Dragos Industrial Ransomware Analysis: Q1 2025

Summary: Dragos identified 708 ransomware incidents impacting industrial entities worldwide in Q1 2025, up from roughly 600 in Q4 2024, with North America rising from 360 to 413 incidents and Europe from 102 to 135. Manufacturing remained the most affected sector at 68 percent (480 incidents), and Cl0p incidents jumped from two in Q4 2024 to 154 in Q1 2025, attributed mainly to exploitation of Cleo Managed File Transfer vulnerabilities.
Why it matters: Cl0p went from two industrial incidents to 154 in a single quarter by exploiting a file transfer tool whose October 2024 patch for CVE-2024-50623 was later found incomplete - a reminder that a vendor's patch note is not the same as a closed door.

Read the original at Dragos Blog ↗

Topics: OT / ICS & Critical Infrastructure
Related: Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026
How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026
Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026