Industrial cybersecurity firm Dragos disclosed that ransomware activity stayed elevated in the second quarter of 2025, shaped by the emergence of new groups, rebranding of existing outfits, and the growing role of IABs (initial access brokers) and social engineering tactics. Geopolitical flashpoints added fuel, with the Israel-Iran conflict prompting hacktivist personas to use ransomware as a tool of disruption and Iranian-linked operators luring affiliates with higher payouts for strikes against U.S. and Israeli targets.
Between April and June, Dragos tracked 657 ransomware incidents affecting industrial organizations worldwide, down slightly from 708 in the previous quarter. North America was the most targeted region in the first quarter with 413 incidents and remained the top-impacted region in the second quarter with 355 incidents. While the overall number of incidents declined, three regions recorded increases. Europe saw the largest jump, rising from 135 incidents in the first quarter to 173 in the second. The Middle East followed, with attacks climbing from 11 to 17 over the same period. Africa registered the smallest uptick, increasing from three incidents in the first quarter to five in the second.
Looking ahead, Abdulrahman H. Alamri and Lexie Mooney, Dragos executives, detailed in a blog post that ransomware threats are poised to evolve rapidly, driven by increasingly sophisticated operational capabilities and strategic shifts. Industrial and critical infrastructure organizations are likely to face intensified targeting as attackers make greater use of AI-driven phishing, malware evasion, and automated reconnaissance, which heighten the sophistication of attacks and narrow detection windows.
At the same time, campaigns are becoming more targeted and selective, often blending financial extortion with operational disruption. Geopolitical tensions are expected to further influence this trend, with threat groups and hacktivist personas aligning their operations with political objectives.
They added that vulnerabilities in interconnected IT and OT environments will continue to provide critical entry points, particularly through supply chain compromises and remote access pathways. The ransomware ecosystem itself is also fragmenting, with new and rebranded groups adopting double and even triple-extortion tactics that combine encryption, data theft, and destructive wiper capabilities.
Dragos identified that manufacturing continued to be the most impacted sector, accounting for 65% of incidents recorded in the second quarter. The top manufacturing subsector impacted by ransomware was construction, accounting for 110 of the 428 manufacturing incidents in the second quarter, while the electric sector saw a decrease in incidents from the first quarter (15 incidents) to three incidents in the second quarter. The mining sector experienced 11 incidents in the second quarter, up from two incidents in the first quarter of this year and four incidents in the last quarter of 2024.
The RansomHub group dominated the ransomware landscape in 2024 and was one of the top three ransomware operations that impacted industrial organizations throughout 2024, alongside LockBit3.0 and Play. RansomHub was responsible for a mere five incidents in the second quarter, with no known victims since April 2025. Qilin was the most active group in the second quarter with 101 incidents. CL0P ransomware accounted for 154 incidents in the first quarter and only three attacks in the first quarter. CL0P’s dramatic surge in the first quarter was driven by exploiting Cleo Managed File Transfer vulnerabilities (CVE-2024-50623, CVE-2024-55956), heavily impacting both manufacturing and supply chains.
During the second quarter of 2025, several new ransomware groups emerged, significantly escalating threats to industrial and enterprise organizations. These groups introduced innovative and adaptive tactics, techniques, and procedures, creating complex new defensive challenges for cybersecurity teams. Among the newly identified groups impacting industrial sectors were Gunra, Dire Wolf, Kraken, Silent, Anubis, BERT, Chaos, Crypto24, IMN Crew, Kawa4096, Underground, and Warlock.
Qilin set itself apart from other ransomware groups by evolving into a highly sophisticated, state-aligned threat actor during this period. With legacy ecosystems like LockBit and RansomHub destabilized, Qilin moved quickly to consolidate its influence, aggressively recruiting displaced, skilled affiliates and ultimately accounting for about 19 percent of ransomware incidents affecting industrial organizations during the quarter. It also elevated the professionalization of the ransomware-as-a-service (RaaS) model.
On the technical front, Qilin systematically exploited critical vulnerabilities in widely deployed Fortinet products using automated tooling. This approach enabled rapid initial access, efficient privilege escalation, and deep penetration into victim networks.
The group’s trajectory took on greater geopolitical significance in March 2025, when North Korea’s state-sponsored Moonstone Sleet adopted Qilin ransomware for operational use. The move underscored a shift beyond financial gain toward influence operations. Qilin’s activity spiked sharply as a result, climbing from 21 ransomware incidents in the first quarter to 101 in the second. This marked escalation highlights both the scale of its ambitions and its growing status as one of the most consequential threats to industrial sectors.
Alamri and Mooney identified that Anubis is an emerging RaaS operation that advertises attractive monetization strategies and combines file encryption with file destruction. “Combining RaaS with added monetization strategies, such as data ransomware and access monetization affiliate programs, Anubis is maximizing its revenue, potentially expanding its reach within the cybercriminal ecosystem. What further sets Anubis apart from other RaaS is that the ransomware has an optional wipe mode. This suggests Anubis can apply additional pressure to their victims during ransomware negotiations or even delete the files once the ransom is paid.”
