Report: Energy Sector Faced 187 Ransomware Attacks in 2025
Summary
Cyble’s 2025 energy and utilities threat landscape report records 187 ransomware attacks and highlights legacy OT, IT/OT convergence, access brokers and slow patching. It recommends segmentation, faster patching, market monitoring and offline backups.
Key points
- The report records 187 ransomware attacks in the energy and utilities sector in 2025, involving encryption and data exfiltration.
- RansomHub led the reported groups with 24 attacks, followed by Akira with 20 and Play with 18.
- For July 2024–June 2025, the article reports 37 underground sales of compromised network access, 57 data breaches and more than 39,000 hacktivist posts targeting energy infrastructure.
- Zerosevengroup, mommy and Miyako were responsible for about 27% of observed access sales targeting the sector, according to the report.
- The article identifies legacy OT, IT/OT connectivity and distributed infrastructure as risks; it says average remediation exceeded 21 days while vulnerabilities could be weaponized within 72 hours.
- Recommended defenses include separating IT and OT networks, monitoring criminal markets, faster patching, offline backups and incident preparedness.
Article Details
- Publisher
- The Cyber Express; cites the Cyble Energy & Utilities Threat Landscape Report 2025
- Report Period
- July 2024–June 2025; ransomware incident totals also cover calendar year 2025
- Scope
- Global energy and utilities sector cyber threats, including ransomware, access sales, data breaches, and hacktivism
- Key Statistics
- The article reports 187 confirmed ransomware attacks against the energy and utilities sector during 2025.
- For July 2024–June 2025, it reports 37 instances of compromised network access being sold, 57 data breaches, and over 39,000 hacktivist posts targeting energy infrastructure.
- RansomHub accounted for 24 attacks (12.8%), Akira for 20 (10.7%), and Play for 18 (9.6%).
- Zerosevengroup, mommy, and Miyako were reportedly responsible for approximately 27% of observed access sales targeting the energy sector.
- Average remediation time exceeded 21 days, while attackers reportedly weaponized vulnerabilities within 72 hours.
- Recommendations
- Separate IT and OT environments through network segmentation; apply strict access controls and monitoring where connections are necessary.
- Monitor underground forums for credentials being sold.
- Reduce patching timelines, including for OT systems where updates are complex.
- Maintain offline backups, prepare to isolate compromised systems, and ensure the ability to operate manually.
Threat Actors
AkiraIdentified among the most active ransomware groups in the energy sector in 2025, with 20 reported incidents.Golden Falcon TeamClaimed access to a French wastewater platform, including controls over pH levels and water distribution; the claim is not independently confirmed in the article.miyakoIdentified as an initial access broker; together with Zerosevengroup and mommy, it was reportedly responsible for approximately 27% of observed access sales targeting the energy sector.mommyIdentified as an initial access broker; together with Zerosevengroup and Miyako, it was reportedly responsible for approximately 27% of observed access sales targeting the energy sector.PlayIdentified among the most active ransomware groups in the energy sector in 2025, with 18 reported attacks.QilinNamed among the ransomware groups that, alongside RansomHub, Akira, Play, and Hunters/Lynx, accounted for nearly half of recorded sector ransomware activity.RansomHubIdentified as a leading ransomware group in the energy sector in 2025, with 24 reported attacks.Sector 16A pro-Russian group reportedly demonstrated access to U.S. oil and gas control systems, including shutdown interfaces and valve controls.ZerosevengroupIdentified as an initial access broker selling network access; it reportedly offered administrator-level access to a UAE-based power and water company in March 2025.
Malware
Vendors
Products
Countries
UAEIn March 2025, Zerosevengroup reportedly offered admin-level access to a UAE-based power and water company, claiming control over 5,000 network hosts.UkraineIn another case, attackers deploying FrostyGoop malware targeted a municipal energy provider in Ukraine, cutting off heating in Lviv during freezing temperatures.United StatesFor example, a pro-Russian group known as Sector 16 reportedly demonstrated access to U.S.
Industries
EnergyRansomware attacks against the global energy sector surged in 2025, with 187 confirmed incidents causing system encryption, data theft, operational disruptions, and multimillion-dollar losses.UtilitiesThere were 187 confirmed ransomware attacks in the energy and utilities sector during 2025, causing encryption, data exfiltration, and service disruption.