ENISA Threat Landscape 2025, explained

ENISA Threat Landscape 2025, published by the European Union Agency for Cybersecurity (ENISA) on 1 October 2025, is the agency's annual, threat-centric assessment of the cybersecurity threats and trends shaping the EU. Section 1 (Executive Summary) describes this edition as introducing "a revised and concise format designed to deliver insights through a threat-centric approach and enhanced contextualisation," covering the EU's cyber threat ecosystem "from July 2024 to June 2025, drawing on nearly 4 900 selected and curated incidents." The publication is licensed under CC BY 4.0, authored by an ENISA team (Jamila Bouteemeur, Ifigeneia Lella, Ilias Bakatsis, Georgios Chatzichristos, Kevin Foley, Jussi Leskinen, Jakub Otcenasek, Dominik Ziolek, with EEAS STRATCOM), and carries ISBN 978-92-9204-723-8 / DOI 10.2824/1946374.

Methodology and its stated limits

Section 2 states ENISA analysts "collected and analysed 4 875 incidents, mainly based on information from open sources, as well as anonymised information shared by EU Member States... and members of the ENISA Cyber Partnership Programme," over the reporting period 1 July 2024 to 30 June 2025 (cut-off 30 June 2025). The report is candid about the dataset's limitations: open-source and voluntarily shared information "do not constitute a complete picture," reporting depth and timeliness vary by threat type (ransomware and DDoS claims surface quickly; cyberespionage campaigns are typically documented 6 months to over 4 years later), and sectoral categorisation is imperfect when one incident spans multiple sectors — ENISA states it curated the dataset deliberately "to avoid inflating the threat." The PDF currently published at ENISA's site is labelled version 1.3 (September 2026), and the report's own Log History table (Section 13) records reference-list edits in December 2025 and January 2026 and editorial changes in August 2026 — a reminder to confirm which point release of a living report a given figure comes from.

Threat landscape overview: intrusion vectors and incident types

Section 3 breaks down the dataset by intrusion vector: social engineering (phishing, vishing, malspam, malvertising) accounted for about 60% of observed cases, exploitation of vulnerabilities for 21.3%, botnets for 9.9%, malicious applications for 8%, and unauthorised insider access for 0.8%. The report draws a contrast in outcome: roughly 73% of phishing cases are classified "unknown" in follow-up, with 27% leading to confirmed intrusions, whereas nearly 70% of vulnerability-exploitation cases culminate in intrusions (68% of which deploy malicious code) — vulnerabilities are a narrower but more consistently damaging vector than phishing.

By incident type, DDoS dominated at about 76.7% of recorded cases (cited elsewhere as affecting 81.4% of EU sectors), "overwhelmingly driven by hacktivist groups." Among confirmed intrusions, ransomware, banking trojans and infostealers together made up 87.3% of deployed malicious code, and 68.6% of intrusions led to data breaches advertised on cybercriminal forums (2.8% explicitly tied to a ransomware attack). By threat category, mobile threats were the largest share at 42.4%, followed by web threats (27.3%), operational technology threats (18.2%), and supply chain risks (10.6%).

Sectoral analysis

Section 5 states that once the 28.5% of incidents not tied to a specific sector are excluded, the top five targeted EU sectors were: public administration (38.2%), transport (7.5%), digital infrastructure and services (4.8%), finance (4.5%), and manufacturing (2.9%) — essential entities under the NIS2 Directive represented 53.7% of all recorded incidents, which the report reads as confirming NIS2's sectoral scope. Public administration incidents were "largely impacted by hacktivist-led DDoS (96.2%)," with France (27%), Italy (26.3%) and Germany (16.2%) the most-affected Member States for that sector.

Cybercrime: ransomware fragmentation and infostealer disruption

Section 6 reports cybercrime at 13.4% of all incidents, with ransomware (81.1%) and data breaches (15.2%, largely resulting from ransomware) the dominant activity types. ENISA counted 82 distinct ransomware variants deployed against EU organisations — a fragmenting ecosystem rather than a few dominant brands: Akira led at 11.6% of deployments, followed by SafePay (10.1%) and Qilin (7.5%), a marked shift from the prior ETL 2024 edition where LockBit3 alone accounted for nearly a quarter of claims (198). The report ties this fragmentation directly to law-enforcement disruption: LockBit's internal database was reportedly leaked in May 2025 (ending its claims from 27 May 2025), 8Base saw partial infrastructure leaks and administrator arrests in early 2025, and BlackBasta's internal chats leaked in February 2025, taking its infrastructure offline. On the infostealer side, Operation Magnus (October 2024) dismantled RedLine and META, which the report says drove a "more than 350%" increase in Lumma infostealer use between the first and second halves of 2024 before a May 2025 Europol/Microsoft action seized roughly 1,300 malicious domains tied to Lumma's infrastructure.

