Europe Intelligence Insights, September 2025

In recent months, the manufacturing, construction, and IT sectors faced fresh ransomware campaigns. Hacktivist collectives stepped up their DDoS assaults on European organizations. Credential leaks and initial access sales, though declined, kept exposing critical business infrastructure across the continent. Get the latest data, trends, and insights in the full report.

Europe’s latest threat activity

The past months brought another sharp rise in cyber incidents. Across Europe, 153 ransomware attacks were recorded, up to 28% month over month. The construction, IT, and manufacturing sectors experienced the heaviest impact. Get the full list of top targets and key threat actors in the report.

Hacktivism and DDoS take center stage

DDoS and hacktivism activity increased by 42%, with Germany, Spain, Belgium, and the United Kingdom among the most targeted countries. The hacktivist groups NoName057(16) and Z-ALLIANCE carried out most of the DDoS attacks across the EU.

Operation Serengeti 2.0

INTERPOL’s Operation Serengeti 2.0, supported by Group-IB, led to 1,209 arrests, helped dismantle 11,400 pieces of malicious infrastructure, and made it possible to return $97.4 million to victims.

Group-IB contributed intelligence on cryptocurrency investment scams, BEC infrastructure, and other malicious assets active in the region.

Stop threats before they take over

Group-IB experts outline the latest regional risks and share steps you can take to strengthen your defenses against ransomware, hacktivism, and data compromise.

Receiving insights but unsure how to apply them to your defenses? Our experts are here to help. Contact us.

Stay informed. Stay protected.

Europe Intelligence Insights, September 2025

Europe’s latest threat activity

Hacktivism and DDoS take center stage

Operation Serengeti 2.0

Relevant reports