Ransomware gangs don’t need control system access to disrupt industrial production

Dragos reports that ransomware actors disrupted industrial production in Q2 2026 primarily by compromising enterprise IT infrastructure rather than accessing industrial control systems directly. With 1,140 recorded incidents, up 12% from the previous quarter, manufacturing was the hardest-hit sector, accounting for two-thirds of all cases. Threat groups such as Qilin, Akira, The Gentlemen, and Silent Ransom Group leveraged social engineering tactics, including impersonating IT support on Microsoft Teams to deploy remote access tools like AnyDesk and Quick Assist.