Dragos Industrial Ransomware Analysis: Q1 2024
Summary: Dragos reported that industrial ransomware incidents fell from 204 in Q4 2023 to 169 in Q1 2024, and active groups targeting industrial organizations dropped from 32 to 22 of the 77 known groups. The quarter saw Lockbit dismantled by an international law enforcement operation and Alphv/Blackcat self-decommission its infrastructure after stealing millions from an affiliate that attacked a US healthcare services provider, while manufacturing absorbed 106 incidents, or 62.7 percent.
Key Takeaway: Dragos assesses with moderate confidence that groups are steering affiliates toward specific sectors, as Alphv/Blackcat did with healthcare, and warns the same coordination could be turned on industrial targets. Only EKANS and Cl0p have shown OT-impacting capabilities, yet Dragos is aware of multiple instances where operators detonated ransomware inside OT environments and caused operational disruption without them.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026