Dragos Industrial Ransomware Analysis: Q4 2022
Summary: Dragos tracked 57 ransomware groups that have hit industrial organizations, of which 24 were active in Q4 2022, and recorded 189 ransomware incidents against industrial organizations and infrastructure - a 30 percent increase over the prior quarter's 128. Lockbit 3.0 accounted for 21 percent of those incidents (40), followed by Black Basta and Royal at 12 percent each, while manufacturing took 76 percent of attacks (143 incidents, up 38 percent) and groups including RansomExx, ALPHV, Hive, Luna and Qilin rewrote malware in Rust and adopted intermittent encryption to evade detection.
What you should know: Dragos observed multiple victims hit by two or more ransomware groups in the same quarter, pointing to shared initial access bought from the same brokers - so one unpatched entry point can feed several crews. And with 143 of 189 incidents landing in manufacturing, the sector carrying your OT footprint is the one being worked hardest.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026