Ransomware, Lack of Visibility, Mischaracterizations and Nation-States, Oh My
There is a silent epidemic of ransomware attacks on commercial operational technology systems, which are mischaracterized as IT incidents even though they impact operational systems, claims a comprehensive annual review of cyberattacks targeting OT, published this week by security firm Dragos.
See Also: How 72% of Enterprises Are Rewriting Cyber Resilience Playbooks
The report outlines worrying trends in the activities of nation-state level OT hacker groups, which are increasingly moving from initial access efforts to operations designed to reconnoiter OT systems and pre-position for attacks with real world effects.
Data collected by Dragos found ransomware attacks on OT systems are routinely mischaracterized, founder and CEO Rob Lee told reporters. “It’s hard to estimate the percentage, but a lot of these [OT ransomware] cases are getting misidentified” as IT incidents, he said at an online press event to launch the report.
He blamed IT cybersecurity teams who don’t understand how OT systems work, and the fact that most businesses don’t collect the OT network data needed to do root cause analysis of cyberattacks on OT systems.
“I have personally been involved in a number of [ransomware incident response] cases where there was physical damage or [OT] outages and there was no data available collected ahead of time to be able to determine if cyber was a component in that or not,” Lee said.
Without data to know for sure whether or not OT systems had been cyber attacked, let alone how successfully, companies often chose to go with a public narrative that wrote the incident off as a conventional IT ransomware infection which “impacted” – in some non-specific way – their operations.
Dragos tracked 119 ransomware groups targeting industrial organizations in 2025, a 49% increase from 80 such attacks in 2024, states the report. The company identified 3,318 attacks on industrial organizations, said Lee, noting that the actual number was likely higher, as many incidents go unreported or undetected.
“I consider [the Dragos annual report] mandatory reading for anyone working in OT/ICS, for anyone defending OT/ICS from cyberattacks,” said Mike Holcomb, an independent cybersecurity consultant specializing in OT/ICS. Holcomb was until last November the OT/ICS cybersecurity global lead for Fluor, one of the world’s largest engineering and construction companies.
A Decade After Stuxnet, Visibility Is Still The Main Problem
The US-Israeli Stuxnet cyber weapon a decade ago employed highly sophisticated OT-specific malware to destroy industrial equipment – centrifuges used to enrich uranium.
“The vast, vast majority of asset owners and operators today still could not detect the tactics, techniques, the methodology of what Stuxnet did 10 years ago,” said Lee. Unlike IT networks, where traffic is extensively logged, traffic on OT networks tends to be ephemeral. Unless specifically copied and stored, it is unavailable for subsequent forensic analysis. Yet only 5% to 10% of asset operators have that visibility today, Lee said (see: For OT Cyber Defenders, Lack of Data Is the Biggest Threat).
“We can only report on things where we have data for,” said Lee, so a lot of the focus in the report ended up being on companies with high-end defenses, such as large electric power utilities, because they were able to detect and track intrusions into their OT networks.
“There’s not a lot of discussion here on Brazilian-based mining companies,” Lee said, because they, like most companies, lack the capability to detect intrusions into their OT networks. “So they’re not seeing anything to be able to report … They don’t know what’s going on in their networks.”
Recognition of the visibility problem is growing among OT owners and operators, said Mark Cristiano, global commercial director for cybersecurity services at Rockwell Automation, a major OT systems vendor, and a Dragos partner. “There’s just more awareness at the CISO level of the importance and the complexity of protecting OT,” Cristiano told Information Security Media Group in an earlier interview.
“The questions that are being asked now are from a much more informed position, from some of these leaders that we talk to.” He said that growing awareness is driven by multiple factors, including news stories and warnings from government officials about nation-state attacks on the power grid and other critical infrastructure, and by regulatory changes like the Cyber Incident Reporting for Critical Infrastructure Act of 2022.
But while regulations may be driving interest and conversation, their impact on security is less clear and likely to take years. The U.S. Cybersecurity and Infrastructure Security Agency is planning a slew of town halls this spring with a review agenda that appears poised to put off a final rule past the its anticipated May rollout.
