---
title: Ransomware Groups Targeting Industrial Systems Surge 49% in 2025
description: Ransomware attacks on industrial firms surge in 2025, exploiting VPNs and stolen credentials, warns Dragos. Manufacturing hit hardest.
canonical_url: https://codekeeper.co/ticker/ransomware-surges-against-industrial-firms-2025
---

# Ransomware Groups Targeting Industrial Systems Surge 49% in 2025

Ransomware attacks on industrial firms surge in 2025, exploiting VPNs and stolen credentials, warns Dragos. Manufacturing hit hardest.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Feb 18, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals are increasingly targeting industrial organizations, with 119 ransomware groups tracked in 2025 compared to 80 in 2024, according to Dragos researchers. Over 3,300 industrial organizations worldwide were hit by ransomware attacks, nearly double the 1,693 affected in 2024. Manufacturing led as the most targeted sector, followed by transportation, oil and gas, electricity, and communications. Attackers primarily exploited remote-access portals like VPNs using stolen credentials obtained through phishing, malware, or dark web purchases. The average "dwell time" before ransomware deployment was 42 days, allowing criminals to move quietly between IT and operational technology systems. One group used compromised VPN access to target SCADA virtual machines, causing operational delays despite not directly touching industrial equipment. Dragos CEO Robert M. Lee warns that without comprehensive monitoring, future technologies like AI and distributed energy will create even greater security blind spots. **Source:** [Infosecurity Magazine](https://www.infosecurity-magazine.com/news/rise-in-ransomware-targeting/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fransomware-surges-against-industrial-firms-2025%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Check Point Patches Critical Auth Bypass That Could Hand Attackers Full Control of Security Systems Aug 11, 2026](https://codekeeper.co/ticker/check-point-hotfix-authentication-bypass-flaw)

[Decades-Old Bash Tricks Leave AI Coding Agents Open to Supply Chain Attacks Aug 12, 2026](https://codekeeper.co/ticker/guardfall-flaw-in-ai-coding-agents)

[Cyber Attack Forces Great Marlow School to Partially Close Aug 12, 2026](https://codekeeper.co/ticker/malware-attack-hits-great-marlow-school-it-systems)

[FortiBleed Campaign Linked to Inc and Lynx Ransomware Gangs Aug 12, 2026](https://codekeeper.co/ticker/fortibleed-attack-ransomware-nextcloud-exploit)