Dragos Industrial Ransomware Analysis for the Fourth Quarter of 2025
Summary: Dragos recorded 1,211 ransomware incidents affecting industrial entities worldwide in Q4 2025, up from 742 in Q3 and 657 in Q2, with Qilin the most active group for a third consecutive quarter at 284 incidents. Manufacturing accounted for nearly 70% of Q4 incidents, while electric/renewables rose from 16 to 40 and transportation from 36 to 120, and Dragos observed no confirmed Stage 2 ICS Cyber Kill Chain activity or ICS-specific malware.
What's compelling: The incidents concentrated in enterprise IT that production depends on - identity services, file servers, ERP, MES, and remote access - so a compromised file-sharing platform or ERP component can disrupt operations without any control-system access; CL0P's Oracle E-Business Suite campaign alone reached more than twenty industry verticals.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026