18% of Attacks Aimed at EU Targeted OT, Says Cybersecurity Agency

According to ENISA, the EU’s cybersecurity agency, its 2025 Threat Landscape report analyses nearly 4,900 incidents from July 2024 to June 2025 and finds that 18.2% of observed threats targeted operational technology (OT) systems, following 42% for mobile threats and 27% for web threats. The report notes that many publicly disclosed attacks on industrial control systems and other OT are carried out by hacktivists or hackers who claim ideological motives but are part of larger, sometimes state‑sponsored, groups.

One such group, NoName057(16), is described as pro‑Russian and has been blamed for attacks across Europe; it is said to be part of the Z‑Pentest Alliance, a coalition active since around October 2023 and known for targeting ICS/OT.

ENISA highlights Z‑Pentest Alliance members increasingly targeting OT in Italy from the fourth quarter of 2024, as well as activity by another pro‑Russia group, Rippersec, and the Infrastructure Destruction Squad (IDS), which emerged in June 2025 and reportedly developed an ICS malware named VoltRuptor. The agency notes IDS also conducted an attack on an Italian smart building automation company, suggesting a realistic working hypothesis about the IDS persona being leveraged by a Russia‑nexus intrusion set.