Technology — Cyber Threat Activity

Technology is attacked twice over: once for its own data, and once as the shortest path into everyone else's. Our log records more than 1,650 incidents across 89 countries, over 480 in the trailing 180 days, with 98 groups attributed at least one claim. Qilin (167), Cl0p (146), RansomHub (126), LockBit (110) and Akira (109) lead. Cl0p's position is the sector's defining pattern: rather than intruding one victim at a time, it has repeatedly mass-exploited a single widely deployed file transfer or managed service product and harvested every customer behind it, turning one vulnerability into hundreds of downstream victims across unrelated industries. That is why technology claims cluster in bursts rather than arriving at a steady rate. The state-sponsored interest is equally real and less visible. CISA and allied agencies attributed a sustained campaign by Russian military intelligence against Western technology companies alongside logistics firms, pursued for the access and visibility those companies hold rather than for extortion. Our graph carries 372 groups associated with the sector in total once profile-level research is counted, the second-highest of any sector here, and the malware families linked through those actors number in the hundreds. Recorded geography is the widest we hold, with the United States at 661 claims followed by Germany, Canada, the United Kingdom, India and France. The practical reading for a technology company is that its own breach is rarely the end of the incident. Source code, signing certificates, build pipelines and customer tenancy are all leverage against a customer base, and the sector's incidents should be assessed for what they enable next, not only for what was taken.

All sectors

Recent incidents

Threat actors targeting Technology

Where these victims are

Malware used against Technology

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions