Editor’s Note: In an environment where digital borders no longer protect organizations, Europe finds itself at a crucial inflection point. As detailed in the ENISA Threat Landscape 2025 report, cybercriminals, state‑linked actors, and hacktivists are no longer operating in isolation. Instead, they collaborate, adopt each other’s tactics, and weaponize AI and supply chain vulnerabilities to bypass traditional defenses.
This article dissects that convergence, showing how ideological and financial motives now blur, complicating attribution and overwhelming static security models. For cybersecurity, information governance, and eDiscovery professionals, the message is clear: defending against these hybrid threats demands adaptive, intelligence‑driven strategies that prioritize behavioral insights over legacy adversary profiles.
Content Assessment: Europe Under Siege: How Cybercriminals and State Actors Are Rewriting Digital Threat Rules
Information - 92%
Insight - 92%
Relevance - 94%
Objectivity - 92%
Authority - 94%
93%
Excellent
A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Europe Under Siege: How Cybercriminals and State Actors Are Rewriting Digital Threat Rules."
Industry News – Cybersecurity Beat
Europe Under Siege: How Cybercriminals and State Actors Are Rewriting Digital Threat Rules
ComplexDiscovery Staff
In 2025, European organizations found themselves navigating an increasingly complex digital landscape, where traditional cybersecurity assumptions were eroded by waves of sophisticated attacks and converging threat groups. The European Union Agency for Cybersecurity (ENISA) latest Threat Landscape report reveals a troubling reality: the lines between cybercrime, state-sponsored espionage, and hacktivist operations have blurred beyond recognition, creating a perfect storm of digital threats that collectively erode organizational resilience.
The numbers paint a stark picture of European vulnerability. ENISA analysts documented 4,875 cyber incidents across the EU from July 2024 to June 2025, with hacktivist activities dominating the landscape at nearly 80% of all recorded incidents. Yet behind this flood of distributed denial-of-service attacks lies a more sophisticated threat ecosystem where artificial intelligence amplifies every attack vector, and ransomware operations have evolved into professional criminal enterprises that rival legitimate businesses in their organizational structure.
When Hacktivism Meets High-Stakes Espionage
The most alarming trend emerging from the 2025 threat landscape involves the convergence of previously distinct threat actor categories. State-aligned groups now leverage hacktivist personas through “faketivism” operations, while traditional hacktivist groups embrace ransomware to fund their ideological campaigns. This tactical blending creates attribution nightmares for security teams and multiplies the potential impact of each attack.
Russia-nexus threat groups exemplify this trend through operations such as the Cyber Army of Russia Reborn, where state-sponsored actors masquerade as independent hacktivist collectives. Meanwhile, pro-Russia hacktivist groups, such as CyberVolk, have adopted multiple ransomware strains, including LockBit and Chaos, demonstrating how quickly ideology-driven movements can pivot to monetization strategies.
Organizations can prepare for this convergence by implementing detection strategies that focus on behavior patterns rather than traditional threat actor profiles. Security teams should monitor for unusual combinations of tactics, techniques, and procedures (TTPs) that might indicate hybrid campaigns. Regular threat intelligence briefings should emphasize the fluid nature of modern threat groups rather than relying on static adversary profiles.
The AI Revolution in Cybercrime
Artificial intelligence has fundamentally transformed the threat landscape, with AI-supported phishing campaigns representing over 80% of observed social engineering activity worldwide by early 2025. This technological shift has democratized sophisticated attack techniques, allowing low-skill operators to launch campaigns that previously required extensive technical expertise.
The proliferation of Phishing-as-a-Service (PhaaS) platforms demonstrates this democratization in action. The Darcula platform alone impersonated more than 200 organizations while targeting victims across 100 countries. These automated systems generate branded phishing kits by cloning legitimate login pages, enabling attackers to emulate trusted brands with minimal effort.
More concerning is the emergence of standalone malicious AI systems, such as Xanthorox AI, which indicates that threat groups are moving beyond the misuse of simple AI tools toward custom-built platforms designed specifically for malicious purposes. This evolution suggests organizations will face increasingly sophisticated AI-powered attacks that can adapt and evolve in real-time.
To combat AI-enhanced threats, organizations should implement comprehensive user awareness training that specifically addresses indicators of AI-generated content. Email security solutions must incorporate AI detection capabilities, while incident response teams need training to recognize and respond to AI-enhanced attack campaigns.
Supply Chain Vulnerabilities Reach Critical Mass
The 2025 threat landscape reveals an unprecedented focus on supply chain compromise, with attackers increasingly targeting third-party providers to maximize their operational efficiency. The compromise of Plus Service in March 2025 exemplifies this trend, where a single external provider breach paralyzed Italian transport ticketing systems for two days, affecting thousands of commuters.
North Korean threat groups have particularly targeted supply chain attacks, with the DPRK-nexus Lazarus group deploying malicious Node Package Manager packages in GitHub repositories to compromise developer environments. These attacks demonstrate how modern software development practices create extensive attack surfaces that extend far beyond organizational boundaries.
Browser extension compromises surged in late 2024, with attackers specifically targeting extensions related to artificial intelligence and virtual private networks. This targeting pattern suggests threat actors understand that browser extensions often maintain elevated privileges while receiving less security scrutiny than traditional applications.
Organizations must expand their security perimeters to encompass all third-party dependencies and vendor relationships. Regular security assessments of suppliers should become standard practice, while development teams need specific training on secure coding practices and repository management. Browser extension policies should restrict installations to approved sources and require regular security reviews to ensure the integrity of the extensions.
