Europe Intelligence Insights, November 2025

Europe recorded 646 DDoS and hacktivism attacks, 322 ransomware incidents, and 119 initial access listings between September and November. Incidents ranged from targeted attacks on German health organizations to ransomware leaks hitting multinational firms.

Ransomware groups targeted large enterprises, particularly in credit information services and imaging technology. Initial access brokers expanded their listings, which included a Serbian marine shipping company valued at 206 million dollars. Adversary-in-the-middle phishing remained active, with Tycoon 2FA leading in the observed campaigns.

Hezi Rash, NoName057, and DarkStorm Team remained among the most active groups, with operations targeting health providers, government entities, and critical service organizations across Europe. The report provides country-level insights into activity levels and sector targeting.