Q2 2026 saw 1,140 ransomware incidents targeting industrial organizations worldwide, with manufacturing, ICS-related organizations, and transportation most affected as attackers increasingly relied on enterprise IT disruption and data theft-only extortion. Qilin, Akira, The Gentlemen, and DragonForce drove much of the activity, while cases involving Chaos, MuddyWater, Stormous, and the Silent Ransom Group showed how ransomware branding, social engineering, and geopolitical motives are converging across industrial environments. #Qilin #Akira #TheGentlemen #DragonForce #Chaos #MuddyWater #Stormous #SilentRansomGroup
Keypoints
- Industrial ransomware incidents rose to 1,140 in Q2 2026, a 12% increase from Q1.
- Manufacturing remained the most targeted sector, followed by ICS-related organizations and transportation.
- Attackers mainly used edge devices, VPNs, compromised credentials, and remote management tools for initial access.
- Ransomware operators increasingly favored data theft-only extortion over encryption-based attacks.
- Qilin, Akira, The Gentlemen, and DragonForce accounted for a large share of industrial ransomware activity.
Read More: https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2026