TL;DR: 1,140 ransomware incidents affected industrial organisations in Q2 2026, up 12% from Q1, according to Dragos, with attackers increasingly abusing internet-facing edge devices, RMM tools, valid accounts and credential theft to hit enterprise IT systems that support OT rather than directly manipulating control systems. The governance problem is less ICS malware than identity, access and remote-management exposure that lets ransomware cascade into operational downtime.
At a glance
What this is: Dragos's Q2 2026 analysis shows industrial ransomware stayed concentrated on enterprise IT systems and access paths that support OT, not on direct manipulation of control systems.
Why it matters: IAM, PAM and service-account governance matter here because the attack path repeatedly runs through valid accounts, remote access tooling and exposed management surfaces that can destabilise production even without ICS-native malware.
By the numbers:
- Dragos identified 1,140 ransomware incidents affecting industrial organisations in Q2 2026, a 12% increase over the 1,020 incidents recorded in Q1.
- Manufacturing accounted for 747 incidents, or 65% of all industrial ransomware cases in Q2 2026.
Context
Industrial ransomware is a governance problem as much as a malware problem: attackers increasingly exploit remote access, valid accounts and exposed management surfaces to reach systems that support operations. In industrial environments, that means business disruption often starts in identity and access layers long before it reaches plant-floor technology.
The article shows that the main failure mode is not direct control-system manipulation but the abuse of enterprise systems, including VPNs, RMM tools, hypervisors and credential stores, that sit between the internet and operational continuity. That pattern is typical for current industrial ransomware activity.
A useful lens for readers is privileged access management because the quarter’s most consequential intrusions repeatedly depended on standing access, weak MFA coverage and remote tooling abuse.
Key questions
Q: Why do passwords alone create risk for remote access and privileged accounts?
A: Passwords alone are weak because they are reusable, easily phished, and often exposed through poor user behavior or credential theft. For remote access and privileged accounts, that creates a single point of failure. A stronger model combines multifactor authentication, policy enforcement, and centralized oversight so access decisions depend on more than a static secret.
Q: Why does ransomware in industrial environments cause OT downtime without touching controllers?
A: Industrial operations depend on enterprise IT, especially identity services, virtualization, ERP and remote connectivity. When those layers are encrypted or isolated, production can stop because operators lose systems needed to schedule, coordinate, observe and recover operations. The consequence is a control-plane outage that behaves like an OT incident even when the attacker never reaches the plant-floor controllers.
Q: What are the signs that attackers are preparing industrial ransomware impact?
A: Look for credential harvesting, anomalous use of remote management tools, browser-stored secret access, security-tool tampering and activity against backup or hypervisor systems. Those signals usually appear before encryption, and they often define the best containment window. In industrial cases, the quiet phase matters more than the ransom note because that is where defenders can still limit blast radius.
Q: Should industrial teams prioritise access control or recovery planning first?
A: They should do both, but access control comes first when exposed remote entry paths and standing privilege are still present. Recovery planning matters because ransomware can still force shutdowns even after initial containment, yet weak access governance makes that recovery harder by allowing deeper compromise before response begins. The practical sequence is to shrink attacker reach, then harden recovery for the dependencies that keep operations running.
Technical breakdown
Why edge devices and remote access tools remain the primary entry path
Industrial ransomware actors continue to favour internet-facing devices because they are reachable, often standardized, and frequently exposed through legacy administration patterns. VPN appliances, RMM platforms and remote support tools compress the attacker’s job: one valid login, one bypass, or one exploited appliance can open the path into environments that were assumed to be internally governed. Once inside, those tools often provide legitimate administrative reach that blends into normal operations. The technical issue is not only compromise of the device itself, but the trust granted to the management plane behind it.
Practical implication: Treat internet-facing management surfaces as high-risk identity entry points, not just perimeter assets.
How credential theft and valid accounts accelerate ransomware impact
The article repeatedly shows attackers harvesting credentials after initial entry, then using those identities to move quietly through enterprise systems before encryption or extortion. Valid accounts reduce noise, bypass many detection controls, and let operators access backups, file shares, hypervisors and security tools with normal-looking authentication. In industrial environments, that creates a long dwell window where the intrusion is already operationally dangerous even though the ransom note has not yet appeared. The result is a governance failure in account scope, authentication strength and monitoring of privileged sessions. See the Service Account Security Guide.
Practical implication: Apply stronger authentication and tighter privilege controls to accounts that can reach backups, virtualization and remote administration layers.
Why enterprise IT disruption cascades into OT downtime
The report is explicit that ransomware often stops at enterprise systems, yet still causes operational downtime because OT depends on ERP, virtualization, identity services and remote connectivity. When those layers are encrypted, isolated or destroyed, production can halt even if controllers and programmable logic devices remain untouched. This is why industrial ransomware is increasingly about business and operational resilience, not just endpoint compromise. The technical boundary between IT and OT is therefore not a protection boundary unless access, identity and recovery processes are separately designed and tested. See the OT Security Guide.
Practical implication: Test recovery for identity services, virtualization and remote access dependencies, not only for plant-floor systems.
Threat narrative
Attacker objective: The objective is to extort industrial organisations by disrupting business-critical IT systems and, in many cases, creating operational downtime that cascades into OT.
- Entry occurs through exposed edge devices, compromised VPN accounts or social engineering against remote access and support tooling.
- Credential access follows through harvesting valid accounts, browser-stored credentials and privileged remote-management access.
- Escalation and impact occur when attackers disable defences, reach backups or hypervisors, and then encrypt or steal data before operational isolation takes effect.
