ENISA Threat Landscape 2023 Overview

Keypoints

• Major cybersecurity reports typically comprise sections on threat overview, threat actor trends, vulnerabilities, specific threat types (e.g., ransomware, malware, social engineering), sectoral impacts, and mitigation recommendations, providing both strategic and technical insights.
• The reports present key statistics such as the predominance of ransomware and DDoS attacks, which account for nearly half of the incidents analyzed during the period, indicating these are the most pressing cyber threats.
• Emerging trends include the professionalization of threat actors through as-a-Service models, use of novel attack techniques, and geopolitical motivations influencing attack campaigns, especially targeting critical sectors like public administration, healthcare, and digital infrastructure.
• Ransomware incidents surged in early 2023, with top groups like LockBit, AlphV, and Bian Lian leading the threat landscape. The rise of double extortion tactics and increased use of zero-day vulnerabilities highlight evolving extortion and attack strategies.
• Cybercriminals are increasingly exploiting legitimate, widely-used tools and cloud infrastructures to evade detection and maximize impact, while law enforcement agencies have intensified their operations against prominent ransomware groups such as Hive and Trickbot.
• Social engineering remains the dominant initial infection vector, with attackers leveraging AI and new techniques to enhance the success of phishing, Business Email Compromise (BEC), and other manipulation tactics, reflecting a persistent human factor vulnerability in cybersecurity defenses.
• The updated threat landscape emphasizes the importance of sector-specific risk management, awareness of geopolitical influences, and strengthening defenses against complex, multi-vector attacks that combine technical exploits with social manipulation.