ENISA’s Threat Landscape 2026 report, covering 1 January to 31 December 2025, names a small set of hacktivist groups behind most claimed ideology-driven activity in the EU. This list follows chapter 6, “Hacktivist Threats”, in the order ENISA gives, with its shares. It covers the groups, the sectors and countries hit, and the main trends.
Which hacktivist groups were most active in the EU in 2025?
ENISA reports that ideology-driven activity made up 57.3% of overall incidents in 2025. Within it, DDoS claims were 89.5% and unauthorized access 10.5%. The groups ENISA lists, with their share of all ideology-driven activity:
- NoName057(16), pro-Russia, 48%. ENISA says it remained active throughout the year.
- Dark Storm Team, pro-Palestine, 8.2%.
- Keymous+, pro-Palestine, 6.5%.
- Mr Hamza, pro-Palestine, 5.4%.
- Server Killers, pro-Russia, 4.3%.
ENISA adds that activity followed political developments, elections, protests, geopolitical tensions and EU Member State support for Ukraine. In coordinated campaigns, it names NoName057(16) and the pro-Palestine groups Hezi-rash, Mr Hamza and Dark Storm Team as the most active. See also our page on the NoName057(16) DDoS campaigns against Italy.
- 51.3%DDoS share of recorded incidents, the primary incident typeSource: ENISA Threat Landscape 2026
- 57.3%Ideology-driven share of overall incidentsSource: ENISA Threat Landscape 2026
- 89.5%DDoS claims as a share of ideology-driven activitySource: ENISA Threat Landscape 2026
Which sectors did hacktivists target?
ENISA says targeting stayed concentrated. Public administration took 45.8% of hacktivist activity, followed by transport (11.7%) and business services (7%). Digital infrastructure and energy each accounted for 4.8%. For the wider sector picture, see our post on the most targeted EU sectors.
Which EU countries were hit most?
ENISA says incidents were not spread evenly. Germany had 16% of claims, France 14.8%, Italy 10.5%, Spain 10.1% and Poland 8.9%. The most affected country changed by quarter, and many attacks ran under named banners such as #OpGermany, #OpFrance, #OpSpain and #OpPoland. Not all did: ENISA cites NoName057(16) attacks on Poland outside such campaigns.
- Q1France, Italy, Lithuania and Spain most targetedA first surge came in late February and early March, mainly against Spain.
- Q2NoName057(16) most activeFrance, Germany, Poland and Lithuania were the most targeted.
- Q3Highest level of the yearA surge followed the announcement of Operation Eastwood against NoName057(16). Germany became the main target.
- Q4Declined from the Q3 peakDenmark was the most targeted Member State.
ENISA also reports that more than 60 hacktivist groups were removed from Telegram between January and March 2025, and that groups responded with alias changes and moves away from the platform.
ENISA’s Q3 note says public administration continued to be the primary target sector, but activity against transport increased compared with Q2. In Q4 it says NoName057(16) kept dominating, followed at a distance by Server Killers and Dark Storm Team.
Is hacktivism moving into operational technology?
ENISA noted an increase in intrusion claims against operational technology (OT) and industrial environments in 2025. In Q2, the pro-Russia Z-Pentest Alliance claimed intrusions against energy- and water-related environments. Q3 recorded 37 OT-related claims and Q4 recorded 124. ENISA notes that most claims did not name the techniques or the affected entities, so impact could not be assessed. It also points to NoName057(16) as a new operator in this field. It concludes that OT disruption remained largely unverified, but that the focus signals rising interest in exploiting configurations, interfaces and credentials.
How reliable are hacktivist DDoS claims?
ENISA says DDoS remained the primary technique used by hacktivism in the EU. Its analysis of NoName057(16) and the DDoSia project, between July and November 2025, found tasking aimed mainly at TCP ports 443 and 80, consistent with web services.
ENISA also reports a growing use of DDoS-as-a-Service by hacktivist groups, which lowers the technical and financial barrier to entry. It says Keymous+ has been assessed as potentially operating as a DDoSaaS, and that Mr Hamza operates under a Hacktivism-As-A-Service model. Its overall reading is that hacktivism remained mainly a reputational pressure point against public administration, with some operational impact. For an earlier national-scale case, see our page on the nationwide DDoS attacks on the .tr domain.
What did DDoS look like globally in 2025?
ENISA states these figures are global and not necessarily tied to ideology-driven attacks. In 2025, 47.1 million DDoS attacks were mitigated, more than double 2024. Network-layer attacks rose from 11.4 million to 34.4 million. In Q3, 71% of HTTP DDoS attacks and 89% of network-layer attacks ended in under 10 minutes. Application layer attacks reportedly rose 128% on the previous year, and ENISA notes they can disrupt services even where traffic volumes appear modest.
Attack size grew too. ENISA cites a 7.3 Tbps multi-vector attack in mid-May 2025, and in Q4 a 31.4 Tbps attack lasting 35 seconds linked to Aisuru-Kimwolf. It adds that in the second half of 2025 more than 8 million DDoS attacks were recorded across 203 countries and territories, and more than half were multi-vector. Attacks on DNS root servers and Network Time Protocol services showed activity against core internet services. One check this raises: do your APIs, login flows and payment services hold up under modest traffic? For AI-related findings from agencies, read AI cyber threats in 2026, and for third-party exposure see the rise of supply chain cyber attacks.