Ransomware’s Professional Evolution
The ransomware ecosystem has undergone dramatic changes, shifting from a few dominant groups to a fragmented landscape of 82 different variants targeting EU organizations. This fragmentation actually increases risk by making it harder for security teams to predict attack patterns and develop targeted defenses.
The disruption of major ransomware operations, such as LockBit, which accounted for nearly a quarter of all claims in the previous reporting period, created opportunities for new groups to emerge. ENISA links LockBit’s reduced visibility to coordinated law-enforcement action and sanctions in late 2024 and reports the programme was compromised in May 2025, with no further claims after 27 May and a separate ‘LockBit4’ operator (‘Syrphid’) emerging. SafePay ransomware gained prominence in Q2 2025, while groups like Fog and Qilin employed aggressive pressure tactics, including countdown timers and fake legal escalation features, designed to exploit concerns related to EU regulatory compliance.
Perhaps most troubling is the integration of Endpoint Detection and Response (EDR) killing tools into standard ransomware operations. Tools like AvNeutralizer and EDRKillShifter allow attackers to disable security controls before deploying ransomware, significantly reducing detection chances.
Organizations should implement layered backup strategies that include offline and immutable storage options, while security teams need training on the latest EDR bypass techniques. Incident response plans must account for scenarios in which primary security tools have been compromised, necessitating the use of alternative detection and response capabilities.
Mobile Devices: The Forgotten Frontier
Mobile device targeting experienced a notable surge in 2025, with Android devices facing particular pressure from both cybercriminal and state-sponsored groups. The deployment of the Rafel RAT across EU member states, combined with state-linked telecommunications provider exploitation of outdated mobile signaling protocols, reveals significant vulnerabilities in mobile security architectures.
China Mobile International and China Telecom Global demonstrate how privileged access to international telecom infrastructure can enable remote monitoring and manipulation of mobile communications without requiring access to target devices. These “silent, infrastructure-level” operations pose particular risks to diplomats, journalists, and political actors who rely on mobile communications for sensitive activities.
The discovery of EagleMsgSpy, a legal intercept surveillance program targeting Android devices and reportedly used by Chinese Public Security Bureaus since 2017, highlights how state-sponsored mobile surveillance has become institutionalized.
Organizations must implement comprehensive mobile device management policies that prioritize device updates and security patch deployment. Regular security assessments should evaluate mobile communication channels, while high-risk personnel need specialized training on mobile security best practices and secure communication alternatives.
The Critical Infrastructure Crossroads
European critical infrastructure faces mounting pressure from multiple threat vectors simultaneously. Public administration remains the most targeted sector, accounting for 38% of all incidents, followed by transport at 7.5% and digital infrastructure at 4.8%. Note: ENISA calculates these sector shares after excluding incidents recorded as ‘unknown.’ This targeting pattern aligns closely with sectors identified under the NIS2 Directive, confirming the relevance of regulatory frameworks while highlighting the scale of the challenge.
Hacktivist groups have demonstrated both intent and capability to target operational technology systems, with groups like Z-PENTEST-ALLIANCE claiming attacks against Internet-accessible OT management interfaces in the energy and water management sectors. ENISA reports limited verification and minimal operational impact; the videos chiefly serve a psychological effect. While these attacks reportedly caused minimal operational impact, the psychological effect of publishing videos showing tampering with critical systems creates broader concerns about infrastructure vulnerability.
The emergence of the Infrastructure Destruction Squad and their VoltRuptor ICS-specific malware represents a concerning escalation in OT-targeted threats. This specialized malware reportedly offers advanced multi-protocol support and anti-forensics capabilities designed specifically for industrial control systems.
Critical infrastructure operators must implement robust network segmentation that isolates OT systems from corporate networks and internet access. Regular security assessments should specifically evaluate OT vulnerabilities, while incident response plans need specialized procedures for managing attacks on industrial control systems.
Building Resilience in an Uncertain Landscape
The convergent nature of modern cyber threats demands a fundamental shift in organizational cybersecurity approaches. Traditional models that rely on distinct threat categorization and static defense strategies prove inadequate against adversaries who fluidly adapt their tactics and collaborate across traditional boundaries.
Organizations should implement intelligence-driven security architectures that prioritize behavioral detection over signature-based approaches. This requirement entails investing in security operations center capabilities that can identify anomalous activity patterns, regardless of the underlying threat actor’s motivation or affiliation.
Cross-sector information sharing becomes essential as threats increasingly target supply chain dependencies that span multiple industries. Organizations should participate in sector-specific threat intelligence sharing initiatives while developing internal capabilities to analyze and act on threat intelligence data.
The regulatory landscape offers both challenges and opportunities for improving collective defense. The Cyber Resilience Act introduces mandatory security requirements for digital products, while the Cyber Solidarity Act strengthens cross-border incident response mechanisms. Organizations should view compliance not as a burden but as an opportunity to align with broader defensive strategies.
How will your organization adapt its cybersecurity strategy to address threats that no longer respect traditional boundaries between crime, espionage, and activism?
News Sources
- EU consistently targeted by diverse yet convergent threat groups (ENISA)
- ENISA Threat Landscape 2025 (ENISA)
Assisted by GAI and LLM Technologies
Additional Reading
- When Boardrooms Feel the Tremor Before Defense Ministries: Phase Zero and the New Enterprise Perimeter
- European Drone Incidents Expose Critical Gaps in Enterprise Security and Hybrid Defense
- Microsoft Disables Cloud Services for Israeli Intel Unit Citing Surveillance Misuse
- EU Agrees on GDPR Cross-Border Enforcement Reform: New Procedural Rules to Streamline Investigations
- When Legal Privilege Isn’t Enough: Cyber Threats Escalate in the Legal Industry
Source: ComplexDiscovery OÜ