State-aligned activity and hacktivism

Section 7 identifies 46 distinct state-aligned intrusion sets active in the EU over the reporting period, with Russia-nexus sets (led by APT29, APT28, Sandworm) reportedly the most active, followed by China-nexus (UNC5221/Volt Typhoon, Mustang Panda, APT41, Flax Typhoon, Salt Typhoon) and DPRK-nexus sets — together accounting for 7.2% of all recorded incidents. Roughly 14.2% of state-aligned activity could not be imputed to a known intrusion set, a gap ENISA attributes partly to TTP shifts and the use of front companies, contractors and "digital quartermasters." Section 4.4 flags a broader trend of threat-group convergence: state-nexus sets leveraging commodity ransomware and commercial residential-proxy infrastructure (APT29, Sandworm), and cybercriminal groups adopting state-nexus social-engineering tradecraft (FIN6 using fabricated LinkedIn personas, echoing DPRK's playbook).

Section 1 states hacktivist activity "continu[ed] to dominate reporting, representing almost 80% of recorded incidents and driven primarily by low-level distributed denial-of-service operations," while resulting in "very low impact" overall. Section 5.1 names NoName057(16) (66.7%), Dark Storm (20%), and Keymous+ (13.3%) as the most active hacktivist intrusion sets targeting EU public administration specifically, operating partly through alliances such as "7 October Union" and "Holy League."

Exploited vulnerabilities and AI-enabled activity

Section 10.2 reports that, per CISA's Known Exploited Vulnerabilities (KEV) catalogue, 245 vulnerabilities were added during the reporting period, with the top three associated CWE categories being CWE-78 (OS Command Injection), CWE-22 (Path Traversal), and CWE-416 (Use After Free) — weaknesses the report notes can enable code execution, full system takeover, or denial of service. From an EU-specific vantage point, ENISA's own open-source collection found at least 115 exploited vulnerabilities affecting EU Member State organisations, with MITRE ATT&CK-mapped analysis showing attackers "consistently exploit Internet-facing applications" (T1190) — naming Confluence, Exchange (ProxyLogon/ProxyShell), Citrix NetScaler, Fortinet/Check Point/Palo Alto VPN appliances, PaperCut, TeamCity, ActiveMQ, vCenter and Zimbra as the dominant exploited products, "typical of mass-exploitation waves where perimeter services are scanned and compromised within hours of disclosure."

Section 4.5 covers AI's role as both tool and lure: state-nexus groups (China-, Iran- and DPRK-nexus) reported using commercial LLMs — Google's Gemini and OpenAI's ChatGPT — "primarily as research assistants for boosting productivity as well as for reconnaissance and anomaly detection evasion," alongside jailbroken or retrained models such as WormGPT, EscapeGPT and FraudGPT to automate social engineering and malware development. Separately, the report documents fraudulent sites impersonating legitimate AI tools (Kling AI, Luma AI, Canva Dream Lab, DeepSeek-R1) used to deliver malware, and a supply-chain attack vector dubbed "Rules File Backdoor" that injects malicious instructions into configuration files used by AI coding assistants like Cursor and GitHub Copilot.

Recommendations (Section 10.3–10.8)

ENISA ties its mitigation guidance directly to the MITRE ATT&CK techniques and mitigations observed in the dataset, organized into five groups: system hardening (execution prevention, OS/software/Active Directory configuration, registry and library-loading restrictions, code signing); access and privilege (least-privilege account management, password policies, multi-factor authentication); network protections (intrusion prevention, traffic filtering, network segmentation, restricting web-based content); monitoring (audit logging, secure application-development guidance); and resilience (data backup and remote storage, data loss prevention, encryption, timely patching, user training). The report states these "form the baseline of cyber hygiene," scaled up from loader-stage containment through ransomware-specific backup/segmentation measures to RAT-specific long-term persistence controls.

A workable starting point

1. Read incident-share percentages against the methodology caveats, not as a precise census. ENISA is explicit that open-source reporting under- and over-represents certain threat types (fast-surfacing DDoS/ransomware vs. slow-surfacing cyberespionage) — use the figures for relative trend direction, not as exact ground truth.
2. Treat DDoS/hacktivism volume and cybercrime impact as separate axes. Hacktivist DDoS drove nearly 80% of recorded incident volume but the report itself calls the resulting impact "very low" — a device or firmware maker's risk model should weight ransomware/infostealer-driven cybercrime (13.4% of incidents, 87.3% of deployed malicious code in confirmed intrusions) more heavily than incident count alone suggests.
3. Prioritize patching Internet-facing perimeter software first. T1190 exploitation of named products (VPN gateways, Exchange, Confluence, file-transfer and collaboration tools) is explicitly called out as the dominant, fastest-exploited vector — this maps directly to CISA KEV-listed CVEs in the same product categories.
4. Expect AI to show up as both attacker tool and attacker lure. Budget for both angles: threat actors using commercial/jailbroken LLMs to scale social engineering, and fake "AI tool" installers used as malware delivery — not just one or the other.
5. Re-check figures against the live PDF before quoting them externally. This is a versioned, periodically-corrected document (v1.3 as of September 2026, per ENISA's own Log History) — confirm you're citing the current revision.

SoftWSP's firmware and device security work uses the same CISA KEV and exploited-vulnerability data ENISA draws on to flag which Internet-facing and embedded components in a product are exposed to the mass-exploitation patterns this report documents: see Device & Firmware Security.

This guide summarises ENISA Threat Landscape 2025 (published October 2025, PDF version 1.3 of September 2026) and the CISA KEV catalogue page it cites; it is not a substitute for the full text and does not constitute compliance, legal or threat-intelligence advice.