Ransomware gangs don’t need control system access to disrupt industrial production

Disrupting IT systems that support industrial environments can be enough to interrupt production, even when ransomware operators do not gain direct access to industrial control systems (ICS), according to Dragos.

The company identified 1,140 ransomware incidents involving industrial organizations in the second quarter of 2026, up 12% from 1,020 in Q1. The figures come from publicly disclosed victim data and posts made by ransomware groups on their data leak sites. Manufacturing accounted for 747 incidents, or 65% of the total.

Construction accounted for 176 incidents, equipment manufacturing for 114, and food and beverage organizations for 70. Organizations supporting ICS environments, including engineering firms, system integrators, and equipment manufacturers, accounted for another 117 incidents. Transportation and logistics recorded 95.

(Source: Dragos)

“Ransomware remained the most persistent and disruptive cyber threat to industrial organizations,” Dragos researchers Lexie Mooney and Abdulrahman H. Alamri wrote.

“Risk to industrial organizations is being shaped less by novel ICS-specific malware and more by adversaries’ deepening focus on the enterprise IT systems that underpin OT environments.”

“Platforms such as ERP systems, virtualization infrastructure, identity services, and remote access gateways represent high-value targets precisely because disrupting them can rapidly cascade into production shutdowns and supply chain impacts,” they added.

Mackay Sugar, Australia’s second-largest raw sugar producer, disclosed a cyberattack on June 10 that stopped milling and cane haulage at two of its three Queensland mills. One mill resumed limited manual crushing two days later. The Gentlemen ransomware group later listed the company on its leak site.

Dragos said it found no evidence that the attackers reached ICS or directly manipulated OT. Researchers assessed with low confidence that the incident mainly affected enterprise IT and said it remained unclear whether the shutdown resulted from the attack or containment measures taken afterward.

Data theft remains central to ransomware extortion

Extortion continued shifting away from file encryption and toward data theft, Dragos noted.

This means an intrusion can continue to expose an organization after affected systems have been restored, since stolen employee, customer, supplier, financial, or operational data can be published or used for further extortion.

Attackers continued gaining access through internet-facing devices, remote management tools, compromised accounts, and stolen credentials.

Qilin logged the largest number of industrial victim claims in Q2, with 140, down from 198 in Q1. Akira followed with 129, up from 100, while The Gentlemen rose from 83 to 125. The three groups finished within 15 claims of one another.

Qilin affiliates used several routes into victim networks, including compromised credentials and vulnerable internet-facing infrastructure. Akira relied on compromised VPN devices, while The Gentlemen targeted edge devices before moving deeper into corporate networks.

Attackers pose as IT support over Teams

“Social engineering was the most consistently reported initial access theme of the quarter and shifted from email to interactive impersonation on enterprise collaboration platforms,” the researchers stated.

Several groups contacted employees over Microsoft Teams while posing as internal IT support, then guided targets through screen-sharing sessions to install remote monitoring tools such as AnyDesk or Quick Assist.

Some attackers also set up credential-harvesting domains designed to resemble the victim organization’s naming conventions, capturing passwords and MFA codes entered by employees.

The FBI warned in late May that Silent Ransom Group, also known as Luna Moth, had begun sending operatives into offices while posing as IT technicians and connecting USB drives directly to machines.

Law enforcement targets ransomware infrastructure

Authorities continued targeting ransomware infrastructure during the quarter, including services and malware used to support attacks.

An international operation dismantled the First VPN anonymization service, seizing 33 servers in 27 countries and identifying thousands of users.

A phase of Operation Endgame in mid-to-late June targeted the SocGholish, Amadey, and StealC malware families, which can provide stolen credentials and initial access to ransomware operators. The operation also recovered tens of millions of stolen credentials.

US remains the top target

North America recorded 514 incidents, up from 480 in Q1. Europe followed with 316, up from 252. The US accounted for 431 incidents, 38% of the worldwide total.

Germany saw one of the sharper changes between quarters, with alleged incidents rising from 37 to 68. Manufacturing organizations made up 76% of Germany’s claimed victims.

Asia recorded 172 incidents, led by Taiwan and Thailand. South America recorded 64, the Middle East 44, Australia and New Zealand 19, and Africa 11.

“Organizations should assume that all internet-facing assets are discoverable and actively sought by adversaries, making continuous external attack surface management a necessity,” Dragos concluded.