Loading story…
Recent reports highlight the increasing cybersecurity risks facing critical infrastructure and industrial sectors, with a particular focus on manufacturing and maritime operations. In manufacturing, attackers are shifting tactics, with a Sophos survey revealing that exploited vulnerabilities and malicious emails remain primary entry points. While the rate of ransomware attacks resulting in data encryption has decreased, there is a notable rise in data theft and extortion, with attackers leveraging the threat of disclosure rather than just encryption. The financial and operational impact remains severe, with median ransom payments reaching $1 million and average recovery costs at $1.3 million, underscoring the need for layered defenses and continuous visibility.
In the maritime sector, vulnerabilities in port infrastructure pose significant risks to supply chains and national security. The example of the Orange Star vessel at Port Elizabeth illustrates how a single cyber incident could disrupt the supply of essential goods to millions. The expiration of the Cybersecurity Information Sharing Act and recent ransomware attacks, such as the one at the Port of Seattle, have exacerbated concerns. New regulatory requirements are prompting some ports to enhance their cybersecurity posture, but many facilities remain underprepared, creating a "perfect storm of vulnerability" that could be exploited by nation-state actors with pre-positioned malware.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
Sophos released a report based on a global survey of 332 IT and security leaders, finding that manufacturing ransomware attacks increasingly exploit vulnerabilities and malicious emails while data theft and extortion without encryption are rising.
New Title 33 CFR cybersecurity regulations were introduced requiring roughly 3,000 MTSA-regulated facilities to designate cybersecurity officers, marking a significant regulatory response to maritime cyber risk.
In late 2024, the Port of Seattle suffered a ransomware attack, underscoring the growing cyber risk facing port infrastructure and maritime supply chains.
In 2023, a LockBit ransomware incident affected the Port of Nagoya in Japan, demonstrating the potential for cyberattacks to disrupt major maritime logistics and supply chains.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The rapid expansion of digital connectivity in sectors such as space, automotive, and logistics is exposing critical infrastructure to new and evolving cyber threats. In the space sector, the lack of a comprehensive international cybersecurity framework leaves satellites, orbital systems, and ground-to-space communications vulnerable to exploitation, with the number of active satellites projected to increase dramatically. Similarly, the automotive industry faces heightened risks as vehicles become increasingly software-driven and connected to cloud services, necessitating compliance with global standards like UN R155 and ISO/SAE 21434 to ensure resilience against modern cyberattacks. Logistics and freight operations are also under significant threat, with cyberattacks in the transportation sector rising sharply and resulting in substantial financial and reputational damage. Human error remains a major vulnerability, and small to medium-sized operators are particularly at risk, with many unable to recover from a serious breach. Across these sectors, the integration of cybersecurity into every stage of production and operation is becoming essential to maintain operational continuity and meet regulatory requirements, as highlighted by recent industry reports and regulatory developments.
Jun 29, 2026
Ransomware continues to pose a significant threat to the manufacturing and logistics industries, with attackers increasingly targeting these sectors due to their critical role in global supply chains. According to Black Kite's 2025 Manufacturing Research Report, manufacturing has been the top target for ransomware groups for four consecutive years, accounting for 22% of all reported attacks between April 2024 and March 2025. This equates to 1,314 attacks out of a total of 6,046, highlighting the persistent focus of cybercriminals on this sector. The report notes that while newer ransomware groups may favor smaller companies, large manufacturing enterprises remain highly attractive targets due to the potential for widespread operational disruption. Attackers are not acting indiscriminately; they deliberately target manufacturing because any interruption can have cascading effects throughout the supply chain. The evolution of ransomware tactics is also notable, with some groups shifting from traditional encryption-based extortion to pure data theft and extortion, and others leveraging artificial intelligence to enhance their attacks. The Dragos Industrial Ransomware Analysis for Q2 2025 corroborates these findings, emphasizing that manufacturing remains the most impacted sector. Companies are responding by strengthening their cybersecurity postures, particularly through improved patch management protocols and increased awareness of the threat landscape. The logistics sector has also been severely affected, as illustrated by the ransomware attack on Kantsu, a midsize Japanese logistics company. On September 12, 2024, Kantsu's internal network and all systems were locked by ransomware, halting shipping operations and cutting off communications both internally and externally. The attack rendered all company data unavailable, impacting over 500 partner companies and threatening the very survival of the business. Kantsu's experience underscores the importance of business resilience and the need for robust incident response plans. The company, which had invested in cloud-based warehouse management systems to streamline operations, found itself grappling with the operational and reputational fallout of the attack. The incident highlights the broader trend of ransomware groups targeting organizations whose operational continuity is vital to the functioning of other businesses. Both manufacturing and logistics companies are increasingly aware that their critical position in supply chains makes them prime targets for cybercriminals. As a result, there is a growing emphasis on proactive defense measures, including timely software updates, employee training, and the adoption of advanced security technologies. The ongoing battle between ransomware actors and these industries is driving innovation in both attack techniques and defensive strategies. The stakes are high, as successful attacks can disrupt not only individual companies but also the broader economy. The need for cross-sector collaboration and information sharing has never been greater, as organizations seek to stay ahead of evolving threats. Ultimately, the fight against ransomware in manufacturing and logistics is an escalating battle, with both sides adapting rapidly to new challenges and opportunities.
Jul 12, 2026
Manufacturers have become the primary target for cyberattacks in 2025, with over half experiencing ransomware incidents and paying significant ransoms, according to industry data. The average ransom payment reached $1 million, and recovery costs excluding ransom approached $1.3 million, highlighting the severe financial impact on the sector. The most common root cause of compromises shifted to exploited vulnerabilities, overtaking malicious emails and compromised credentials from previous years. Experts attribute the sector's vulnerability to a lack of security expertise, unaddressed cybersecurity gaps, and insufficient adoption of protective measures, making operational disruptions both likely and costly. The broader threat landscape in November 2025 was marked by a surge in data theft and ransomware attacks across multiple industries, with high-profile victims including major airlines, media organizations, universities, and healthcare providers. The Cl0p ransomware syndicate alone claimed responsibility for attacks on over 29 organizations, contributing to a global trend of increasing data breaches and extortion. Regulatory and legal pressures are intensifying, raising the stakes for organizations that fail to protect sensitive data. These developments underscore the urgent need for improved cybersecurity maturity, regular incident response testing, and proactive vulnerability management to mitigate the growing risks.
Jun 29, 2026