A different set of new regulations for the bulk electricity system in North America will require OT network monitoring for key sites in the power grid, Lee said. But, he noted that, following consultations with industry, they will also be phased in over three to five years (see: Monitoring the Electric Grid Is Easier Said Than Done).
It’s Not an OT Attack If We Say It Wasn’t
Even when attacks were detected, they were often mischaracterized, Lee said, citing ransomware attacks on manufacturing plants that directly affected operations by encrypting data on the servers and virtual machines that connected OT relies on, or on the workstations used by engineers to control OT systems. Lee said such attacks were often defined as “IT incidents” because they impacted an endpoint or a server running the Windows operating system.
A separate report, published by Dragos last year, but written by analysts from insurance giant Marsh McLennan using their data, provided evidence of misidentification, said Lee. The report correlated insurance claim data from attacks described as IT-only, showing that in many cases “people were saying it was just an IT incident, but were actually filing property damage claims on the operations side of the house,” said Lee. He added that this suggested there is “tens of billions of dollars in impact every year that is getting mischaracterized, misclassified and risk that wasn’t getting covered under the right policies.”
Like ransomware attackers in general, hackers targeting industrial organizations often abuse identity, stealing passwords and authentication credentials that allowed them to log in to assets directly connected to OT systems. The threat group Dragos designates TAT25-84, also tracked as Scattered Lapsus Shiny Hunters, was a good example of attackers abusing identity in this way. “The group systematically exploited help-desk workflows, self-service password reset mechanisms and MFA enrollment to gain privileged access” to systems hosting or connected to OT.
“These campaigns required no specialized exploits and often avoided detection entirely until critical enterprise systems underpinning OT continuity such as ERP, virtualization, cloud SaaS platforms, or backup infrastructure, were degraded or unavailable,” notes the report. Conventional ransomware, executed on a hypervisor hosting SCADA, human-machine interface software or engineering workloads, encrypts or corrupts data and “routinely resulted in denial of view, denial of control, and multi-day loss of productivity and revenue, even without any interaction with industrial protocols.”
The report cautions that ransomware actors often exaggerate or make false claims about their OT capabilities. Dragos “observed multiple ransomware operators and hybrid hacktivist personas attempting to inflate their perceived capabilities by misrepresenting access to industrial systems.” One highly public incident involved ransomware group Devman publishing screenshots of OT control consoles and monitoring dashboards, “falsely claiming to have developed ‘ICS-aware ransomware.’ Dragos analysis found no evidence supporting these assertions and no indication Devman accessed or could interact with ICS equipment.”
Despite the absence of technical evidence for such claims, the report notes that they “created uncertainty for victims, introduced friction into executive decision-making and attracted media amplification, … [allowing] adversaries to artificially increase extortion pressure.”
A Dire Warning
The report also documents a shift in high-end cyberattacks against OT systems, with more intrusions designed to pre-position adversaries “inside the control loop,” from where they can issue commands to industrial or power transmission or generation systems. Lee, drawing on his own experience running U.S. offensive cyber operations, said this was characteristic of a unit preparing the battlefield for a conflict.
“The shift is from ‘I want access that could be used for a future attack,’ to ‘I want to get access and explicitly start doing the actions to prepare my ability to do the attack,” Lee said, “That’s what shifted this past year.”
“A reasonable assessment” of this shift was that operators were being told to prepare for offensive cyber-physical operations within 12 months, said Lee. “They … are being told by their leadership, ‘You know what? It’s not just about getting access. We might want to leverage that access within a 12 month period.’ And when you hear that as an offensive team, that’s when you go ahead and develop that [control loop access] out,” he said.
Even where data was being stolen, he said, it was being done to conduct reconnaissance on the systems and understand how they worked – and how they could be disrupted. “Nothing that they were taking was useful for intellectual property, everything they were doing and learning was only useful for disrupting or causing destruction at those sites,” he said, calling it “a very clear signal,” that attackers were “embedding in that infrastructure for the purpose of taking it down.”