Manufacturing — Cyber Threat Activity

Manufacturing absorbs more ransomware than any other industrial sector, and our log reflects it: over 2,000 recorded incidents across 75 countries, more than 630 in the trailing 180 days. 102 groups have been attributed at least one claim, led by Akira (275), Qilin (273), Play (198), LockBit (107) and RansomHub (107). Dragos measured manufacturing at roughly two-thirds of all industrial ransomware incidents it tracked in early 2025, with construction, food and beverage, consumer goods and equipment the busiest subsectors and metals and chemicals far behind. The reason manufacturers are chosen is that they cannot wait. Encrypt the systems that schedule production and an assembly line stops earning within hours, which compresses the negotiation window in the attacker's favour. That pressure sits on top of flat networks, long-lived legacy controllers and IT-to-OT paths that were never designed to be adversarial. Attacks rarely need to touch control systems to halt production; disruption to enterprise IT cascades into the plant on its own. Manufacturing also carries a genuine espionage overlay that the extortion volume obscures. CrowdStrike has documented roughly ten adversary groups deliberately targeting the industry alongside the opportunists, mixing state-sponsored intellectual property theft with criminal extortion, and our own graph records 173 groups in total once profile-level research associations are included. Geography is broader here than in most sectors: the United States leads with 895 claims but Germany (145), Canada, the United Kingdom, Italy and India all carry meaningful volume, which is what a globally distributed supply chain looks like when it is attacked at the weakest link rather than the largest one.

All sectors

Recent incidents

Threat actors targeting Manufacturing

Where these victims are

Malware used against Manufacturing

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions