Increase in Ransomware Attacks Against Industry

On May 23, 2025, cybersecurity firm Dragos released a report showing that ransomware attacks targeting the industrial sector increased by 15% from the last quarter of 2024 to the first quarter of 2025. During this period, the company identified 708 ransomware incidents affecting industrial entities, compared to approximately 600 between October and December 2024.

Specifically, North America and Europe experienced 413 and 136 attacks respectively in Q1 2025, up from 360 and 102 in the previous quarter. 68% of these attacks targeted the manufacturing industry.

Several incidents had significant operational impacts. The outage at the South African Weather Service (SAWS) severely disrupted agricultural weather forecasting in South Africa. An attack on Taiwanese printed circuit board manufacturer Unimicron also caused a substantial drop in its production.

This rise in confirmed incidents reflects changes in the cybercrime landscape. Dragos noted that established ransomware gangs like Cl0p, Akira, and RansomHub “maintained high levels of activity.” Meanwhile, emerging groups such as FunkSec, Sarcoma, and Lynx have “introduced advanced techniques including AI-driven malware and sophisticated EDR evasion strategies.”