Dragos Industrial Ransomware Analysis: Q2 2025
Summary: Dragos recorded 657 ransomware incidents impacting industrial entities worldwide in Q2 2025, down from 708 in Q1, with North America the most targeted region at 355 incidents and manufacturing accounting for 65% of them. Qilin was the most active group with 101 incidents, up from 21 in Q1, after recruiting displaced affiliates from LockBit and RansomHub and being adopted operationally by North Korea's Moonstone Sleet in March 2025.
What you should know: Qilin's jump from 21 to 101 industrial incidents in a single quarter, backed by state adoption and specialized legal and PR staff, means a ransomware operation is now running a professionalized extortion business against industrial victims rather than a loose affiliate network.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2024-50623CVE-2024-55956
- Related
- CVE-2024-55956: Cleo Multiple Products Unauthenticated File Upload Vulnerability Known Exploited Vulnerabilities · Dec 17, 2024CVE-2024-50623: Cleo Multiple Products Unrestricted File Upload Vulnerability Known Exploited Vulnerabilities · Dec 13, 2024Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026