Manufacturing threat landscape
Industrial and automotive production — consistently the most ransomware-hit sector, with OT downtime as leverage.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 23
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 487
- Ransomware victims, since 2026-06
- 666
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 23.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| Kimsuky | Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 485 |
| Scattered Spider | Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. T… | 423 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| OilRig | OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government… | 293 |
| APT28 | APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.(Citation: NSA/FBI Drovorub… | 283 |
| APT-C-36 | APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targe… | 275 |
| Sandworm Team | Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Ci… | 270 |
| Leviathan | Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citat… | 236 |
| Threat Group-3390 | Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has target… | 224 |
| Elderwood | Elderwood is a suspected Chinese cyber espionage group that was reportedly responsible for the 2009 Google intrusion known as Operation Aurora. The gr… | 202 |
| POLONIUM | POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February… | 194 |
| MirrorFace | MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools,… | 181 |
| BRONZE BUTLER | BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, bi… | 171 |
| FIN8 | FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology,… | 166 |
| Fox Kitten | Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North Am… | 164 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 44.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Anthropic AI-orchestrated Campaign | The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre… | — | — |
| J-magic Campaign | The J-magic Campaign was active from mid-2023 to at least mid-2024 and featured the use of the J-magic backdoor, a custom cd00r variant tailored for use… | — | — |
| Operation CuckooBees | Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted… | — | — |
| KV Botnet Activity | KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https… | Volt Typhoon | — |
| 2025 Poland Wiper Attacks | 2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind an… | — | — |
| C0021 | C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporat… | — | — |
| Ready, Settra, Go: New Settra Ransomware Variant Deploys MeshAgent RMM | Settra is a ransomware variant first observed in June 2026 that targets organizations through VPNs or compromised credentials. Two incidents were investigated in July and September 2026, affecting the consumer services, retail, and manufact… | — | 2026-10-17 |
| DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel | DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer af… | — | 2026-10-15 |
| MATCHBOIL: New tricks, same old evil intentions | ESET researchers documented the evolution of MATCHBOIL, a custom C# downloader used by Russia-aligned APT group UAC-0099. The malware downloads payloads from command-and-control servers, installs them, and establishes persistence on victim… | — | 2026-10-09 |
| Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy | Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, S… | — | 2026-10-09 |
| Counterfeit installers to system compromise: Tracking a deceptive software download campaign | A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users… | — | 2026-10-02 |
| PAYLOAD ransomware attacks through Active Directory GPO | In April 2026, a manufacturing organization in the Middle East suffered a ransomware attack where threat actors with domain admin privileges weaponized Active Directory Group Policy Objects to achieve domain-wide impact without deploying ra… | — | 2026-09-21 |
| Clop Returns with Custom Implant in Mass-Extortion Campaign | The Clop threat group has returned to mass exploitation tactics by leveraging CVE-2026-12569 in PTC Windchill, deploying a sophisticated custom web shell designed specifically for data theft and extortion. This purpose-built implant provide… | — | 2026-09-18 |
| Mirage2FA Hijacks Companies’ Microsoft 365 Sessions, with Over 4K Victims in the US | Mirage2FA is an active phishing-as-a-service toolkit built to steal Microsoft 365 credentials and authenticated sessions through Adversary-in-the-Middle attacks. Analysis shows 63.7% of identified victims are in the US, with Technology, Man… | — | 2026-09-17 |
| PhantomCore and PhantomGraph backdoors delivered via an unpatched TrueConf server | The Head Mare APT group exploited a chain of vulnerabilities in TrueConf video conferencing servers to deploy PhantomCore and PhantomGraph backdoors. Attackers connected to unpatched TrueConf servers via port 4307/TCP without authorization,… | — | 2026-09-10 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 318.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-18782 | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issu… | |
| CVE-2026-49827 | 9.8 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, l… | |
| CVE-2026-61245 | 9.8 | Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft (component: Integration). The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthen… | |
| CVE-2025-67928 | 9.3 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQL Injection.This issue affects Automotive Listings: from n/a … | |
| CVE-2026-44758 | 9.1 | SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successf… | |
| CVE-2026-89108 | 9.1 | SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially cr… | |
| CVE-2026-61244 | 9.1 | Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Argentina product of Oracle PeopleSoft (component: Manufacturing). The supported version that is affected is 9.1. Easily exploitable vulnerability allows una… | |
| CVE-2026-31889 | 8.9 | ### Summary We identified and fixed a vulnerability in the Shopware app registration flow that could, under specific conditions, allow attackers to take over the communication channel between a shop and an app. By abusi… | |
| CVE-2026-62450 | 8.8 | Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low pr… | |
| CVE-2026-18783 | 8.8 | Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29.… | |
| CVE-2026-61010 | 8.8 | Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability al… | |
| CVE-2026-60681 | 8.8 | Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vu… | |
| CVE-2026-61289 | 8.8 | Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). The supported version that is affected is 12.2.15. Easily exploitable vuln… | |
| CVE-2026-62513 | 8.5 | Vulnerability in the Oracle Process Manufacturing Regulatory Management product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vu… | |
| CVE-2026-61340 | 8.2 | Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability al… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Manufacturing), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| Brüninghoff Group | payload | 2026-10-20 |
| Walbro | nitrogen | 2026-10-19 |
| GTL Concreto e Logística LTDA | emperador | 2026-10-19 |
| POWERsonic Industries Inc. | aurora | 2026-10-19 |
| SMIC US Company (Sunnyvale, CA — US arm of Semiconductor Manufacturing International Corpo... | N0n | 2026-10-18 |
| Mastelli S.r.l. | qilin | 2026-10-18 |
| Southwire | Helix | 2026-10-18 |
| www.marvinpac.com | settra | 2026-10-18 |
| Quikrete | Helix | 2026-10-18 |
| Smith Douglas Homes | Helix | 2026-10-17 |
| Rheem Global | Helix | 2026-10-17 |
| Kissei Shoji | everest | 2026-10-17 |
| Chugoku Bend | everest | 2026-10-17 |
| Prafesta Ind. e Com. de Embalagens Ltda | N0n | 2026-10-16 |
| New Tec Tool Limited | play | 2026-10-16 |
Most active crews · since 2026-06
- qilin97
- thegentlemen96
- akira34
- incransom27
- Deadlock22
- dragonforce22
- safepay20
- Storm18
- play14
- Dark Project13
- aurora13
- settra12
- lockbit511
- emperador10
- N0n8
watch this sector
Get a daily email when something new touches manufacturing — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.