Ransomware Attacks on Industrial Organizations Surge in 2024, Dragos Report Reveals Industrial cybersecurity firm Dragos has identified a sharp escalation in ransomware attacks targeting industrial organizations in 2024, with 1,693 entities found to have sensitive data exposed on ransomware groups’ leak sites. The firm’s OTICS Cybersecurity Report documents an 87% year-over-year increase in ransomware incidents against industrial sectors, alongside a 60% rise in attacks affecting operational technology (OT) and industrial control systems (ICS). Manufacturing bore the brunt of the assault, accounting for 69% of all attacks 1,171 incidents across 26 subsectors. The second half of 2024 saw ransomware activity more than double compared to the first two quarters, though the reasons for the surge remain unclear. While Dragos did not observe ICS-specific ransomware variants, attackers disrupted production lines, compromised supply chains, and exfiltrated data for follow-on malicious activity. Many ransomware operators appeared to prioritize victims with low tolerance for downtime, exploiting OT environments to pressure faster payments. Key Threat Actors and Tactics The most active ransomware groups targeting industrial organizations included RansomHub, Fog, and LockBit3.0. RansomHub, which emerged in February 2024, rapidly expanded by absorbing affiliates from defunct groups like Cyclops and Knight, claiming over 300 victims across critical infrastructure. Fog targeted vulnerable remote services, while LockBit3.0 persisted despite a February 2024 law enforcement disruption (Operation Cronos). Geopolitical tensions amplified the threat landscape, with hacktivist groups increasingly adopting ransomware tactics. Notable actors included Handala, Kill Security, and CyberVolk, which blended ideological motives with financial extortion. Dragos also noted a rise in opportunistic attacks leveraging remote tools, such as VPN exploits and exposed RDP sessions, with 65% of assessed sites exhibiting insecure remote access conditions including default credentials and unpatched systems. Regional and Sectoral Impact North America suffered the highest concentration of attacks (984 incidents, 58% of the total), followed by Europe (419 incidents, 25%). Manufacturing remained the top target due to its vulnerability to downtime, but energy, transportation, and ICS vendors also faced significant threats. Dragos tracked nearly 80 ransomware groups in 2024 a 60% increase from 2023 with attacks averaging 34 industrial victims per week in the first half of the year, doubling in the second half. Vulnerability Management Challenges The report highlighted persistent gaps in OT security, including poor network segmentation and overreliance on outdated remote access policies. Organizations with strict IT-OT segmentation and tested offline backups recovered faster and avoided ransom payments, while those lacking these measures faced prolonged disruptions and higher remediation costs. Dragos emphasized a risk-based vulnerability management approach, noting that only 6% of OT vulnerabilities required immediate action (Now category), while 63% were high-priority (Next) and 31% posed minimal risk (Never). However, inaccuracies in public advisories complicated prioritization: 22% of advisories contained incorrect data, 11% of CVEs had errors, and 7% were more severe than reported. Additionally, 70% of vulnerabilities resided deep within OT networks (Purdue Level 3.5 and below), making patching difficult without operational disruption. Incident Trends and Weaknesses Ransomware accounted for the majority of OT disruptions, with 25% of cases causing full site shutdowns and 75% resulting in partial operational halts. Exploitation of remote access including VPNs and RDP was a factor in 20% of incidents. Third-party vendors and contractors emerged as a major weak point, with some organizations unaware of all remote connections to their OT networks. Dragos also observed a concerning trend of hacktivist groups incorporating ransomware into their operations, further blurring the lines between ideological and financial motives. The report underscored that sophistication was not always necessary for impact, as even low-skilled adversaries could disrupt critical infrastructure by targeting exposed OT environments.

OT Cybersecurity Landscape Shaken by Major Acquisition, Supply Chain Breach, and Market Growth The operational technology (OT) cybersecurity sector is experiencing unprecedented activity, marked by a landmark acquisition, a high-profile supply chain attack, and surging market expansion driven by regulatory pressures and real-world downtime risks. ### Dragos Breach Revisited: Lessons in Resilience In 2023, OT security firm Dragos faced a targeted attack when threat actors compromised a newly hired sales employee’s personal email before his first day, intercepting onboarding credentials. Despite gaining initial access, strict role-based access controls and network segmentation prevented lateral movement, containing the breach within hours. Dragos refused extortion demands, citing forensic evidence of no further compromise, and later published a transparent account of the incident. Key takeaways for OT and IT leaders include hardening onboarding processes, assuming perimeter breaches, and leveraging transparency as a defensive strategy. ### Accenture’s $4.175 Billion OT Security Play Accenture has acquired a majority stake in Dragos while fully purchasing asset-discovery firm runZero and firmware security specialist NetRise, aiming to create a comprehensive industrial risk framework. The deal combines: - runZero (asset discovery) - NetRise (firmware vulnerability analysis) - Dragos (threat detection and response) Dragos will operate independently under CEO Robert M. Lee, though concerns persist about cultural shifts as smaller, engineering-driven firms integrate into Accenture’s large-scale professional services model. ### Klue Supply Chain Attack Exposes Third-Party Risks A breach at competitive intelligence platform Klue used by cybersecurity vendors like Huntress, Recorded Future, Tanium, and LastPass highlighted the dangers of shared third-party tools. Attackers exploited a legacy credential to push a malicious update, harvesting OAuth tokens to bypass security perimeters and extract CRM data via Salesforce APIs. The Icarus extortion group claimed responsibility, underscoring how breaching a single integration point can compromise multiple downstream organizations. ### OT Cybersecurity Market Expands to $23 Billion The OT security market is projected to exceed $23 billion by 2026, divided into three key segments: 1. IT/OT convergence players (Palo Alto Networks, Fortinet, Cisco) 2. OT-focused pure plays (Dragos, Nozomi Networks) 3. Managed service providers (Align Managed Services, CrowdStrike) As critical infrastructure operators face talent shortages, managed services are becoming increasingly vital for mid-sized organizations. The evolving landscape reflects both growing threats and the push for integrated, scalable security solutions.