Dragos Industrial Ransomware Analysis: Q4 2023
Summary: Dragos reported that in Q4 2023 only 32 of the 77 ransomware groups that have historically attacked industrial organizations were active, and incidents fell from 231 to 204 over the same period, though the cause of the decline is unknown. LockBit 3.0 accounted for 25.5 percent (52 incidents) of observed attacks, BlackBasta followed at 10.3 percent (21 incidents), and manufacturing was the most impacted industry with 135 incidents, or 66.1 percent.
Why it matters: The Qilin attack on Yanfeng in November 2023 disrupted operations enough that Stellantis halted production at its North American plants, and Dragos assesses with low confidence that groups may build ransomware specifically to disrupt OT processes, where disruption would compromise safety as well as operations.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2023-4966
- Related
- CVE-2023-4966: Citrix Net Scaler ADC and Net Scaler Gateway Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Oct 18, 2023Threat Brief: Citrix Bleed CVE-2023-4966 Cyber Risks ·