Autonomous Execution: While 2025 was defined by threat actors using LLMs to write phishing lures, translate propaganda, and code RaaS panels (as seen with the Gentlemen ransomware group), early 2026 introduced malware invoking generative AI at runtime (such as the Android threat PromptSpy), LLM-generated exploits targeting React2Shell (CVE-2025-55182), and an AI-assisted cloud intrusion that achieved administrative takeover in just 8 minutes. Anthropic also documented a state-nexus group deploying an agentic AI system against international targets.
• AI as an Attack Surface & C2 Proxy: Researchers demonstrated “AI in the Middle” techniques—abusing legitimate web-based AI services as covert Command-and-Control (C2) proxies—alongside “LLMjacking” campaigns (Operation Bizarre Bazaar) that steal enterprise cloud LLM API keys for resale. Developer AI ecosystems are also under fire, evidenced by the delivery of the AMOS infostealer via compromised Cursor AI agent sessions, malicious AI browser extensions harvesting chat histories, and the April 2026 Vercel security incident linked to an infostealer infection at an AI vendor (Context.ai).

Strategic Recommendations for Defenders

To counter the convergence of cybercrime, state-nexus espionage, and AI-accelerated tradecraft detailed in ETL 2026, security leaders should prioritize five high-leverage controls:

1. Harden Authentication Against Token Theft & ClickFix: Enforce phishing-resistant MFA (FIDO2/WebAuthn passkeys) to neutralize AiTM kits like Tycoon 2FA. Restrict or disable Microsoft 365 device code authentication workflows unless strictly required, and use Group Policy or Endpoint Detection rules to block standard users from launching PowerShell, mshta, or command prompts via the Windows Run dialog (Win+R) to break the ClickFix kill chain.
2. Treat Edge Appliances & RMM Tools as Tier-0 Assets: With 70% of state-nexus intrusions and major ransomware waves relying on perimeter vulnerabilities (Fortinet, Ivanti, Cisco, SonicWall), organizations must establish sub-48-hour emergency patching SLAs for internet-facing appliances, monitor for anomalous configuration exfiltration, and enforce strict application allowlisting to prevent unauthorized RMM tools (ScreenConnect, NetSupport, AnyDesk, NetBird) from executing.
3. Defend the Endpoint Agent & Virtualization Layer: Mitigate RaaS defense-evasion tactics (EDRKillShifter, BYOVD) by enabling tamper protection on all EDR sensors, enforcing Microsoft’s Vulnerable Driver Blocklist (HVCI/Memory Integrity), and isolating hypervisor management interfaces (ESXi/vCenter) from domain-joined Active Directory credentials.
4. Enforce Supply Chain, Package Manager & Hiring Verification: Implement ENISA’s March 2026 Technical Advisory on Package Managers (pinning dependencies, scanning npm/PyPI commits, and restricting VS Code extension installations) to block developer-focused supply chain attacks. Pair technical controls with rigorous video/in-person identity verification and behavioral monitoring for remote IT hires to detect DPRK Famous Chollima infiltration.
5. Secure Enterprise AI Deployments: Inventory all internal and third-party AI integrations, browser extensions, and coding assistants. Apply strict least-privilege scoping to OAuth tokens and API keys granted to AI connectors, monitor egress traffic to cloud LLM endpoints for anomalous volume (LLMjacking or AI-in-the-Middle C2), and align governance with the EU Action Plan on Cybersecurity and AI and NIS2 Technical Implementation Guidance.