Dragos Identifies 1,140 Industrial Ransomware Incidents in Q2 2026
Summary
Using public victim disclosures and ransomware-group leak-site posts, Dragos identified 1,140 industrial ransomware incidents in Q2 2026, up 12% from Q1. Manufacturing was hardest hit; extortion increasingly relied on data theft, while disruption largely stemmed from IT
Key points
- Dragos identified 1,140 incidents in Q2, a 12% increase from Q1, using publicly disclosed victim data and ransomware-group leak-site posts.
- Manufacturing accounted for 747 incidents; ICS-related organizations had 117 and transportation had 95.
- Dragos observed no case reaching Stage 2 of the ICS Cyber Kill Chain or directly manipulating control systems; disruption instead followed enterprise IT or virtualization outages and precautionary shutdowns.
- Reported access methods included exposed edge devices and VPNs, compromised credentials, remote-management tools, and social engineering through Microsoft Teams.
- Data-theft-only extortion continued to gain ground relative to encryption-based attacks.
- Qilin, Akira, and The Gentlemen led group claim volumes; DragonForce affiliates used Backdoor.Turn to route command-and-control through Microsoft Teams’ TURN relay infrastructure.
- Dragos recommends external attack-surface management, credential hygiene, MFA, and stricter controls on remote-management tools.
Article Details
- Publisher
- Dragos
- Report Period
- Q2 2026
- Scope
- Ransomware incidents affecting industrial organizations worldwide, based on public victim disclosures and ransomware-group Data Leak Site postings; includes sector, regional, threat-group, TTP, and operational-impact analysis.
- Sample Size
- 1,140 incidents identified from publicly disclosed victim data and ransomware-group Data Leak Site postings.
- Key Statistics
- Dragos identified 1,140 incidents in Q2 2026, a 12% increase from 1,020 in Q1.
- Manufacturing accounted for 747 incidents (65% of the total).
- The U.S. accounted for 431 incidents (38%); Germany's count rose from 37 in Q1 to 68 in Q2.
- Qilin had 140 claims, Akira 129, and The Gentlemen 125; these are group claims, not necessarily confirmed incidents.
- Dragos observed no Q2 case in which a ransomware operator reached Stage 2 of the ICS Cyber Kill Chain or directly manipulated a control system.
- Recommendations
- Use continuous external attack-surface management for internet-facing assets.
- Improve credential hygiene, enforce MFA, and apply strict policies to remote-management tooling.
- Monitor anomalous use of legitimate remote-access tools, unexpected screen-sharing sessions, and out-of-policy removable-media events.
- Prioritize capability- and behavior-based detection rather than relying on tracking individual ransomware brands.
MITRE ATT&CK
T1056.003 · Web Portal CaptureSome adversaries used organization-tailored credential-harvesting domains to capture credentials and MFA codes in real time.T1078 · Valid AccountsOperators used compromised credentials and abused valid accounts for access.T1102.002 · Bidirectional CommunicationA DragonForce affiliate used Microsoft Teams TURN relay infrastructure for command-and-control communications.T1133 · External Remote ServicesThe report describes initial access through compromised VPN devices and a legacy VPN account.T1190 · Exploit Public-Facing ApplicationRansomware affiliates exploited internet-facing edge devices and vulnerabilities in remote-access and management products to gain access.T1219 · Remote Access ToolsAdversaries used legitimate remote-monitoring and management tools for access and persistence.T1486 · Data Encrypted for ImpactRansomware operators deployed file-encrypting payloads against victims.T1490 · Inhibit System RecoveryAn Akira intrusion reconstruction described backup destruction before encryption.T1555.003 · Credentials from Web BrowsersQilin affiliates harvested credentials stored in browsers.T1562.001 · Disable or Modify ToolsQilin affiliates disabled endpoint security tools before ransomware deployment.T1566.004 · Spearphishing VoiceThe report describes voice-phishing activity, including the Silent Ransom Group's campaign against professional-services firms.T1567 · Exfiltration Over Web ServiceAkira operators exfiltrated data through legitimate file-sharing services.T1656 · ImpersonationAdversaries impersonated internal IT support on Microsoft Teams to induce employees to install tools or execute payloads.
CVE
Threat Actors
AkiraThe report identifies Akira as a leading operation targeting manufacturing and industrial services. It describes compromised VPN access, data exfiltration, credential theft, and backup destruction before encryption.chaosThe report describes both a conventional, financially motivated Chaos ransomware operation and separate activity using Chaos branding as cover for a state-sponsored espionage campaign; it cautions that the branding can obscure different actors and objectives.DragonForceThe report describes DragonForce affiliates using Backdoor.Turn for command-and-control through Microsoft Teams TURN relay infrastructure, exploiting a Huawei driver zero-day, and exploiting SimpleHelp vulnerabilities.MuddyWaterThe U.S. government links MuddyWater to Iran's Ministry of Intelligence and Security. Researchers reassessed a suspected Chaos-branded intrusion as likely MuddyWater activity involving credential theft, data exfiltration, account takeover, and persistence.QilinThe report identifies Qilin as the most active ransomware brand targeting industrial organizations in Q2. Affiliates used internet-facing infrastructure and compromised credentials, and were reported to disable endpoint security and harvest browser-stored credentials.Silent Ransom GroupThe FBI warned that Silent Ransom Group escalated social-engineering activity against professional-services firms, including impersonating IT technicians, visiting offices, inserting USB drives, and directly accessing machines. The report says Mandiant documented the same adversary completing data theft within a business day.StormousThe report says Stormous expanded its industrial victim claims from one in Q1 to 15 in Q2 and continued to list manufacturing victims across multiple regions. It describes the group's activity as combining hacktivist framing with extortion.The GentlemenThe report describes The Gentlemen as a growing ransomware operation that targeted industrial organizations, including Mackay Sugar, which the group claimed on its leak site. Leaked records reportedly showed data from one victim being reused to facilitate compromises of related organizations.UNC3753The report identifies UNC3753 as an open-source tracking name for Silent Ransom Group, which it describes as conducting social-engineering and data-theft activity.zeta88Leaked records reportedly identified zeta88 as an actor who managed The Gentlemen's affiliate platform and intrusion activity.
