Loading story…
Ransomware incidents in manufacturing environments can create a loss of operator visibility by encrypting the files that HMI, SCADA, and engineering workstations rely on to display and manage industrial processes. Trend Micro reported that attackers do not need to directly manipulate industrial control processes to cause major disruption; in one HMI-related case, 88% of encrypted files were image assets such as JPEG, BMP, and GIF files that were required for the interface to render properly.
The resulting outage aligns with MITRE ATT&CK ICS technique T0829 (Loss of View), in which operators lose remote visibility into the true state of operations and may be forced into local, manual intervention to restore monitoring or control. Beyond immediate production disruption, the attacks can also hit shared file repositories, engineering workflows, and supply chain systems, while modern ransomware groups increasingly add data theft and extortion, raising the risk of blackmail, resale of stolen information, and exposure of intellectual property and confidential supply chain data.
See attribution, scope, and your downstream exposure.
3 events from the most recent confirmed update back to the earliest known activity.
Trend Micro reported that ransomware can incapacitate industrial environments by encrypting HMI, SCADA, and engineering workstation support files rather than directly attacking ICS processes, and highlighted one HMI incident where 88% of encrypted files were image assets needed to render the interface.
MITRE published technique T0829 describing how adversaries can cause sustained or permanent loss of operator visibility in ICS environments, potentially forcing local manual intervention while concealing the true state of operations.
Trend Micro states that the Maze ransomware operation started a trend in which ransomware groups steal victim data in addition to encrypting files, using the threat of leaks or resale to increase pressure on victims.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware continues to pose a significant threat to the manufacturing and logistics industries, with attackers increasingly targeting these sectors due to their critical role in global supply chains. According to Black Kite's 2025 Manufacturing Research Report, manufacturing has been the top target for ransomware groups for four consecutive years, accounting for 22% of all reported attacks between April 2024 and March 2025. This equates to 1,314 attacks out of a total of 6,046, highlighting the persistent focus of cybercriminals on this sector. The report notes that while newer ransomware groups may favor smaller companies, large manufacturing enterprises remain highly attractive targets due to the potential for widespread operational disruption. Attackers are not acting indiscriminately; they deliberately target manufacturing because any interruption can have cascading effects throughout the supply chain. The evolution of ransomware tactics is also notable, with some groups shifting from traditional encryption-based extortion to pure data theft and extortion, and others leveraging artificial intelligence to enhance their attacks. The Dragos Industrial Ransomware Analysis for Q2 2025 corroborates these findings, emphasizing that manufacturing remains the most impacted sector. Companies are responding by strengthening their cybersecurity postures, particularly through improved patch management protocols and increased awareness of the threat landscape. The logistics sector has also been severely affected, as illustrated by the ransomware attack on Kantsu, a midsize Japanese logistics company. On September 12, 2024, Kantsu's internal network and all systems were locked by ransomware, halting shipping operations and cutting off communications both internally and externally. The attack rendered all company data unavailable, impacting over 500 partner companies and threatening the very survival of the business. Kantsu's experience underscores the importance of business resilience and the need for robust incident response plans. The company, which had invested in cloud-based warehouse management systems to streamline operations, found itself grappling with the operational and reputational fallout of the attack. The incident highlights the broader trend of ransomware groups targeting organizations whose operational continuity is vital to the functioning of other businesses. Both manufacturing and logistics companies are increasingly aware that their critical position in supply chains makes them prime targets for cybercriminals. As a result, there is a growing emphasis on proactive defense measures, including timely software updates, employee training, and the adoption of advanced security technologies. The ongoing battle between ransomware actors and these industries is driving innovation in both attack techniques and defensive strategies. The stakes are high, as successful attacks can disrupt not only individual companies but also the broader economy. The need for cross-sector collaboration and information sharing has never been greater, as organizations seek to stay ahead of evolving threats. Ultimately, the fight against ransomware in manufacturing and logistics is an escalating battle, with both sides adapting rapidly to new challenges and opportunities.
Jul 12, 2026
Dragos reported that ransomware incidents affecting industrial organizations rose to **1,140 publicly disclosed or leak-site-listed cases in Q2 2026**, up 12% from the prior quarter, with **manufacturing** accounting for 747 incidents. **Qilin, Akira, and The Gentlemen** were identified as the most active groups, while North America and Europe were the hardest-hit regions and the United States remained the most affected country. The report said attackers increasingly relied on **data-theft-only extortion** and commonly gained access through internet-facing edge devices, compromised credentials, remote management tools, and **Microsoft Teams impersonation of IT support**. The findings show that ransomware gangs often disrupted production **without reaching industrial control systems**, instead causing outages through compromised enterprise IT, ERP, and virtualization environments that support OT operations. Dragos said it observed no Q2 case in which an operator reached **Stage 2 of the ICS Cyber Kill Chain**, yet real-world impacts still included production stoppages and precautionary shutdowns at **West Pharmaceutical Services, Foxconn, and Mackay Sugar**. Huntress separately highlighted **Akira** activity involving data exfiltration, reinforcing the broader shift away from encryption-only attacks and toward extortion based on stolen data.
Aug 13, 2026
Manufacturing accounted for **22%** of publicly disclosed ransomware victims from April 2025 through March 2026, retaining its position as the most-targeted sector for a fifth consecutive year. Recorded incidents rose about 40% year over year to 1,183 in the first seven months of 2026, with European victims increasing 85.4% and Germany facing particular pressure. Attackers target manufacturers because production stoppages, delayed deliveries, and supply-chain disruption increase leverage in extortion negotiations; the Jaguar Land Rover incident and Clop’s exploitation of Cleo illustrate the potentially broad downstream impact. New and established ransomware-as-a-service operations are driving the increase. Qilin claimed the most victims during the reporting period, while SafePay focused heavily on German manufacturers and The Gentlemen expanded rapidly; in Japan, The Gentlemen led observed activity with 14 of 90 ransomware incidents from January through July, where manufacturing was also the most affected sector and 78% of victims were small and medium-sized organizations. Talos identified The Gentlemen infrastructure consistent with reconnaissance, Active Directory compromise, credential theft, lateral movement, backup theft, and exfiltration to Wasabi cloud storage, while Qilin-linked endpoint-wiping and Veeam-backup destruction scripts showed signs of likely LLM-assisted development.
Sep 18, 2026