Europe's cybersecurity defenses are cracking under pressure from a converging wave of threats: artificial intelligence is supercharging criminal attacks, ransomware operators are targeting essential services with industrial precision, and geopolitical tensions are fueling state-sponsored cyberespionage campaigns that exploit digital dependencies across the continent. The European Union Agency for Cybersecurity (ENISA) released its 2026 Threat Landscape report analyzing incidents from 2025, and the findings paint a sobering picture of an increasingly interconnected threat ecosystem where traditional boundaries between cybercrime, hacktivism, and state-backed operations are blurring.

Why Are AI-Powered Attacks Becoming the Cybercriminal's New Weapon?

The integration of artificial intelligence into malicious cyber operations represents one of the most significant shifts in the threat landscape. A concrete example emerged in September 2026 when Microsoft dismantled EvilTokens, a phishing-as-a-service platform that used AI "at every step of the attack chain" to compromise email accounts and orchestrate financial fraud at scale. The platform had compromised approximately 12,000 inboxes and generated roughly $1.1 million in revenue for its operators between October 2025 and June 2026.

What made EvilTokens particularly dangerous was not just its technical sophistication, but how it democratized complex attack capabilities. The service packaged account takeover, AI-driven mailbox analysis, and fraud tooling into a single commercial offering sold on Telegram for between $600 and $1,500 per product, with monthly subscription fees of $500. At the center of the platform was an AI-powered chatbot that could analyze a victim's inbox and help criminals identify trusted relationships, payment authorizations, and sensitive responsibilities where fraud was most likely to succeed.

"EvilTokens packaged account takeover, AI-driven mailbox analysis, and fraud tooling into a single commercial service, lowering the expertise once needed to run business email compromise and invoice fraud at scale," stated TRM Labs, a blockchain intelligence firm that assisted in the takedown.

TRM Labs, Blockchain Intelligence Firm

The platform's AI capabilities extended beyond analysis. The chatbot could recommend fraud strategies, draft messages impersonating trusted contacts, and even identify the best people to impersonate within an organization. This represents a fundamental shift in how cybercriminals operate: instead of requiring deep expertise in identity attacks, cloud systems, social engineering, and financial fraud, attackers can now purchase a turnkey solution that handles the heavy lifting automatically.

How Widespread Is the Vulnerability Problem Across Europe?

The sheer volume of new vulnerabilities discovered in 2025 underscores a critical challenge facing European organizations. ENISA documented the publication of over 48,000 new vulnerabilities assigned Common Vulnerability and Exposure (CVE) identifiers, representing a 22 percent increase from the prior year. More alarming, 60 percent of unauthorized access incidents leveraged known vulnerabilities, meaning organizations failed to patch systems despite having security updates available.

This vulnerability-exploitation gap reveals a systemic weakness in European cybersecurity posture. Threat groups are not waiting for zero-day exploits (previously unknown vulnerabilities); they are systematically targeting organizations that have not applied patches for known security flaws. The problem is compounded by the fact that vulnerability exploitation accounts for 70 percent of identified initial intrusion vectors in state-nexus cyberespionage campaigns, where attackers have the resources and motivation to conduct sustained operations.

What Sectors Are Being Targeted, and Why?

Public administration remains the most targeted sector, accounting for 32 percent of all targeted organizations in 2025. However, the targeting patterns reveal a strategic approach by different threat actors. Ransomware operators, driven by financial motivation, have diversified their targeting across manufacturing, business services, and public administration. Meanwhile, state-nexus intrusion sets show distinct preferences: Russian-nexus groups primarily target central governmental and diplomatic entities, while China-nexus intrusion sets demonstrate continuous interest in the transport sector, including maritime entities.

The concentration of attacks on essential and important entities is particularly concerning. Across the reporting period, 73 percent of targeted organizations are classified as essential or important entities under European Union regulations. This means that critical infrastructure, healthcare systems, financial institutions, and government services are bearing the brunt of cyberattacks. The sectoral breakdown reveals that beyond public administration, business services (8 percent), transport (8 percent), manufacturing (7 percent), and finance and banking (6 percent) are all significant targets.

How Are Geopolitical Tensions Driving Cyber Attacks?

