Pro-Russia Hacktivists Target EU Operational Technology Systems

• •Pro-Russia hacktivist groups increased OT cyberattacks in the EU in 2025.
• •NoName057(16) was responsible for 48% of hacktivist attacks despite a prior takedown.
• •Public administration was the most targeted sector, with 32% of incidents reported.

In 2025, pro-Russia hacktivist groups significantly increased cyberattacks against operational technology (OT) systems in the EU, as reported by the European Union Agency for Cybersecurity (ENISA). The agency's annual Threat Landscape report indicated that ideology-driven attacks accounted for 57.3% of all incidents, with 4,709 hacktivist claims made against EU member states. Most of these attacks were distributed denial-of-service (DDoS) attacks, which caused minimal disruption. However, unauthorized access attempts targeting OT systems have raised alarms, particularly in critical sectors like energy and transport. The pro-Russia group NoName057(16) was responsible for 48% of these attacks, despite a Europol-led takedown in mid-2025. The most notable incident involved data-wiping malware targeting the Polish power grid in December 2025. Public administration was the most affected sector, accounting for 32% of cases, followed by business services and transport. Cybercrime incidents, including ransomware and data breaches, also comprised a significant portion of reported attacks.