Loading story…
Manufacturing accounted for 22% of publicly disclosed ransomware victims from April 2025 through March 2026, retaining its position as the most-targeted sector for a fifth consecutive year. Recorded incidents rose about 40% year over year to 1,183 in the first seven months of 2026, with European victims increasing 85.4% and Germany facing particular pressure. Attackers target manufacturers because production stoppages, delayed deliveries, and supply-chain disruption increase leverage in extortion negotiations; the Jaguar Land Rover incident and Clop’s exploitation of Cleo illustrate the potentially broad downstream impact.
New and established ransomware-as-a-service operations are driving the increase. Qilin claimed the most victims during the reporting period, while SafePay focused heavily on German manufacturers and The Gentlemen expanded rapidly; in Japan, The Gentlemen led observed activity with 14 of 90 ransomware incidents from January through July, where manufacturing was also the most affected sector and 78% of victims were small and medium-sized organizations. Talos identified The Gentlemen infrastructure consistent with reconnaissance, Active Directory compromise, credential theft, lateral movement, backup theft, and exfiltration to Wasabi cloud storage, while Qilin-linked endpoint-wiping and Veeam-backup destruction scripts showed signs of likely LLM-assisted development.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Black Kite published a report finding that manufacturing accounted for 22% of disclosed ransomware victims from April 2025 through March 2026 and remained the most targeted sector for a fifth consecutive year. It recorded 1,183 manufacturing incidents from January 1 to July 29, 2026, about 40% more than the equivalent 2025 period, with European victims rising 85.4%.
The Gentlemen's leak-site listings exceeded 100 organizations for the first time in June 2026, reaching 108 listings; its listings had numbered 48 in January.
Cisco Talos recorded 90 ransomware incidents affecting Japanese organizations from January through July 2026, up from 86 in the corresponding 2025 period. Manufacturing represented 34% of victims, and The Gentlemen was the most frequently observed group with 14 incidents.
Black Kite first observed The Gentlemen in September 2025. The group later became a significant contributor to ransomware activity targeting manufacturers.
Jaguar Land Rover shut down its UK plants throughout September 2025 following a cyberattack, halting production of roughly 1,000 luxury vehicles per day and disrupting more than 5,000 other companies in its supply chain.
The Gentlemen began operating as a ransomware-as-a-service group around July 2025, using double extortion against victims.
A Clop campaign targeting Cleo in January and February 2025 produced 52 disclosed distribution-sector victims and ultimately resulted in nearly 400 publicly disclosed victims.
Talos identified infrastructure associated with The Gentlemen containing reconnaissance, exploitation, Active Directory compromise, credential theft, backup theft, and Wasabi cloud exfiltration tooling; Russian-language artifacts suggested possible Russian-speaking operator involvement. Talos also found Qilin-associated wiping, backup-destruction, and ransomware-deployment Python scripts with characteristics suggesting likely LLM-assisted generation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcesecurityweek.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Italian organizations suffered **148 confirmed ransomware attacks** in the first half of 2026, with the **manufacturing sector** accounting for 59 victims and **Northwest Italy** representing 42.6% of affected organizations, according to the RedACT H1 2026 report. Threat actors claimed to have exfiltrated more than **13,400 GB** of data, though detailed volume disclosures were available in fewer than half of the incidents, underscoring both the scale of extortion activity and the limits of public reporting. The report found a fragmented ransomware landscape in which **30 different groups** claimed at least one victim, while **LockBit5** and **Qilin** were the most active, each naming 21 victims. A spike in June was driven in part by **Deadlock** and **Safepay**, and the most common intrusion paths were **reused credentials**, **unpatched public-facing systems**, and **exposed RDP**, indicating that many attacks relied on basic but persistent access weaknesses rather than sophisticated tradecraft.
Jul 31, 2026
Dragos reported that ransomware incidents affecting industrial organizations rose to **1,140 publicly disclosed or leak-site-listed cases in Q2 2026**, up 12% from the prior quarter, with **manufacturing** accounting for 747 incidents. **Qilin, Akira, and The Gentlemen** were identified as the most active groups, while North America and Europe were the hardest-hit regions and the United States remained the most affected country. The report said attackers increasingly relied on **data-theft-only extortion** and commonly gained access through internet-facing edge devices, compromised credentials, remote management tools, and **Microsoft Teams impersonation of IT support**. The findings show that ransomware gangs often disrupted production **without reaching industrial control systems**, instead causing outages through compromised enterprise IT, ERP, and virtualization environments that support OT operations. Dragos said it observed no Q2 case in which an operator reached **Stage 2 of the ICS Cyber Kill Chain**, yet real-world impacts still included production stoppages and precautionary shutdowns at **West Pharmaceutical Services, Foxconn, and Mackay Sugar**. Huntress separately highlighted **Akira** activity involving data exfiltration, reinforcing the broader shift away from encryption-only attacks and toward extortion based on stolen data.
Aug 13, 2026
Ransomware continues to pose a significant threat to the manufacturing and logistics industries, with attackers increasingly targeting these sectors due to their critical role in global supply chains. According to Black Kite's 2025 Manufacturing Research Report, manufacturing has been the top target for ransomware groups for four consecutive years, accounting for 22% of all reported attacks between April 2024 and March 2025. This equates to 1,314 attacks out of a total of 6,046, highlighting the persistent focus of cybercriminals on this sector. The report notes that while newer ransomware groups may favor smaller companies, large manufacturing enterprises remain highly attractive targets due to the potential for widespread operational disruption. Attackers are not acting indiscriminately; they deliberately target manufacturing because any interruption can have cascading effects throughout the supply chain. The evolution of ransomware tactics is also notable, with some groups shifting from traditional encryption-based extortion to pure data theft and extortion, and others leveraging artificial intelligence to enhance their attacks. The Dragos Industrial Ransomware Analysis for Q2 2025 corroborates these findings, emphasizing that manufacturing remains the most impacted sector. Companies are responding by strengthening their cybersecurity postures, particularly through improved patch management protocols and increased awareness of the threat landscape. The logistics sector has also been severely affected, as illustrated by the ransomware attack on Kantsu, a midsize Japanese logistics company. On September 12, 2024, Kantsu's internal network and all systems were locked by ransomware, halting shipping operations and cutting off communications both internally and externally. The attack rendered all company data unavailable, impacting over 500 partner companies and threatening the very survival of the business. Kantsu's experience underscores the importance of business resilience and the need for robust incident response plans. The company, which had invested in cloud-based warehouse management systems to streamline operations, found itself grappling with the operational and reputational fallout of the attack. The incident highlights the broader trend of ransomware groups targeting organizations whose operational continuity is vital to the functioning of other businesses. Both manufacturing and logistics companies are increasingly aware that their critical position in supply chains makes them prime targets for cybercriminals. As a result, there is a growing emphasis on proactive defense measures, including timely software updates, employee training, and the adoption of advanced security technologies. The ongoing battle between ransomware actors and these industries is driving innovation in both attack techniques and defensive strategies. The stakes are high, as successful attacks can disrupt not only individual companies but also the broader economy. The need for cross-sector collaboration and information sharing has never been greater, as organizations seek to stay ahead of evolving threats. Ultimately, the fight against ransomware in manufacturing and logistics is an escalating battle, with both sides adapting rapidly to new challenges and opportunities.
Jul 12, 2026