Breaches seen in the wild
- Stryker Microsoft Intune Wiper Attack: Compromised Microsoft Intune credentials enable wiper attack wiping 200,000 Stryker devices.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Industrial ransomware is now an identity and remote-access governance problem first. The quarter’s most consequential cases relied on valid accounts, internet-facing appliances and remote management tooling rather than direct exploitation of controllers. That means the control failure sits in access design, authentication strength and privileged session governance, not only in malware detection. Practitioners should treat the management plane as part of the attack surface and not as a trusted operational shortcut.
Standing privilege is the recurring condition that turns a foothold into production risk. When attackers can reuse remote access accounts, harvest browser credentials or pivot through hypervisors, they gain time to destroy backups and disable defenders before impact. The breach pattern maps cleanly to just-in-time access and zero standing privilege because persistent access makes quiet movement and delayed detonation easier. Practitioners should remove always-on administrative access wherever it is not absolutely required.
Industrial ransomware exposes a control-plane blind spot in hybrid IT-OT environments. The report shows that enterprise systems such as ERP, identity services and virtualization platforms are operational dependencies, not just back-office tooling. That creates a hidden blast radius: one identity compromise can trigger shutdowns, loss of view and safety concerns even when control logic remains untouched. Practitioners should govern those dependencies as part of OT resilience planning.
Credential hygiene is now a resilience control, not a housekeeping task. The article repeatedly links compromise outcomes to stolen credentials, weak MFA coverage and abused remote tooling. In industrial environments, the question is no longer whether a login can be stolen, but whether that login can reach systems whose failure halts production. Practitioners should align credential policy with operational consequence, not just with account administration.
What this signals
Control-plane resilience is becoming the real industrial ransomware metric. The question for practitioners is no longer whether an adversary can encrypt endpoints, but whether it can take out the identity, virtualization or remote-management layers that make operations possible. That shifts programme priorities toward blast-radius reduction, dependency mapping and recovery design across the entire operational stack.
Industrial ransomware also shows why security teams need to separate management convenience from governance trust. Remote tooling and privileged access are useful only when they are constrained, monitored and disposable; otherwise they become the shortest path from internet exposure to operational disruption. The practical implication is to design management access as a controlled, auditable exception, not a permanent operating mode.
For practitioners
- Harden every internet-facing management surface Inventory VPN appliances, RMM platforms, remote support tools and appliance consoles, then remove exposed or legacy access paths that are not explicitly required for operations.
- Eliminate standing administrative access Move privileged operators, service accounts and remote support identities to just-in-time patterns so that no account remains continuously usable across critical systems.
- Enforce MFA on legacy access paths Prioritise VPNs, remote admin portals and break-glass paths that still rely on passwords alone, because the article shows those paths repeatedly seed industrial ransomware intrusion chains.
- Test recovery for identity and virtualisation dependencies Run recovery exercises that include identity services, hypervisors, backup systems and remote connectivity, since shutdowns often begin when those layers fail rather than when plant systems are touched.
Key takeaways
- Industrial ransomware is increasingly an enterprise access and resilience problem rather than a controller-focused attack problem.
- The quarter’s incidents show that valid accounts, exposed management tools and weak MFA can create enough leverage to stop production without any ICS-native malware.
- Teams should reduce standing privilege, harden remote access and test recovery for identity, virtualization and backup dependencies together.
Related NHI Mgmt Group resources: Just-in-Time Access and Zero Standing Privilege Guide · Service Account Security Guide · Cloud PAM and CIEM Guide · OT Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008; TA0040 — Credential Access; Lateral Movement; Impact | The article centres on credential theft, lateral movement and operational impact in ransomware chains. |
| Recommendation — Map industrial ransomware patterns to TA0006, TA0008 and TA0040 and tune detections for remote-access abuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Valid accounts and privileged remote access are core to the intrusion paths described. |
| Recommendation — Tighten access entitlements for remote administration and reduce persistent privilege on operationally critical systems. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account abuse and credential theft are recurring enablers in the article's attack patterns. |
| Recommendation — Harden account lifecycle governance, especially for remote access and administrator identities. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The report highlights weak MFA coverage and credential abuse across remote access paths. |
| Recommendation — Apply authenticator management controls to remote access, service accounts and privileged sessions. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Service and machine identities that retain broad access can widen ransomware blast radius across infrastructure. |
| Recommendation — Reduce overprivileged non-human identities that can reach backups, virtualization and management planes. | ||
Key terms
- Industrial ransomware: Ransomware that targets industrial organisations and their supporting enterprise systems, often causing operational disruption without directly manipulating controllers. The primary damage may come from encrypted identity services, virtualization, remote access or backup systems that production depends on.
- Remote management tool: A remote management tool is software used to administer endpoints, servers, or customer environments from a central console. These tools are high-value targets because compromise can provide broad control over many systems, which makes their authentication, patching, and monitoring especially important.
- Standing Privilege: Standing privilege is access that remains active even when no immediate task requires it. For NHI programmes, it is a common failure mode because long-lived credentials and persistent roles create unnecessary exposure. Reducing standing privilege usually means tighter expiry, on-demand access, and clearer review of who or what still needs access.
- Control plane resilience: The ability to preserve and restore the management logic that governs how systems are observed, controlled, and operated. It goes beyond uptime and data durability by ensuring the team can still direct, interpret, and trust the environment after disruption.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management in a way that maps directly to privileged access risk. It helps practitioners connect identity controls to the operational consequences that matter across enterprise and industrial environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org