The cyber threat landscape cannot be separated from geopolitical developments. Hacktivists launched 4,709 campaigns against European Union Member States during 2025, with more than 89 percent involving disruptive distributed denial-of-service (DDoS) attacks tied to geopolitical tensions, political developments, and elections. Ideology-driven incidents accounted for 57 percent of threats targeting the European Union, while 30 percent were financially motivated.

Russia's approach to cyber operations has evolved beyond traditional espionage. The country employed Foreign Information Manipulation and Interference (FIMI) as a core state power instrument in 2025, strategically shifting focus from the United States to concentrate on Europe. Russian FIMI campaigns accompanied escalatory hybrid actions including drone incursions, sabotage, and critical infrastructure attacks across Poland, Romania, Lithuania, and Estonia, designed to manage public perception and test European Union responses. The Kremlin's operations, tailored to specific audiences, aimed to deepen existing divisions and mobilize anti-establishment sentiment by portraying the European Union as either undemocratic and aggressive or dangerously weak.

Steps to Strengthen Your Organization's Cyber Resilience

Organizations across Europe face a complex threat environment requiring a multifaceted defense strategy. Based on the threat landscape analysis, several critical actions can improve organizational resilience against the converging threats of AI-powered attacks, ransomware, and state-sponsored operations.

• Patch Management Discipline: Implement a rigorous vulnerability management program that prioritizes patching known vulnerabilities within defined timeframes. Since 60 percent of unauthorized access incidents leverage known vulnerabilities, organizations must treat patch deployment as a critical security control rather than a routine maintenance task.
• Supply Chain Visibility: Map and monitor third-party dependencies and cloud environments that could serve as entry points for attackers. Supply chain and third-party attacks continued to result in large-scale incidents affecting critical infrastructure and digital services, making vendor risk management essential.
• Email Security Enhancement: Deploy advanced email filtering and authentication mechanisms to defend against phishing campaigns, which remain the most prevalent enabling mechanism for attacks. Social engineering tactics, including phishing campaigns and the ClickFix technique, accounted for 77.8 percent of social engineering attacks.
• AI-Aware Threat Detection: Recognize that threat groups are increasingly integrating artificial intelligence to enhance malicious activities and expand operational reach. Organizations must update their security monitoring to detect AI-assisted attacks that may exhibit different patterns than traditional malware.
• Credential Compromise Response: Establish protocols for rapid response to credential compromise, as fraud and phishing activity highlighted the continued importance of credential compromise, impersonation, and social engineering techniques in the threat landscape.

What Does the Future Hold for European Cybersecurity?

ENISA's assessment of future threats suggests that several dynamics observed in 2025 are likely to persist into the next reporting period. Organizations across the European Union will continue facing a combination of cybercrime, cyberespionage, and hacktivist activity driven by geopolitical developments. While the objectives of different threat actors remain distinct, cybercriminal, hacktivist, and state-nexus operators increasingly rely on similar access vectors, tools, and operational approaches, making attribution and threat analysis more challenging.

"The ENISA threat landscape is more than a list of cybersecurity threats affecting the European Union and how they are distributed around sectors and entities. The analysis highlights how threats become more interconnected and how threat groups spread their impact across the larger map of digital services and infrastructures. Being aware of such underlying dynamics is key if we want to implement the right solutions and maintain a high level of resilience across our digital economy," explained Juhan Lepassaar, ENISA's executive director.

Juhan Lepassaar, Executive Director at ENISA

The emergence of AI-powered attack platforms like EvilTokens demonstrates that cybercriminals are not simply adopting artificial intelligence as an incremental improvement; they are fundamentally restructuring how attacks are designed, executed, and scaled. The takedown of EvilTokens, carried out with authorization from the U.S. District Court for the Eastern District of Virginia and involving efforts from Health-ISAC, Cloudflare, Coinbase, OpenAI, Railway, SpyCloud, The Shadowserver Foundation, and TRM Labs, represents a rare coordinated international response. However, the platform's existence and profitability demonstrate that the market for AI-enhanced cybercrime services is robust and growing.

European organizations must recognize that cyber dependencies expand the attack surface and require a new level of vigilance to effectively prevent and mitigate the impact of cyber incidents. The convergence of AI-powered attacks, supply chain vulnerabilities, geopolitical tensions, and the persistent exploitation of known vulnerabilities creates a threat environment that demands continuous adaptation and investment in cybersecurity capabilities. The question is no longer whether organizations will face attacks, but whether they can detect and respond to them before attackers achieve their objectives.