Suspected Conti Ransomware Activity in the Auto Manufacturing Sector
Summary: Dragos observed consistent network communication between Emotet command-and-control servers, suspected to be controlled by the Conti ransomware group, and numerous auto manufacturing companies in North America and Japan, from December 2021 through March 2022. Some victims communicated with many of the C2 IP addresses, indicating well-established footholds with multiple backup controllers, though Dragos reported no confirmed initial access method and no evidence of ransomware encryption.
What you should know: Multiple backup C2 controllers per victim means an adversary already has redundant paths into these networks, and an infection reaching Level 2-3 systems such as engineer workstations, historians, or SCADA can severely disrupt industrial operations.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026