Security Report · raw.githubusercontent.com

ENISA Threat Landscape 2026: DDoS Dominates Recorded EU Cyber Incidents

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

ENISA's Threat Landscape 2026 analyses 8,257 incidents recorded in 2025. DDoS accounted for 51.3% of activity, while public administration was the most affected sector. Ransomware and third-party compromises continued to disrupt operations.

Key points

ENISA analysed 8,257 incidents recorded during calendar year 2025, primarily using open sources and anonymised partner information. The period overlaps the previous report by six months, and reporting visibility limits conclusions about activity levels.
DDoS accounted for 51.3% of recorded activity and unauthorised access for 39.5%. Phishing represented 77.8% of identified social-engineering techniques, alongside increased use of ClickFix and phishing services.
An intrusion vector was identified for only 5.2% of unauthorised-access incidents; vulnerability exploitation accounted for 60.4% of that subset, while misconfiguration and accidental exposure accounted for 20.7%.
Public administration accounted for 31.8% of recorded events, followed by business services, transport, manufacturing and finance/banking. NIS2 Member State reporting also placed health and digital infrastructure among the five most affected sectors.
Ransomware represented 47.3% of recorded financially motivated activity. Manufacturing accounted for the largest share of ransomware claims; prominent operators included Qilin, SafePay, Akira, INC Ransom and Hunters International.
Compromises of suppliers, shared SaaS platforms, CRM environments and cloud services created downstream exposure. The Collins Aerospace passenger-processing incident disrupted automated airport check-in and forced manual procedures.
Only 23.8% of assessed NoName057(16) claims were validated through independent availability checks. ENISA cautioned that unverified disruption claims could inflate perceptions of operational impact.

Article Details

Publisher: ENISA
Report Period: 2025-01-01/2025-12-31
Scope: Cyber threats affecting EU Member States and EU-based organisations, including cybercrime, State-nexus activity, hacktivism, FIMI and vulnerabilities.
Sample Size: 8,257 incidents collected primarily from open sources and anonymised voluntary contributions; reporting coverage is incomplete and some claims are unverified.
Key Statistics: DDoS represented 51.3% and unauthorised access 39.5% of recorded incidents in 2025.
An intrusion vector was identified for only 5.2% of unauthorised-access incidents; vulnerability exploitation accounted for 60.4% of that subset.
The five most targeted sectors were public administration (31.8%), business services (8.5%), transport (8%), manufacturing (6.9%) and finance/banking (5.6%).
Ransomware accounted for 47.3%, data breaches for 36%, and fraud and impersonation for 13.3% of recorded financially motivated claims in 2025.
For NoName057(16) activity assessed between July and November 2025, only 23.8% of claims were validated through independent third-party availability checks.
Recommendations: Registries and registrars should detect and mitigate domain-registration abuse supporting phishing and other cybercrime.
Counter FIMI through disruption, cost imposition and limitation of operators' operational space.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`breachforums[.]bf`	BreachForums ecosystem domain identified as a source of compromised-data claims.
DOMAIN	`breachforums[.]st`	BreachForums ecosystem domain used to advertise, leak or trade compromised data.
DOMAIN	`darkforums[.]st`	Cybercriminal marketplace used to advertise, leak or trade compromised data; accounted for 58% of data-breach claim sources observed by ENISA.
DOMAIN	`leakbase[.]la`	Underground platform identified as a source of claims advertising compromised data.
DOMAIN	`xss[.]is`	Underground platform identified as a source of claims advertising compromised data.