Cybersecurity Agency Reports 18% of EU Attacks Target Operational Technology Systems

What's Happening?

The European Union's cybersecurity agency, ENISA, has released its 2025 Threat Landscape report, revealing that 18.2% of cyberattacks aimed at the EU targeted operational technology (OT) systems. The report analyzed nearly 4,900 cybersecurity incidents from July 2024 to June 2025, including publicly reported incidents and those shared by EU countries. While mobile threats accounted for 42% and web threats for 27% of attacks, OT systems remain a significant target due to their increasing connectivity and exposure. The report highlights the involvement of hacktivists, often state-sponsored, such as the pro-Russian group NoName057(16), known for DDoS attacks. This group is part of the Z-Pentest Alliance, which targets ICS/OT systems to weaken Western industrial and control systems, thereby enhancing Russia's geopolitical influence.

Why It's Important?

The targeting of operational technology systems poses a significant risk to industrial and critical infrastructure, which are vital for national security and economic stability. As these systems become more interconnected, they are increasingly vulnerable to cyberattacks that can disrupt essential services and operations. The involvement of state-sponsored groups like NoName057(16) and the Z-Pentest Alliance underscores the geopolitical dimensions of cybersecurity threats, where technological vulnerabilities are exploited to gain strategic advantages. This trend highlights the need for robust cybersecurity measures and international cooperation to protect critical infrastructure from such threats.

What's Next?

ENISA's report suggests that the targeting of OT systems is likely to continue, with groups like the Infrastructure Destruction Squad (IDS) developing advanced malware such as VoltRuptor, which is reportedly available on the dark web. The agency has noted increased targeting of OT systems in Italy and other EU member states. As these threats evolve, cybersecurity agencies and governments may need to enhance their defenses and develop new strategies to counteract these sophisticated attacks. The ongoing ICS Cybersecurity Conference in Atlanta could serve as a platform for professionals to discuss and address these challenges.

Beyond the Headlines

The report's findings raise ethical and legal questions about the use of cyberattacks as tools of geopolitical influence. The involvement of state-sponsored groups in targeting critical infrastructure highlights the blurred lines between hacktivism and state-sponsored cyber warfare. This development could lead to increased tensions between nations and necessitate new international norms and agreements to govern cyber activities. Additionally, the sale of advanced malware on the dark web poses a threat to global cybersecurity, requiring coordinated efforts to track and mitigate these risks.