CrowdStrike has just released its 2025 European Threat Landscape Report, and for the second consecutive year, they observe the ransomware threat and state-sponsored ransomware attack multiplication and the risk from cyber activity on Europe as a whole to be growing. The report describes a troubling and predictive multi-prong attack on critical infrastructure, government, and commercial targets, detailing the seamless coordination of the expanding cyber attack.
A shift in focus areas: Where will they attack next?
The European Threat report shows that ransomware remains the foremost threat in Europe, but malicious cyber actors continue to evolve their attack strategies while seeking greater returns on their invested cyber attack resources. Threat actors primarily engaged in opportunistic ransomware attacks across all commercial sectors; they are now focusing their cyber attacks on the energy and health sectors alongside government financial systems, conducting double-extortion ransomware attacks.
The report highlights advancements in cyber attack systems, cyber supply chain attack systems, and endemic cyber attack uber systems, where the report indicates perhaps unrecoverable recovery from ransomware due to an unrecoverable system.
What does the report say?
The report shows that, on top of criminal ransomware infrastructure, there is now an unprecedented multiplication of state-sponsored cyber activity. State-sponsored actors are using an unprecedented multiplication of cyber operations as tools of geopolitical influence. Espionage has now morphed into the cyber attacks themselves as a strategic disruption design and targets to achieve geopolitical advantage. Targets now include military defense contractors, energy military-grade cyber control systems, and diplomatic cyber control networks aimed at crippling the defense and economic stability of Europe.
The data suggests that these attacks are becoming more sophisticated as attackers join forces
The report describes the legacy and newer threat landscape as follows:
- Living-off-the-land attacks: Defenders use legitimate tools and workflows, maximizing time use to avoid detection.
- Cloud exploitation: Attackers take advantage of the limited identity and access management (IAM) controls and configuration errors as organizations continue their migration to cloud environments.
- AI-driven: Use of machine learning to automate the reconnaissance phase of attacks and for more efficient phishing.
A bigger risk to critical infrastructure
One of the most concerning findings of the report is the heightened risk to critical infrastructure. For the most attacked and strategically valuable of the societal critical infrastructure services, i.e., energy, transport, and healthcare, the socio-economic is vulnerable, and the security is often insufficient. A successful attack on these sectors is likely to lead to severe socio-economic consequences by eroding public confidence and trust as these services become interrupted and essential.
Ransomware and nation-state goals: could this lead to hybrid attacks?
CrowdStrike believes that the combination of ransomware with nation-state goals may result in hybrid attacks, in which political criminals cross the borders of financial crime to become proxies for a geographically motivated opponent.
CrowdStrike suggests:
- A cross-public and private sector collaboration in threat intelligence.
- Deployment of Endpoint Detection and Response (EDR) technology to enable quicker detection and neutralization of attacks.
- Frequent training of employees, along with systematic security audits to eliminate the human factor, which remains a primary cause of breaches.
The report is a final warning
The message of CrowdStrike’s report is that the warning they provide is a final warning to all leaders of industry and for all politicians and policy makers, the message is clear: cybersecurity ceases to be an issue for the information technology community.
The message is unambiguous, the message is that, and it is that of cybersecurity. Cybersecurity is an issue of the highest strategic order. It is an issue that speaks to the very core and essence of the nations. It is an issue that speaks of security and economic order within cybersecurity. It is the order in which the nation thrives. Cybersecurity is the order on which the nation thrives.
