Behind the ENISA 2025 Threat Landscape: How Low-Level DDoS Masks a Converging Ransomware Crisis

Security leaders frequently debate whether the primary cyber threat facing modern infrastructure is the sheer volume of automated attacks or the quiet sophistication of targeted intrusions. Proponents of the volume theory point to overwhelming denial-of-service traffic that exhausts defensive resources.[2]

Conversely, those focused on sophistication argue that noisy traffic is merely a distraction from the stealthy deployment of ransomware and espionage frameworks. The European Union Agency for Cybersecurity has published its 2025 Threat Landscape report, providing empirical data that validates both perspectives.[1]

The agency analyzed 4,875 curated incidents recorded between July 2024 and June 2025 across the European Union. This dataset reveals a maturing threat environment characterized by the rapid weaponization of vulnerabilities and an increasingly complex web of adversary behaviors.[1]

While the absolute number of attacks remains high, the data demonstrates a clear bifurcation in impact. The landscape is shifting toward mixed, convergent pressure, where continuous, diversified campaigns collectively erode organizational resilience rather than relying on single, catastrophic breaches.[1]

The Illusion of Volume

Distributed denial-of-service attacks dominate the raw incident metrics, accounting for 76.7 percent of all recorded cases. Hacktivist groups drive the overwhelming majority of this traffic, utilizing low-cost tools to execute ideology-driven operations that generate significant visibility.[1]

These hacktivist campaigns primarily target the public administration sector, which absorbed 38.2 percent of all curated incidents. Regional and central government entities, including diplomatic missions and defense bodies, face continuous barrages from groups like NoName057(16) and Dark Storm.[1]

Despite the massive volume, these denial-of-service events generally result in very low operational impact. They function primarily as symbolic tactics for protest and information manipulation, often timed to coincide with electoral processes or geopolitical developments in member states.[1]

The sheer scale of this hacktivist activity mathematically obscures the more severe threats operating beneath the surface. When nuisance traffic is separated from the dataset, a starkly different picture of the European threat environment emerges, defined by targeted extortion and espionage.[2]

Defacements, another highly visible but low-impact tactic, are almost exclusively associated with these same hacktivist collectives. Like denial-of-service traffic, defacements serve as a mechanism for public messaging rather than a sustained intrusion method or a pathway to data exfiltration.[1]

The Mechanics of Intrusion

Actual network intrusions represent 17.8 percent of the recorded incidents, driven predominantly by financially motivated cybercriminal operations. Unlike noisy hacktivist campaigns, these intrusions rely heavily on social engineering, with phishing remaining the dominant initial access vector.[1]

Phishing, including malspam and malicious advertising, accounts for roughly 60 percent of observed intrusion pathways. Threat actors continuously refine these techniques, moving away from simple deceptive emails toward complex, multi-stage campaigns designed to bypass modern endpoint protections.[1]

The ClickFix technique gained significant momentum in early 2025, utilized by both cybercriminal and state-aligned groups. Attackers disguise malicious payloads as fake verification prompts on compromised websites, tricking users into executing commands that install information stealers.[1]

The industrialization of these attacks is facilitated by Phishing-as-a-Service platforms, which allow low-skill operators to launch sophisticated campaigns. Platforms like Darcula and Lucid automate the generation of branded phishing kits, distributing malicious links through templated infrastructure and mobile messaging services.[1]

Vulnerability exploitation serves as the second most prevalent intrusion vector, accounting for 21.3 percent of initial access events. The data indicates that adversaries rapidly weaponize newly disclosed vulnerabilities, often integrating them into widespread campaigns within days of their public release.[1]

The Ransomware Ecosystem

Cybercrime accounts for 13.4 percent of all incidents, but it remains the most directly impactful threat to European organizations. Within this category, encrypting ransomware constitutes 81.1 percent of claimed activities, frequently resulting in severe operational disruptions and data breaches.[1]

The ransomware ecosystem experienced significant fragmentation following law enforcement operations against major groups like LockBit and BlackBasta. This disruption led to a more evenly distributed market, with 82 distinct ransomware variants deployed against European targets during the reporting period.[1]

Akira emerged as the most frequently deployed variant at 11.6 percent, followed closely by SafePay and Qilin. These groups have adopted aggressive extortion tactics, capitalizing on regulatory compliance fears and the threat of reputational damage to force ransom payments.[1]

The manufacturing sector absorbed the highest share of these ransomware claims at 14.9 percent. High-profile incidents in late 2024, including attacks on the German electronics maker Medion AG and the Arntz Optibelt Group, resulted in prolonged IT and operational disruptions.[1]

