For industrial organisations, resilience depends on knowing where the real risks lie.
In the fourth quarter of 2025, state-sponsored operations continued targeting European industrial infrastructure, while ransomware activity increased across the industry. At the same time, hacktivist groups maintained campaigns against exposed industrial systems.
This are the key takeaways:
State-sponsored espionage: Iran-linked operations continue targeting industrial organisations, focusing on persistence and intelligence gathering across critical infrastructure.
Ransomware escalation: Ransomware incidents increased by 30% compared to the previous quarter, although attacks remain largely opportunistic.
Hacktivist disruption: Pro-Russia groups continue DDoS campaigns and sabotage attempts targeting exposed SCADA and OT systems.
