Evolution of Cyber Threats in the ENISA Report

The cyber threat landscape is constantly evolving, becoming more mature, complex, and convergent. We present to you the report ENISA Threat Landscape 2025, which analyses incidents detected between July 2024 and June 2025. It emerges that the digital infrastructure and services sector, of which we are part, remains a strategic and critical target.

MAIN THREATS IDENTIFIED IN 2025

Attack Vectors – Criminal and cyber-espionage activities are based on increasingly sophisticated and automated vectors. Here are the main ones:

• Phishing and Social Engineering: Phishing (including smishing via SMS and vishing via voice call) remains the most widespread initial intrusion vector, used in about 60% of observed cases. Social engineering is closely linked to human behaviour. The availability of PhaaS (Phishing-as-a-Service) platforms has industrialised its use, enabling even less experienced attackers to launch complex campaigns.
• Exploitation of Vulnerabilities: The exploitation of software vulnerabilities (especially so-called zero-days, not yet known to the vendor) constitutes another prevalent intrusion vector, accounting for 21.3%. Attackers are able to weaponise a vulnerability within days of its disclosure.

 
Supply Chain – There has been an increase in attacks on companies supplying other organisations, which occur in two ways:

• Third-party attacks: A service provider is targeted, causing an impact on its customers.
• Digital supply chain attacks: For example, the injection of malicious code into a software package that affects all users.

These approaches optimise the effectiveness of attacks, allowing access to a multitude of data and systems by targeting a single entry point.

Technological Evolution of Cybercrime – Attack techniques leverage modern technologies.

• Ransomware remains the most impactful threat in terms of operational continuity, and with the spread of ‘Ransomware-as-a-Service’ tools, more and more attackers can launch sophisticated attacks with limited effort. Cybercriminal groups have adopted aggressive extortion tactics, exploiting fears related to regulatory compliance (such as GDPR in Europe) to push victims to pay the ransom quickly.
• The use of Artificial Intelligence (AI) for malicious purposes is growing significantly. It is estimated that over 80% of all phishing emails use AI in some way to create more convincing texts. AI is also used to accelerate malware development and for espionage, for example, to generate fake LinkedIn profiles and support communications with victims.

MAIN RECOMMENDATIONS FOR ICT SECTOR OPERATORS

Our activities are constantly targeted by criminals: a company operating in the ICT sector and acting as a producer, supplier, and customer is particularly attractive to cybercriminals.

Our defensive approach must be intelligence-driven and focused on prevention, containment, and resilience.

Here are the pillars of an adequate defensive strategy for our sector.

Proactive Vulnerability Management and System Hardening

• Asset and Library Inventory – It is essential to know what needs to be protected and therefore maintain a complete inventory of assets (physical and digital) and software libraries in use. In case of alerts about campaigns or vulnerabilities, it is necessary to know whether the system or library in question is being used.
• Patch Management – The application of patches must be timely to mitigate the impact of the most serious vulnerabilities, such as zero-days. The speed with which attackers exploit disclosed vulnerabilities requires robust and fast update processes.
• Hardening – Strengthen the configuration of operating systems and use mechanisms for execution prevention and behavioural prevention on endpoints to block initial execution and persistence of malware.

Development, Integration, and Code Auditing

• According to the principle of Security by Design, security must be integrated into the design and development phases of software, which must be conducted based on industry guidelines (e.g. Mitre, OWASP, SANS) to reduce exploitable defects.
• It is essential to carry out integrity and security tests on code distributed on systems, especially in the context of supply chain attacks exploiting compromised repositories.

Access and Privileges

• The implementation of Multi-Factor Authentication (MFA) is crucial to strengthen identity and counter credential abuse.
• In Privileged Account Management, the principle of least privilege must be applied to limit opportunities for damage and lateral movement following credential compromise.
• The use of code signing helps ensure that only trusted components are present on systems.

Resilience and Containment

• Network segmentation isolates threats within confined zones, limiting lateral movement and the spread of ransomware and espionage activity.
• Backups and remote storage are essential to ensure operational continuity and mitigate the destructive impact of ransomware.

The cyber threat, especially that linked to vulnerabilities in the supply chain, requires constant attention. A systemic approach based on intelligence, with a focus on security by design and careful management of access and vulnerabilities, increases resilience and, if applied as part of a continuous and updated process, constitutes an effective defence against most threats.

Each of us, by paying attention to these topics while managing and planning our work, forms the #FirstLineofDefence, which is essential for safeguarding the stability of our business.

Link para o artigo no Engage: Link