Construction — Cyber Threat Activity

Construction is a pure volume target, and the pattern in our log is unusually clean: more than 450 recorded incidents across 45 countries, over 180 in the trailing 180 days, and every one of the 51 attributed groups is a ransomware or extortion crew. Qilin (98), Akira (85), Play (63), DragonForce (45) and SafePay (21) lead. There is no espionage story here and the data does not pretend otherwise; zero malware families are linked to the sector through our actor graph and only 9 groups carry a profile-level research association against 51 attributed through incidents. What makes construction attractive is structural rather than strategic. Firms are asset-rich and margin-thin, project delivery is bound by contractual completion dates and liquidated damages, and the industry runs on a sprawl of subcontractors, joint ventures and shared project systems that dissolves any clean network boundary. Design documents, tender pricing and payment instructions all sit in the same accessible places, which is why construction suffers invoice and payment diversion fraud alongside encryption. Dragos placed construction at the top of its industrial ransomware subsector breakdown in early 2025, ahead of food and beverage and consumer goods, which matches what we record. Recorded geography is United States-led at 260 claims, then the United Kingdom, Canada, Australia, Germany and France. These totals are attacker claims posted to extortion sites rather than confirmed breaches. For defenders the useful conclusion is that construction is chosen for being reachable rather than for being valuable, so the controls that matter are the generic ones done properly: multi-factor authentication on remote access, patched edge devices, and offline backups of project data.

All sectors

Recent incidents

Threat actors targeting Construction

Where these victims are

Malware used against Construction

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 94.9% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions