Log in Request a demo
Industry · Manufacturing

Ransomware Could Stop Our Plants And Suppliers.

Plants depend on suppliers and on systems that must stay up. Ransomware groups know it and pick targets that cannot afford to stop.

Request A Demo See The Platform
What We Watch For Manufacturing 4 Threats

In Short

Plants and the suppliers around them cannot stop for long. Attackers use exposed remote access, stolen logins and phishing to get in, and supply chain attacks let an outage spread from one supplier to the next. Watching your exposure and your suppliers from outside gives manufacturers early notice.

At A GlanceRansomware, open remote access and supply chain attacks that can stop plants and suppliers, and the rules that apply to manufacturers.

Main Threats

What Threatens Manufacturers.

Glossary term Ransomware CISA lists exposed remote services, compromised credentials and phishing among the ways ransomware actors get in. See The Definition → Incident A Production Stop On 2 September 2025 Jaguar Land Rover shut down its systems after a cyber incident. Production and retail were severely disrupted and restarted in phases from 8 October 2025. Read The Incident → Technique Open Remote Access Remote services left reachable from the internet are a common first step. Open Technique → Glossary term Supply Chain Attacks Attacks that get in through a supplier or a software component. See The Definition →

Compliance

Which Rules Apply To You.

NIS2 Directive The European Commission lists critical product manufacturing among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents, and applies to medium-sized and large entities. Official Site ↗

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

Products

How Brandefense Helps.

Threat Landscape

Who Targets Manufacturing, And Where.

Akira ransomware group Active Akira is a ransomware group active since March 2023. Since 2023 · Ransomware as a service (per MITRE ATT&CK) Hive Disrupted Hive was a ransomware as a service operation active from June 2021. Since 2021 · Ransomware as a service LockBit Disrupted LockBit is a ransomware as a service operation first seen in January 2020. Since 2020 · Ransomware as a service Medusa Active Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Since 2021 · Ransomware as a service (closed group until at least early 2023) Qilin Active Qilin, also tracked as Agenda, is a ransomware as a service family that MITRE ATT&CK says has been active since at least 2022. Since 2022 · Ransomware as a service RansomHub Ransomware group RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service REvil ransomware group Disrupted REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Since 2019 · Ransomware as a service Rhysida Active Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Since 2023 · Ransomware as a service (profit-sharing with associates) Royal Ransomware group Royal is a ransomware group that, according to a joint FBI and CISA advisory (AA23-061A, first published March 2, 2023), rebranded as BlackSuit. Rebranded · Since 2022 · Not stated as ransomware as a service in the sources; operated by the group itself
Jaguar Land Rover cyber attack Incident On 2 September 2025 Jaguar Land Rover (JLR) said a cyber incident had hit it, and it shut down its own systems. September 2025 · Transport and manufacturing
Brazil Country Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America Germany Country Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe Italy Country Italy faces ransomware, DDoS campaigns by pro-Russian groups and data exposure. Europe Japan Country Japan faces cyber espionage linked by its police to China and North Korea, ransomware against manufacturers and smaller firms, and theft of crypto assets. Asia Pacific United Arab Emirates Country The United Arab Emirates is a Gulf state with a national Cyber Security Council and separate bodies in Dubai and Abu Dhabi. Middle East United Kingdom Country The United Kingdom faces cyber threats from states and from ransomware crews. Europe United States Country This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America

FAQ

Frequently Asked Questions.

  • Does this touch our plant network?

    No. It looks from the outside at what is exposed and at criminal sources.

  • Do the public sources say how JLR was attacked?

    The sources we opened do not say how the attackers got in or who they were.

  • Which rules apply?

    NIS2 covers some manufacturing of critical products, for medium-sized and large entities. Check with your legal team.

  • Do you name groups that target manufacturing?

    No. We name a group only when a government or standards source links it to the sector.

  • How do attackers get into manufacturers?

    CISA lists exposed remote services, compromised credentials and phishing among the ways ransomware actors get in. Open remote access is a common first step. Watching your exposure from outside shows these openings early.

  • What is a supply chain attack in manufacturing?

    It is an attack that gets in through a supplier or a software component. Plants and the suppliers around them cannot stop for long, so an outage can spread from one supplier to the next. The Supply Chain and Vendor Risk use case shows which suppliers expose you.

  • Why does open remote access matter at a plant?

    Remote services left reachable from the internet are a common first step for attackers. External Attack Surface Management shows exposed remote access and forgotten systems at your sites. You can then close them before they are used.

  • How does ransomware intelligence help a manufacturer?

    Ransomware Intelligence follows ransomware groups and the victims they announce, including manufacturers. The Ransomware Early Warning use case spots the signs that come before an attack. Both give your team time to act.

  • Does NIS2 cover manufacturers?

    The European Commission lists critical product manufacturing among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents. It applies to medium-sized and large entities. Your legal team decides what applies to you.

  • How long can a production stop last after a cyber attack?

    It can last a long time. On 2 September 2025 a large carmaker shut down its systems after a cyber incident. Production and retail were severely disrupted and restarted in phases from 8 October 2025.

Mentioned In
  1. BlackTech →April 2026
  2. Tick APT Group (BRONZE BUTLER): A Long-Running East Asian Cyber Espionage Actor →March 2026
  3. The Economic Dynamics of Data Trade in the Dark Web: Strategic Insights for SOC Analysts and Incident Response Leads →November 2025
  4. menuPass →Threat group

Related Reading.

Knowledge Hub →
101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open → 101 guide External Attack Surface Management 101 How to find, check and reduce everything an attacker could reach from the internet, and how to keep that list true as your company changes. Open → Glossary Attack surface An attack surface is everything an attacker could reach to try to get into your organization. Open →

Other Ways In.

All Roles →
RoleCISOSee what is exposed outside your network in terms a board understands, and know what to… RoleCIO and IT directorSee what your company exposes to the internet, which suppliers carry risk into your systems, and… Threat groupmenuPassAttributed by the US, UK and EU governments to a China-based group working with the Ministry… TechniqueRemote ServicesRemote Services is when an attacker uses a valid account to log in to a service…

For Manufacturing

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo See The Platform