Nation-state actors are increasing attacks on manufacturing OT and ICS environments

Manufacturing organizations are facing a broader and more diverse threat landscape as nation-state espionage campaigns converge with financially motivated attacks, according to CYFIRMA’s latest industry report. Researchers observed manufacturing in 20 of 42 tracked APT campaigns during the past 90 days, involving the widest mix of China-linked groups seen across any industry alongside North Korean, Iranian, Russian and Pakistani threat actors. The report warns that attackers are increasingly targeting operating systems and host-level assets, underscoring growing exposure across OT (operational technology) and ICS (industrial control system) environments.

The manufacturing sector’s ransomware exposure remains entrenched despite only a marginal decline in victim numbers, with CYFIRMA identifying 279 verified victims over the past 90 days, or 12.48% of all ransomware victims globally. Researchers found activity has settled into a sustained elevated baseline after peaking in March, with 62% of tracked ransomware gangs targeting manufacturing organizations. Food and beverage production and machinery and heavy equipment manufacturers recorded the highest victim counts while the geographic spread of attacks expanded to 49 countries, signaling increasingly widespread targeting of industrial operations.

CYFIRMA’s analysis of observed attack campaigns is based on data collected through its Early Warning platform, which tracks known campaigns conducted by advanced persistent threat (APT) actors, including both nation-state and financially motivated groups. A single campaign may target multiple organizations across different countries and can remain active for weeks, months or even years. Campaigns are organized by the date they were last observed to highlight the most recent activity, which can result in a concentration of campaigns toward later dates in trend analyses. 

Read more at Industrial Cyber