OT / ICS · 170 days ago
Manufacturing is no longer just dealing with encryption. The sharper risk is that phishing-spread backdoors are creating the foothold that ransomware crews need to move into OT and keep production down longer than a simple file-locking event.
Check Point says manufacturing ransomware rose 56% in 2025 to 1,466 incidents, out of 7,419 global cases. Kaspersky says Q4 2025 saw email-spread Backdoor.MSIL.XWorm appear across all regions on ICS systems, after not showing up in the prior quarter. That backdoor is built to persist and allow remote control, which makes it a useful bridge from initial access to later ransomware activity.
The pattern points to a more durable threat model for factories. Phishing is not just a user problem anymore; it is becoming an OT entry path that can turn a single mailbox compromise into extended production disruption.
2 sources covering this story
Threat landscape for industrial automation systems in Q4 2025
The report contains industrial threat statistics for Q4 2025. It covers various infection vectors and malware types, as well as regional statistics and statistics by industry.
Manufacturing absorbs 56% ransomware surge of global attacks in 2025, as RaaS, legacy OT systems, and supply chains fuel spike.
Part of the PlainSec briefing for 2026-04-15