Huntress: manufacturing's share of cyber attacks rose from 9% to 17% in 2025; seven sector trends outlined
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufacturers tolerate very little downtime. It also covers the loss of air gaps between IT and OT, legacy systems that cannot be patched, third-party and supply chain access, cloud/AI attack surface growth, and regulatory pressure from CMMC 2.0 and NIS2. It ends with a promotion of Huntress managed EDR and its SOC.
Detalhes técnicos
- Typical IT-to-OT path described: phishing of a non-plant employee (Sales, Finance), then network scanning for bridges such as jump servers or vendor VPN appliances, then lateral movement with stolen credentials into the OT network, then access to MES, HMIs and PLCs, where an attacker could change recipe values, stop belts or disable safety sensors.
- Legacy weaknesses: HMIs on Windows 7/XP, unpatched PLCs, hard-coded or shared credentials, and default-open insecure services (Telnet, unencrypted HTTP, FTP).
- Supply chain path: compromise of a contractor or integrator, theft of saved credentials or always-on VPN links, then trusted-looking logins and ransomware deployment or manipulation of control systems. The 2014 Target breach is cited as an analogy.
- Extortion model: double extortion, combining theft of proprietary designs with OT shutdown.
- Attackers' AI use: the article says threat actors use AI to write better phishing emails and find network weaknesses faster.
Remediação
- Apply Zero Trust principles: time-limited, system-specific vendor access; segmentation between IT and OT; MFA on every login, especially VPN gateways and control-system access.
- Check device health (NAC or Zero Trust gateways) before allowing access to ICS.
- Baseline network traffic and monitor for anomalies such as after-hours connections and traffic spikes.
- Maintain live asset inventories, regular access reviews, documented policies and tested incident response plans.
- Run managed EDR with 24/7 monitoring (the vendor's own offering).
Linha do tempo
-
Huntress: manufacturing's share of cyber attacks rose from 9% to 17% in 2025; seven sector trends outlined
ler a análise desta fonte ocultar
Huntress reports that manufacturing accounted for about 17% of cyber attacks in 2025, up from 9% in 2024, citing its own cyber threat report. The article is a vendor trends piece rather than an incident report. It argues that ransomware operators now target production uptime and operational technology (OT), not just data, because manufacturers tolerate very little downtime. It also covers the loss of air gaps between IT and OT, legacy systems that cannot be patched, third-party and supply chain access, cloud/AI attack surface growth, and regulatory pressure from CMMC 2.0 and NIS2. It ends with a promotion of Huntress managed EDR and its SOC.
Technical Details
- Typical IT-to-OT path described: phishing of a non-plant employee (Sales, Finance), then network scanning for bridges such as jump servers or vendor VPN appliances, then lateral movement with stolen credentials into the OT network, then access to MES, HMIs and PLCs, where an attacker could change recipe values, stop belts or disable safety sensors.
- Legacy weaknesses: HMIs on Windows 7/XP, unpatched PLCs, hard-coded or shared credentials, and default-open insecure services (Telnet, unencrypted HTTP, FTP).
- Supply chain path: compromise of a contractor or integrator, theft of saved credentials or always-on VPN links, then trusted-looking logins and ransomware deployment or manipulation of control systems. The 2014 Target breach is cited as an analogy.
- Extortion model: double extortion, combining theft of proprietary designs with OT shutdown.
- Attackers' AI use: the article says threat actors use AI to write better phishing emails and find network weaknesses faster.
Remediation
- Apply Zero Trust principles: time-limited, system-specific vendor access; segmentation between IT and OT; MFA on every login, especially VPN gateways and control-system access.
- Check device health (NAC or Zero Trust gateways) before allowing access to ICS.
- Baseline network traffic and monitor for anomalies such as after-hours connections and traffic spikes.
- Maintain live asset inventories, regular access reviews, documented policies and tested incident response plans.
- Run managed EDR with 24/7 monitoring (the vendor's own offering).