Pro-Russia Hacktivists Increase OT Intrusion Claims Across EU

Claims of cyberattacks against operational technology and industrial environments increased significantly in 2025 - particularly those involving pro-Russia hacktivist groups, the European Union Agency for Cybersecurity warned.

See Also: Bridging the IT-OT Divide in Building Security: Insights on Reducing IT-OT Security Risk in Commercial Systems

ENISA released its annual Threat Landscape report last week, finding that ideology-driven malicious cyberattacks accounted for 57.3% of all incidents the agency recorded in 2025, followed by financially motivated activity at 30%. In total, there were 4,709 hacktivist claims against European Union member states last year, 89.5% of which involved distributed denial-of-service attacks. The rest involved unauthorized access.

Speaking at a Tuesday briefing the report, Jamila Boutemeur, head of the agency's threat analysis team, said the hacktivist DDoS attacks generally caused little disruption, with most lasting only a few minutes or hours. But she said there was reason for concern, given that "the number of unauthorized accesses has increased, especially when it comes to the targeting of operational technology, notably by pro-Russia hacktivist groups."

"Operational technology systems are particularly deployed within organizations involved in critical sectors, such as the energy sector, telecommunications and transport. So, of course this is something that should be highlighted and watched," Boutemeur said.

According to ENISA, the most prolific hacktivist group involved in these attacks was the pro-Russia NoName057(16), which was the subject of a Europol-led infrastructure takedown in mid-2025 (see: EU Authorities Take Down Pro-Russian Hacktivist Collective ).

But given that the agency said NoName057(16) "remained active throughout the year," the takedown clearly had limited effect. According to ENISA, the group was responsible for 48% of the hacktivist attacks recorded in 2025, while the three most prolific groups - Dark Storm Team, Keymous+ and Mr Hamza - were apparently motivated by pro-Palestinian sympathies.

Last year attackers attempted hundreds of politically motivated compromises of OT systems in Europe, particularly involving Russia-linked groups attacking European water infrastructure . The most high-profile incident came at the end of December 2025, when someone - security researchers pointed to Russian military intelligence - deployed data-wiping malware against the Polish power grid (see: Wiper Malware Targeting Poland's Power Grid Tied to Moscow ).

Public administration was the most targeted sector in the EU in 2025, accounting for 32% of cases. Business services and transport came , each with 8%, followed by manufacturing at 7% and finance and banking at 6%.

After hacktivism, cybercrime accounted for 36% of the reported incidents. Two-fifths of those cases involved ransomware, while data breaches accounted for 31% of incidents, and fraud and impersonation accounted for 19%.

It's notoriously difficult to draw a line between cybercriminal and state-linked attacks.Countries such as Russia are known to tolerate criminal gangs that prove useful - but Boutemeur warned Tuesday that this "blurriness" should not overly concern defenders.

"We cannot stress this enough, that your defense should be around the pathways that attackers are taking, rather than necessarily focusing on specific threat types," she said. As for which pathways, 71% of vulnerabilities reported in 2025 mentioned the network as the attack vector, so "internet-facing systems are particularly vulnerable to exploitation."

Overall, the number of reported vulnerabilities in 2025 increased - up 22% year over year, with more than 48,000 flaws assigned Common Vulnerabilities and Exposures identifiers.

"This does not necessarily mean that all of these vulnerabilities were exploited, but this is of course quite concerning, because the more you disclose then the more opportunities there are also for attackers," Boutemeur said. "We also assess that this increased number of vulnerabilities that were disclosed was due to the fact that more manufacturers and suppliers in general are increasingly documenting vulnerabilities, which is fully in line with the work that ENISA has been focusing on for the last two years."

Boutemeur said the reports showed an increase in third-party and supply chain attacks, in which attackers target a supplier or organization that can help them reach their ultimate victim. Another ongoing trend involves an increase in attacks targeting EU institutions and officials outside European territory.

As for the impact of artificial intelligence on cybersecurity, 2025 was before the advent of Anthropic's Mythos and other frontier models that have proved particularly adept at locating and even exploiting software vulnerabilities. That said, ENISA observed continued integration of AI into malicious activities last year - by both criminals and state-linked actors - and expects its report to show that trend continuing this year.

AI will act as a "force multiplier" across all types of threats, Boutemeur said, from crafting more believable phishing messages to creating proof-of-concept vulnerability exploits. But she added that network defenders may also find AI useful for detecting breaches and improving situational awareness.

In its report, ENISA also called out AI's ability to generate fake images, audio, video and text that "have become a daily and cost-effective tool in the arsenals of threat actors." ENISA said that "AI also enables the mass distribution of content as well as translations across multiple languages, significantly expanding reach and potential impact."

Russia's foreign information manipulation and interference efforts were mostly focused on elections in 2025, the agency said. Russia's predictable playbook begins with the delegitimization of political leadership months before elections take place, followed by weaponizing domestic divisions during the electoral campaign and attempts to undermine electoral integrity in the late stages (see: UK PM Vows to Combat Russian 'Industrial Scale' Disinfo ).

China, meanwhile, uses foreign information manipulation and interference to intimidate critics and promote an image of China as a "force for peace," ENISA said.

Critical Infrastructure Security

Governance & Risk Management

Operational Technology (OT)

David Meyer is a freelance technology journalist based in Berlin. He previously was a senior writer for Fortune, covering artificial intelligence. He has worked for Politico Europe and written for ZDNet, Privacy Advisory and the BBC.