Dragos: ransomware hits 3,300 industrial organisations, mostly manufacturers

2026-02-17 · Publisher : Dragos · Domain : Industry 4.0 & 5.0

Dragos' annual OT cybersecurity report counts 3,300 industrial organisations hit by ransomware in 2025, over two-thirds of them manufacturers, 119 active groups versus 80 in 2024 and three new threat groups.

### Background On 17 February 2026, Dragos, an industrial control system cybersecurity specialist, published its annual "Year in Review" on threats to operational technology (OT). The finding: adversaries are moving from reconnaissance to actual operational disruption. ### Key features - **26 OT threat groups** tracked worldwide, 11 active in 2025 and **3 new**: SYLVANITE (initial access broker), AZURITE (long-term access and data theft), PYROXENE (supply chain and social engineering). - **119 ransomware groups** targeted industrial organisations, versus 80 in 2024. - **3,300 organisations** affected worldwide, **over two-thirds** in manufacturing. - Average ransomware dwell time in OT: **42 days**; about **5 days** for organisations with full OT visibility. - 25% of vulnerability scores contained errors, and only 2% of ICS vulnerabilities required immediate action. ### Why it matters Manufacturing is the top ransomware target in the industrial world. The report also shows that investing in OT network monitoring sharply shortens incidents. For an automation team, it argues for asset inventory, industrial traffic monitoring and patch prioritisation based on real exposure rather than CVSS scores alone. ### Key takeaway The factory has become ransomware's favourite target, and OT network visibility makes the difference between a few days and several weeks of crisis.

Tags : Cybersécurité OT, Rançongiciel, Menaces, Énergie