Dragos Industrial Ransomware Analysis: Q3 2024
Summary: Dragos reports that Q3 2024 brought new ransomware groups, rebranding of existing entities, and expanded initial access broker operations, while LockBit's disruption under Operation Cronos pushed affiliates such as Velvet Tempest toward RansomHub. Dragos observed new groups including APT73, Fog, Helldown, Eldorado, and Play targeting industrial organizations, with roughly 30% of ransomware incidents linked to VPN appliance vulnerabilities such as CVE-2024-40766 in SonicWall SSL VPNs or poorly managed credentials.
What you should know: Dragos says it has no knowledge of direct attacks on OT assets by the newly identified groups, yet ransomware-induced IT downtime still halted industrial processes and caused financial losses, production delays, and safety risks - and hacktivist personas such as CyberVolk, Handala, and KillSec are now using ransomware for operational sabotage rather than payment.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026