Dragos Industrial Ransomware Analysis for the First Quarter of 2026
Summary: Dragos identified 1,020 ransomware incidents impacting industrial organizations worldwide in Q1 2026, consistent with the elevated baseline seen in late 2025, with manufacturing accounting for 62% of observed industrial victims and North America reporting nearly 500 victim organizations. Qilin and Akira led claim volume, while The Gentleman operation rose from 18 incidents in Q4 2025 to 83 in Q1 2026, and Dragos observed no ransomware variants specifically engineered to manipulate industrial control protocols or process environments.
Bottom line: Dragos found that ransomware does not need ICS-specific malware to degrade industrial operations: attacks on IT systems, ERP platforms, and virtualization infrastructure cascaded into OT disruptions, and in 43% of ransomware intrusions Mandiant responded to in 2025, adversaries targeted virtualization infrastructure, up from 29% in 2024.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026