Industrial Ransomware Analysis for Q2 2026
Summary: Dragos recorded 1,140 ransomware incidents against industrial organizations in Q2 2026, a 12% rise over the 1,020 in Q1, with Qilin the most active brand since March 2025 and Akira second. Dragos found no case where an operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system; disruption came from encryption or precautionary shutdown of enterprise and virtualization systems on which OT depends.
Key Takeaway: The Akira reconstruction showed entry through a legacy VPN account without multi-factor authentication followed by several days of quiet credential theft and backup destruction before encryption - a dwell window that is both the most detectable and most recoverable point, and one that closes before any ransom note appears.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026