ReliaQuest Reports Rising Ransomware and Vulnerability Threats to Manufacturers
Summary
ReliaQuest says manufacturers were named in 563 ransomware attacks in the latest quarter, up 71% quarter over quarter. It also reports more exploited vulnerabilities and identity attacks, and recommends stronger exposure, identity and response controls.
Key points
- ReliaQuest reports manufacturers were named in 563 ransomware attacks in the latest quarter, a 71% increase from the previous quarter.
- The company observed 109 newly exploited vulnerabilities, up from 62 in the prior quarter, and said same-day exploitation nearly doubled.
- Password spraying, brute force, and exploitation of public-facing applications gained share during Q3 2026, while phishing remained a factor.
- Impersonating domains and subdomains accounted for 74% of DRP alerts for manufacturing customers, according to ReliaQuest.
- ReliaQuest recommends prioritizing exposed systems, enforcing phishing-resistant MFA, monitoring external threats, and restricting unapproved remote-access and data-transfer tools.
- Reported average containment time improved from 2 hours 11 minutes to 1 hour 56 minutes; organizations using Automated Response Playbooks averaged 6 minutes, the article says.
Article Details
- Publisher
- ReliaQuest
- Report Period
- Q3 2026
- Scope
- Manufacturing-sector ransomware activity, vulnerability exploitation, external risk, and security operations.
- Key Statistics
- Manufacturing organizations were named in 563 ransomware attacks, a 71% increase from the previous quarter.
- 109 newly exploited vulnerabilities were observed, up from 62 in the previous quarter; same-day exploitation nearly doubled.
- Impersonating domains and subdomains accounted for 74% of DRP alerts for manufacturing customers.
- Mean time to contain improved from 2 hours 11 minutes to 1 hour 56 minutes; organizations using Automated Response Playbooks averaged 6 minutes.
- Recommendations
- Prioritize internet-facing VPNs, firewalls, SD-WAN management, remote-access portals, and collaboration tools for exposure reduction and risk-based patching; restrict public access where possible.
- Enforce phishing-resistant MFA, especially for administrators, remote access, and third-party users, and monitor for password spraying, brute force, unusual device registration, and session behavior.
- Restrict or block unapproved use of AnyDesk and rclone; enable rapid session termination or system isolation.
- Monitor for impersonating domains, exposed credentials, open ports, and expired certificates.
- Automate safe containment actions, but route actions that could affect OT to a human analyst with the investigation attached.
MITRE ATT&CK
T1078 · Valid AccountsThe article describes attackers using valid credentials to blend into normal activity and move through trusted systems.T1110 · Brute ForceBrute force is explicitly identified as an attack method gaining share during Q3 2026.T1110.003 · Password SprayingPassword spraying is explicitly identified as an attack method gaining share during Q3 2026.T1190 · Exploit Public-Facing ApplicationExploitation of public-facing applications is explicitly identified as an attack method gaining share during Q3 2026.T1219 · Remote Access ToolsThe article says attackers leverage AnyDesk for hands-on-keyboard activity.T1566 · PhishingPhishing is described as a factor in attacks against manufacturing organizations.
Threat Actors
AkiraNamed as a ransomware group showing elevated interest in manufacturing in the latest reporting period.QilinNamed as a ransomware group showing elevated interest in manufacturing in the latest reporting period.The GentlemenNamed as a ransomware group showing elevated interest in manufacturing in the latest reporting period.
Products
Tools
AnyDeskControl remote-access and data-transfer tools: Restrict or block unapproved use of tools like AnyDesk and rclone, which attackers leverage for hands-on-keyboard activity and data theft.RCloneControl remote-access and data-transfer tools: Restrict or block unapproved use of tools like AnyDesk and rclone, which attackers leverage for hands-on-keyboard activity and data theft.