Dragos Industrial Ransomware Analysis: Q3 2025
Summary: Dragos identified 742 ransomware incidents affecting industrial entities worldwide in Q3 2025 (July-September), up from 708 in Q1 and 657 in Q2, with North America the most targeted region and manufacturing accounting for 72% of incidents. Qilin was the most active group for the second consecutive quarter with 138 incidents, and in September a Qilin intrusion on Asahi Group Holdings in Japan led to reported production and logistics delays.
Bottom line: Qilin, Akira, Play, and INC ransom accounted for nearly 40% of industrial ransomware activity in Q3, and Qilin's Asahi intrusion showed that access to enterprise IT alone can halt production without touching an ICS network.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026