There was a significant increase in ransomware attacks on industrial organizations in the second quarter of 2024 compared to the previous quarter, according to industrial cybersecurity firm Dragos.
The company’s Industrial Ransomware Analysis Report for Q2 2024 shows that 29 of the 86 ransomware groups known to target industrial organizations were still active in the second quarter, an increase from the 22 groups observed launching attacks in the first quarter.
In Q1 2024, there was a drop in attacks, both in terms of volume and impact, following law enforcement crackdowns on major ransomware operations such as BlackCat and LockBit.
However, the number of attacks nearly doubled in Q2 compared to Q1 — from 169 incidents to 312 incidents — with these and other groups adapting and ‘recalibrating’ their strategies.
Dragos pointed out that the Royal ransomware group rebranded to BlackSuit, and the Knight group has become RansomHub. Both gangs emerged with updated tactics and techniques.
A majority of the ransomware attacks observed by Dragos targeted industrial organizations in the United States and Europe, and the manufacturing sector continues to be the most targeted.
LockBit was behind the highest percentage of attacks (66 incidents), followed at a distance by Play (31 incidents), BlackBasta (27 incidents), 8Base (22 incidents), and Akira and BlackSuit (both with 20 incidents each).
It’s worth noting that some have questioned LockBit’s resurgence, pointing out that the hackers may have inflated their numbers in the second quarter to downplay the impact of the law enforcement operation.
“While Dragos did not identify any ransomware attacks targeting industrial control systems (ICS) or operational technology (OT) processes, ransomware groups have disrupted the IT systems of industrial organizations. Disruptions to OT networks have occurred, primarily due to the interdependencies between OT and IT systems,” Dragos noted.
The company “assesses with moderate confidence that the ransomware threat landscape will continue to evolve, characterized by the introduction of new ransomware variants and increasingly coordinated campaigns targeting industrial sectors. Despite significant law enforcement actions, the observed resilience and adaptability of ransomware groups indicate a likely continuation of this trend.”
Learn More at SecurityWeek’s ICS Cybersecurity Conference
The leading global conference series for Operations, Control Systems and OT/IT Security professionals to connect on SCADA, DCS PLC and field controller cybersecurity.
October 21-24, 2024 | Atlanta
www.icscybersecurityconference.com
Related: Over 40,000 Internet-Exposed ICS Devices Found in US: Censys
Related: Ransomware Attacks on Industrial Orgs Increasingly Impact OT Systems: Survey
Related: Cybersecurity Experts Cast Doubt on Hackers’ ICS Ransomware Claims
