Manufacturing OT Faces Phishing-to-Ransomware Pressure
Manufacturing is no longer just dealing with encryption. The sharper risk is that phishing-spread backdoors are creating the foothold that ransomware crews need to move into OT and keep production down longer than a simple file-locking event.
Check Point says manufacturing ransomware rose 56% in 2025 to 1,466 incidents, out of 7,419 global cases. Kaspersky says Q4 2025 saw email-spread Backdoor.MSIL.XWorm appear across all regions on ICS systems, after not showing up in the prior quarter. That backdoor is built to persist and allow remote control, which makes it a useful bridge from initial access to later ransomware activity.
The pattern points to a more durable threat model for factories. Phishing is not just a user problem anymore; it is becoming an OT entry path that can turn a single mailbox compromise into extended production disruption.