Threat actors are increasingly deploying specialized tools to disable endpoint detection and response solutions. In mid-2025, variants of EDRKillShifter were incorporated into multiple ransomware toolsets, enabling attackers to conduct stealthier intrusions focused on rapid data exfiltration before encryption.[1]

The Information Stealer Economy

Information stealers remain a foundational element of the cybercriminal supply chain, facilitating credential theft and access brokering. The market saw significant shifts following the October 2024 takedown of the RedLine and META stealer families during Operation Magnus.[1]

This law enforcement action drove a massive migration to the Lumma stealer, which saw its usage increase by more than 350 percent. Between March and May 2025, Lumma was reportedly deployed on 394,000 machines globally, with a strong prevalence across Europe.[1]

Initial access brokers monetize these stolen credentials, shifting toward a high-volume, lower-cost economic model. The majority of network accesses are now priced under 2,800 euros, lowering the barrier to entry for ransomware affiliates and other malicious operators.[1]

Data breaches resulting from these compromises primarily impacted digital infrastructure and services, accounting for 27.7 percent of leaked datasets. Notable incidents included the compromise of contact details for over 62,000 Dutch police staff and the exposure of telecommunications customer data.[1]

The monetization of stolen data increasingly extends into the physical realm, with rising reports of physical targeting and kidnapping of cryptocurrency holders. These violent incidents, documented in Belgium, France, and Spain, are directly linked to data leaks from centralized exchanges.[1]

Targeting the Supply Chain

Adversaries are aggressively targeting third-party dependencies to optimize the efficiency and scale of their attacks. Digital infrastructure and services emerged as the third most targeted sector overall, reflecting the strategic value of compromising service providers to reach downstream clients.[1]

The compromise of the Telemaco platform in March 2025 exemplifies this systemic risk. Unauthorized access to the external provider paralyzed ticketing systems for multiple Italian transport companies, including ATM Milano, impacting thousands of daily commuters for several days.[1]

Software repositories and development environments face continuous exposure to supply chain attacks. State-aligned groups, particularly the North Korean-nexus Lazarus, increasingly deploy malicious packages in open-source repositories, mimicking legitimate libraries to compromise developers' workstations and steal proprietary code.[1]

A surge in attacks leveraging malicious browser extensions was observed in late 2024. Campaigns compromised multiple corporate extensions, specifically targeting tools related to artificial intelligence and virtual private networks, to silently harvest session tokens and sensitive corporate data.[1]

Telecommunications infrastructure remains a prime target for highly advanced espionage campaigns. China-nexus intrusion sets, such as Salt Typhoon, concentrate on these networks to maintain long-term visibility over European trade corridors and secure strategic intelligence.[1]

The Mobile Attack Surface

Mobile devices represent the largest share of specific threat categories at 42.4 percent, underscoring their role as a primary attack surface. Android devices face a particularly high level of threat from both financially motivated cybercriminals and state-aligned espionage groups.[1]

The Rafel remote access trojan saw increased deployment against outdated devices in Czechia, France, Germany, and Italy. Simultaneously, the Medusa banking trojan re-emerged with updated features focused on on-device fraud and automated account takeover mechanisms.[1]

State-aligned actors increasingly utilize commercial and custom Android spyware for surveillance. Reports documented the use of tools like KoSpy and EagleMsgSpy, the latter being a legal intercept program allegedly used by Chinese public security bureaus since 2017.[1]

Beyond endpoint malware, fundamental flaws in mobile signaling protocols continue to be exploited. A 2025 technical report revealed that state-linked telecommunications providers abuse vulnerabilities in SS7 and Diameter protocols to remotely monitor communications without requiring direct device access.[1]

These infrastructure-level operations are silent and exceedingly difficult to detect. Operators with privileged access to international telecom routing can intercept messages, track locations, and hijack sessions across borders, posing severe risks to diplomats and political figures.[1]

Impacts on Finance and Transport

The finance sector absorbed 4.7 percent of all curated incidents, with banking institutions bearing the brunt of the attacks. Hacktivist groups directed 69 percent of their financial sector operations against banks, attempting to disrupt online services and generate public frustration.[1]

Beyond nuisance traffic, financial institutions remain high-value targets for data theft. Data breaches accounted for 64 percent of cybercrime incidents in this sector, as attackers successfully exfiltrated sensitive personal and banking details to sell on dark web marketplaces.[1]