They identified that the group has claimed attacks against a range of industries, including healthcare, engineering, and construction, across multiple regions, with two attacks against industrial organizations in the second quarter of this year.
“Groups like Eldorado and Play have previously developed Linux lockers specifically to target VMware ESXi environments. These lockers encrypt critical virtual machine files while disabling active VMs, disrupting business operations with minimal pre-encryption dwell time,” according to Alamri and Mooney. “Other ransomware operations have followed suit, creating tailored ransomware to disrupt ESXi environments.”
In April 2025, a new ransomware variant called BERT emerged with the built-in ability to forcibly shut down ESXi virtual machines to maximize impact and disrupt recovery efforts. “While BERT only accounted for 4 attacks on industrial organizations in Q2, this demonstrates a persistent effort by multiple ransomware operations to tailor attacks against virtual environments.”
During this quarter, Dragos observed an increase in IAB activities, including the use of an attack pattern first reported by Microsoft in May 2024 in connection with the threat group designated Storm-1811. In this pattern, the attacker uses ‘email bombing’ to overload a targeted organization’s employee with unwanted emails, and then makes a voice or video call over Microsoft Teams posing as a tech support team member to deceive that employee into allowing remote access to their computer.
Affiliates of the Three AM ransomware group modified this attack pattern to use phone calls to spoof the phone number of the targeted organization’s IT departments. One reported attack included the deployment of a virtual machine to a compromised computer, providing the ransomware operators with an initial foothold hidden from the view of endpoint protection software. Organizations should educate staff on the exact ways IT support will contact them and which tools they will use to provide remote technical support, so they can recognize social engineering efforts.
In the second quarter, ransomware attacks continued to cause significant disruptions to industrial organizations, severely impacting operations, data integrity, and supply chains. In April, Nova Scotia Power was hit by a ransomware attack that disrupted communication between power meters and billing systems, forcing manual readings and exposing customer data.
On May 6, Masimo Corporation reported unauthorized network activity that reduced manufacturing capacity and delayed order fulfillment. A week later, on May 13, Nucor Corporation halted production after attackers exfiltrated data from its IT systems. By June 9, United Natural Foods was forced offline by a cyberattack that crippled ordering and invoicing systems, causing widespread delays in customer orders.
Dragos reported that during the period, ransomware incidents underscored the diverse and pervasive nature of the threat landscape, continuing to affect numerous geographic regions and industry sectors. Manufacturing, transportation, and ICS (industrial control systems) equipment and engineering remained consistently impacted sectors.
North America continued to experience the highest frequency of attacks, accounting for more than half of all global ransomware activity impacting industrial organizations. It recorded 355 incidents in the second quarter, maintaining its position as the most impacted region and accounting for approximately 54 percent of global ransomware activity. The U.S. and Canada continued to be the main targets, with attacks concentrated on manufacturing, transportation, ICS equipment, and engineering firms.
In Europe, incidents rose to 173 in the second quarter, accounting for about 26 percent of global ransomware activity, up from 135 incidents, or 19 percent, in the first quarter. Across Europe, the U.K., Germany, and Italy were the most affected countries, with ransomware activity concentrated in manufacturing, transportation, and engineering ICS sectors. Asia documented 59 incidents, comprising about 9 percent of global activity, with India and Japan most frequently targeted, particularly in transportation, manufacturing, and telecommunications.
South America experienced 38 incidents, or about 6 percent of global ransomware cases, with Brazil most heavily impacted, primarily in transportation and manufacturing. The Middle East reported 17 incidents, representing nearly 3 percent of global activity, with the UAE and Saudi Arabia most affected in the oil and gas and manufacturing sectors.
Oceania observed 10 incidents, accounting for roughly 1.5 percent of global activity, with Australia the primary target in manufacturing, ICS, and oil and gas. Africa recorded five incidents, comprising less than 1 percent of global activity, with South Africa the most impacted, underscoring ongoing risks to industrial infrastructure despite limited reporting.
“To effectively manage these evolving risks, industrial organizations must adopt a strong, proactive cybersecurity posture,” according to Alamri and Mooney. “Prioritizing a zero-trust approach, implementing rigorous vulnerability management practices, enhancing detection capabilities with AI-driven tools, and ensuring segmented, resilient networks will be essential.”
They added that strengthening employee training to recognize and counter sophisticated social engineering attempts, maintaining secure offline backups, and regularly conducting incident response simulations will enhance organizational preparedness. “Active collaboration through timely threat intelligence sharing and adherence to best-practice guidelines will further reinforce resilience against future ransomware threats. By strategically preparing for increasingly selective, impactful ransomware incidents, organizations can mitigate operational disruption risks, safeguard critical assets, and maintain resilience in the face of an ever-evolving threat landscape.”