Malware
AmadeyA major phase of Operation Endgame, between 15 and 24 June, disrupted the SocGholish, Amadey, and StealC families that supply initial access and stolen credentials to ransomware operators, taking down hundreds ofBackdoor.TurnOne affiliate deployed Backdoor.Turn, a custom Go-based remote access trojan, which was identified as the first known malware to misuse Microsoft Teams’ TURN relay infrastructure for command-and-control communications.Edgecutioninitial access broker paired this Teams pretext with a forged software-update console to deploy the Edgecution browser backdoor, and the state-aligned MuddyWater used the same Teams approach to harvest credentialsSocGholishA major phase of Operation Endgame, between 15 and 24 June, disrupted the SocGholish, Amadey, and StealC families that supply initial access and stolen credentials to ransomware operators, taking down hundreds ofStealCA major phase of Operation Endgame, between 15 and 24 June, disrupted the SocGholish, Amadey, and StealC families that supply initial access and stolen credentials to ransomware operators, taking down hundreds of
Vendors
Check PointAffiliates primarily gained access via internet-facing infrastructure, including Palo Alto appliances, by exploiting a Check Point Remote Access VPN authentication-bypass vulnerability and compromised credentials.CiscoInitial access consistently targeted Fortinet FortiGate and Cisco edge devices, followed by a repeatable sequence of Active Directory reconnaissance, certificate abuse, and EDR evasion.FortinetInitial access consistently targeted Fortinet FortiGate and Cisco edge devices, followed by a repeatable sequence of Active Directory reconnaissance, certificate abuse, and EDR evasion.HuaweiThe same affiliate also exploited a zero-day vulnerability in a Huawei driver, while the group continued exploiting SimpleHelp vulnerabilities to gain access to managed service providers and, in some cases, theirMicrosoftMicrosoft’s disruption of the Fox Tempest malware-signing service removed one component of the affiliate ecosystem during the quarter but had little visible impact on Qilin’s overall activity, highlighting thePalo Alto NetworksAffiliates primarily gained access via internet-facing infrastructure, including Palo Alto appliances, by exploiting a Check Point Remote Access VPN authentication-bypass vulnerability and compromised credentials.
Products
AnyDeskthrough a screen-sharing session to install a Remote Monitoring and Management (RMM) tool, such as AnyDesk/QuickAssist, or to execute a delivered payload.Check Point Remote Access VPNAffiliates primarily gained access via internet-facing infrastructure, including Palo Alto appliances, by exploiting a Check Point Remote Access VPN authentication-bypass vulnerability and compromised credentials.ESXiThe group’s ransomware supports Windows, Linux, NAS, BSD, and ESXi environments.Fortinet FortiGateInitial access consistently targeted Fortinet FortiGate and Cisco edge devices, followed by a repeatable sequence of Active Directory reconnaissance, certificate abuse, and EDR evasion.Microsoft TeamsOne affiliate deployed Backdoor.Turn, a custom Go-based remote access trojan, which was identified as the first known malware to misuse Microsoft Teams’ TURN relay infrastructure for command-and-control communications.QuickAssista screen-sharing session to install a Remote Monitoring and Management (RMM) tool, such as AnyDesk/QuickAssist, or to execute a delivered payload.SimpleHelpalso exploited a zero-day vulnerability in a Huawei driver, while the group continued exploiting SimpleHelp vulnerabilities to gain access to managed service providers and, in some cases, their downstream
Countries
AustraliaOverview: Mackay Sugar, Australia’s second-largest raw sugar producer, disclosed a cybersecurity incident on 10 June that forced the shutdown of milling and cane haulage at two of its three Queensland mills.GermanyHowever, the country with the greatest increase from Q1 (37 incidents) to Q2 (68 incidents) was Germany.IranThe second was a state-sponsored espionage campaign in which MuddyWater, an adversary linked to Iran’s Ministry of Intelligence and Security (MOIS) by the U.S.South Africamultiple regions, including a Mexican pharmaceutical manufacturer and the Consumer Goods Council of South Africa.United StatesThe U.S. consistently ranks as the most impacted country by ransomware by a far margin (431 incidents in Q2, or 38% of all incidents).
Industries
ConstructionThe first was a conventional, financially motivated RaaS operation targeting sectors including construction, oil and gas, and manufacturing across North America.EnergyThe Middle East: Recorded 44 incidents primarily affecting the manufacturing and energy sectors.EngineeringChaos, MuddyWater, Stormous, and the Silent Ransom Group showed how ransomware branding, social engineering, and geopolitical motives are converging across industrial environments.Food and Beverage· Food and Beverage: 70 incidentsGovernmentgovernment, used the Chaos branding as a cover for credential theft and persistence activities unrelated to extortion.ManufacturingQ2 2026 saw 1,140 ransomware incidents targeting industrial organizations worldwide, with manufacturing, ICS-related organizations, and transportation most affected as attackers increasingly relied on enterprise ITMiningRenewable energy organizations (12 incidents) and mining organizations (15 incidents) were also impacted, indicating continued adversary interest in energy production and resource extraction environments.pharmaceuticalto 15 in Q2 and continued to list manufacturing victims across multiple regions, including a Mexican pharmaceutical manufacturer and the Consumer Goods Council of South Africa.Transportation and LogisticsTransportation and logistics ranked third with 95 incidents.