Dragos ICS/OT Ransomware Analysis: Q4 2021
Summary: Dragos analyzed 37 ransomware strains on Dark Web leak and negotiation sites and counted 176 ICS-related victim postings in Q4 2021 - 58 in October, 57 in November, and 61 in December - with 41% of victims located in the U.S. and Germany and Italy tied at 9% each. Manufacturing accounted for 65% of postings across 52 sub-sectors, Lockbit 2.0 made 28% of postings and Conti 18%, and PYSA's November spike of 11 ICS victims nearly matched Conti's 12 that month.
What you should know: Two RaaS platforms produced 46% of the quarter's ICS postings, and Conti was noted for sometimes returning no files or only a fraction after payment - so a ransom paid by an OT-dependent manufacturer buys no guaranteed recovery, while upstream and downstream disruption can reach automotive, food and beverage, and energy firms that depend on its output.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026