The transport sector experienced 7.5 percent of total incidents, with a heavy concentration on aviation and logistics networks. Hacktivist denial-of-service campaigns frequently targeted these entities in response to national security agreements or geopolitical developments involving European member states.[1]

Ransomware attacks against transport infrastructure proved highly disruptive, even when representing a small share of total events. An intrusion utilizing the Akira ransomware at Croatia's Split Airport paralyzed passenger reception systems, forcing a temporary suspension of all commercial flights.[1]

State-Aligned Cyberespionage

Cyberespionage campaigns account for 7.2 percent of the assessed objectives, driven by state-aligned threat groups executing long-term intelligence gathering. These operations demonstrate advanced tradecraft, including stealthy malware frameworks, supply chain compromises, and the abuse of signed drivers.[1]

Russia-nexus groups, including APT28 and APT29, display the broadest sectoral spread, targeting diplomatic entities, ministries, and political parties. Their operations frequently align with Moscow's broader strategy to monitor and disrupt the critical infrastructure of NATO allies.[1]

China-nexus intrusion sets, such as Mustang Panda and APT31, maintain a clear focus on government entities and maritime logistics. This activity supports Beijing's strategic interest in securing supply chains tied to the Belt and Road Initiative and monitoring European trade.[1]

The transport sector, particularly aviation and freight, emerged as a high-value target for these state-aligned campaigns. While representing only 4.1 percent of state-nexus activity, the targeting of logistics networks provides adversaries with critical visibility into European supply chain resilience.[1]

A newcomer to the European landscape, the Sidewinder group, demonstrated a highly specific focus on diplomatic entities within public administrations. This targeted approach highlights the continuous evolution of state-sponsored actors seeking specialized intelligence regarding European policy and foreign relations.[1]

Artificial Intelligence Realities

Artificial intelligence has become a defining element of the threat landscape, though its application remains largely predictable. Rather than achieving autonomous breakthrough capabilities, adversaries primarily leverage commercial and jailbroken language models to augment and accelerate existing social engineering operations.[1]

By early 2025, AI-supported phishing campaigns reportedly represented more than 80 percent of observed social engineering activity worldwide. Threat actors utilize these models to craft highly convincing, localized lures that evade traditional linguistic analysis and spam filters.[1]

The emergence of standalone malicious AI systems, such as Xanthorox AI, indicates a shift toward customized tools running on local servers. This approach allows cybercriminal groups to avoid the detection mechanisms and usage restrictions built into commercial generative models.[1]

Generative AI also serves as a highly effective lure for malware distribution. Fraudulent websites impersonating legitimate tools like Kling AI, Luma AI, and DeepSeek-R1 proliferated throughout the reporting period, tricking users into downloading information stealers and ransomware payloads.[1]

The AI supply chain itself is increasingly targeted through poisoned machine learning models and trojanized Python packages. Vulnerabilities in AI coding assistants, such as the Rules File Backdoor, enable attackers to inject malicious instructions directly into enterprise development environments.[1]

The Convergence of Threats

The traditional boundaries separating hacktivism, cybercrime, and state-nexus activity continued to blur throughout the year. Intrusion sets historically distinguished by their operational sophistication now frequently share toolsets, infrastructure, and tactical procedures, complicating attribution efforts.[1]

State-aligned groups increasingly leverage hacktivist personas to conduct false-flag operations. The Cyber Army of Russia Reborn, associated with the Russia-nexus Sandworm group, utilizes this faketivism tactic to associate disruptive network attacks with broader information manipulation campaigns.[1]

Conversely, hacktivist collectives are embracing ransomware to fund their operations and increase their visibility. Groups like FunkSec and CyberVolk have deployed strains such as FunkLocker and HexaLocker, blending political messaging with financial extortion to maximize their impact.[1]

State-nexus actors are also adopting cybercriminal tradecraft, utilizing commodity information stealers and commercial proxy networks to obscure their origins. Groups like the North Korean-nexus Andariel have been linked to ransomware activity, likely operating as affiliates or initial access brokers.[1]

This convergence indicates a fundamental shift in the European cyber threat environment. Organizations no longer face distinct, easily categorized adversaries, but rather a fluid ecosystem where advanced espionage techniques and commoditized cybercrime tools are deployed interchangeably.[2]

The data confirms that resilience requires defending against this entire spectrum simultaneously. While high-volume nuisance traffic demands robust network filtering, the quiet exploitation of third-party dependencies and mobile protocols requires deep, continuous visibility into the digital supply chain.[2]