The EU Agency for Cybersecurity has published its annual threat report. The ENISA Threat Landscape 2026 analyzes 8,257 security incidents affecting organizations across the EU in 2025. The report’s main finding is that: DDoS attacks remain the most common type of incident. At the same time, it is becoming increasingly difficult to distinguish between cybercriminals, hacktivists, and state-backed groups.
We have reviewed the report for you. Here are the findings that matter most for your security strategy.
Below are key figures from the ENISA Threat Landscape 2026. For the first time, ENISA covers a full calendar year. The data comes mainly from open sources and anonymized reports shared by EU member states. The picture is clear:
- 51.3% of all recorded incidents were DDoS attacks.
- 39.5% involved unauthorized access to systems.
- 57.3% of activity was ideologically motivated and 29.8% was financially motivated.
- Public administration was the most affected sector at 31.8%.
- 72.9% of the incidents affected essential entities–organizations that matter most to the state and society.
Following public administration were business services (8.5%), transport (8%), manufacturing (6.9%), and finance (5.6%). ENISA draws an important distinction here. Financially motivated attacks, such as ransomware, are less frequent but cause the most damage in the short term. Cyberespionage is a long-term strategic risk.
DDoS remains the dominant threat in Europe
Hacktivists are responsible for most DDoS activity. ENISA recorded 4,709 claims of hacktivist attacks against EU member states, more than 89% of which were DDoS attacks. Nearly half of these attacks came from a single pro-Russian group, NoName057(16).
Germany was the most targeted country with 16% of all claims, followed by France, Italy, Spain, and Poland. Campaigns track the political calendar. Elections, aid packages for Ukraine, and summits regularly trigger new waves of attacks.
One detail stands out: In July 2025, law enforcement dismantled a significant portion of NoName057(16)’s infrastructure in Europol’s Operation Eastwood. Shortly afterwards, hacktivist activity reached its yearly peak. These networks are clearly resilient.
Learn how the new Network DDoS Protection protects you even more effectively
Faster mitigation, IPv6 parity, greater transparency, and significantly less manual effort.
Noisy but not harmless
ENISA rates many hacktivist DDoS attacks as having a low impact. Of the success claims that ENISA examined, only 23.8% could be confirmed by independent availability checks. Some of these attacks appear to serve propaganda more than disruption.
However, it would be a mistake to dismiss DDoS as background noise. The report highlights three developments that deserve your attention.
1) Attacks are getting bigger. According to the report, 47.1 million DDoS attacks were mitigated worldwide in 2025. This figure is more than double that of the previous year. The largest recorded attack peaked at 31.4 Tbps and lasted only 35 seconds.
Second, attacks are getting shorter. In the third quarter, 71% of HTTP attacks and 89% of network-layer attacks ended in under ten minutes. If your defense depends on a manual response, it will arrive too late.
Attacks are becoming more precise. Application-layer (Layer 7) DDoS attacks increased by 128%. They don’t require high traffic volumes to take down APIs, login flows, or payment services.
Additionally, DDoS attacks have become commonplace. Booter and stresser services sell attacks on subscription. Groups without their own infrastructure can now launch large-scale campaigns.
For businesses, this means protection must be automated and continuous. Link11 Network DDoS Protection detects and filters attacks in real time with no action required from your team. It blocks known attack vectors instantly and new ones within three seconds.
Vulnerabilities and supply chains open the door
ENISA found an exploited vulnerability in 60.4% of unauthorized access incidents where the entry point could be identified. Misconfigurations followed at 20.7%.
In 2025, more than 48,000 new vulnerabilities were published, marking a 22% increase. Of these, 71% can be exploited remotely via the network. The two most common types of weakness are cross-site scripting and SQL injection. This is precisely the area in which modern Web Application & API Protection (WAAP) comes in. WAAP combines a web application firewall with API security, bot management, and application-layer DDoS protection.
The supply chain remains a critical weak spot. Attackers compromise software packages, browser extensions, and third-party service providers deliberately. A single successful breach at a supplier can affect many organizations simultaneously. ENISA’s European Vulnerability Database (EUVD) is a central source of current vulnerability information.
One often-overlooked area is DNS. The report documents attacks on DNS root servers, as well as criminals hijacking reputable subdomains through abandoned DNS records. The number of phishing domains increased by 38%.
When attackers share the same toolbox
One of the report’s most important observations is that cybercriminals, hacktivists, and state actors have different goals but increasingly rely on the same methods, tools, and entry points. For example, a North Korean group deployed Qilin ransomware, a tool originating from the criminal ecosystem.
For defenders, the upside is clear. Addressing shared vulnerabilities can protect against multiple threats simultaneously.
Social engineering is evolving as well. Phishing dominates at 77.8%. A newer technique called ClickFix tricks victims into “fixing” a supposed technical problem themselves, thereby executing malicious code. State-backed groups have also used messaging apps, such as Signal and WhatsApp, to lure targets through legitimate sign-in processes.
Germany is a prime target here as well. Twenty-six and a half percent of all ransomware extortion claims in the EU were aimed at German organizations, which is more than any other country.
AI speeds up every stage of an attack
Artificial intelligence has arrived in the attacker’s toolkit. According to ENISA, most groups currently use AI to enhance their existing skills. They can write more convincing phishing emails, develop malware faster, and automate reconnaissance.
The report illustrates how much time this can save attackers. In one AI-assisted intrusion into a cloud environment, for example, attackers gained administrator access within eight minutes. ENISA expects that, by 2026, AI will directly support even more stages of an attack.
The conclusion is simple. When attacks unfold in minutes, defense must respond in seconds.
Key takeaways from the ENISA Threat Landscape 2026 for IT leaders
The report contains few surprises, but it provides clear confirmation. There are four points that should be on your agenda now.
Availability poses a business risk. Attacks often last only minutes. Your DDoS protection should be automatic and active at all times, not just on demand.
Applications and APIs require dedicated protection. The sharp rise in Layer 7 attacks and the prevalence of traditional web vulnerabilities demonstrate that network protection alone is insufficient.
Dependencies increase the attack surface. Review your service providers, software components, and DNS infrastructure with the same care as your own systems. The NIS2 Directive already requires this of many organizations.
The political calendar is an early warning system. Hacktivist waves follow elections and political decisions. If you provide public services, transportation, or financial services in Europe, consider these dates when planning your security strategy.
European threats require European protection. The ENISA Threat Landscape 2026 makes it clear that Europe is at the center of geopolitically motivated attacks, particularly Germany. Since 2005, Link11 has protected businesses and critical infrastructure against these types of threats. Headquartered in Frankfurt and qualified by Germany’s Federal Office for Information Security (BSI) as a DDoS protection provider, Link11 secures networks, applications, and DNS.
For insights from our network, read the European Cyber Report 2026.
Would you like to know how resilient your infrastructure is today? Talk to our experts.
You might also like:
