Are manufacturing OT systems the new ransomware target?

Manufacturing facilities face direct production halts when cyber attackers breach operational technology networks. Huntress research indicates that threat actors are shifting focus from data theft to disrupting assembly lines. This strategic change targets the physical operations that generate revenue, causing immediate financial losses through missed shipments and idle labor costs.

By the numbers

• 17 percent: Share of total cyber attacks targeting the manufacturing sector in 2025.
• 9 percent: Share of total cyber attacks targeting the manufacturing sector in 2024.
• 2025: The year Huntress observed the notable jump in manufacturing-specific incidents.

What the figures mean

The rise in manufacturing incidents reflects a broader trend where attackers exploit the convergence of IT and OT networks. Huntress notes that smart factory initiatives have eliminated traditional air gaps. Industrial control systems, once isolated, now connect to corporate networks via remote access tools and cloud dashboards. This connectivity creates a path for attackers to move from standard office laptops to critical plant machinery.

Attackers often begin with phishing emails targeting non-technical departments like sales or finance. Once inside a corporate laptop, they scan for bridges to manufacturing systems. Huntress describes this path as moving through jump servers or vendor VPN appliances. Without strict segmentation, stolen credentials allow lateral movement into the operational technology environment.

What to watch

Threat actors seek control over human-machine interfaces and programmable logic controllers once inside the OT network. Huntress warns that attackers can modify recipe values, stop conveyor belts, or disable safety sensors. These actions create safety risks for plant workers and can damage sensitive equipment. The restart process for OT systems is significantly longer and more complex than standard IT reboots, extending downtime and financial impact.

Infection and persistence in general

Security teams should examine how malware establishes footholds in converged IT-OT environments. Attackers typically arrive via phishing or compromised credentials, then scan for network bridges. Persistence often relies on legitimate administrative tools or shared accounts that bypass standard detection. Analysts should check for unusual lateral movement between corporate and industrial segments. Monitoring for changes in device behavior, such as unexpected configuration updates on controllers, helps identify compromise before production disruption occurs.

What to do and how to stay safe: Huntress

• Verify network segmentation between corporate IT and operational technology zones to prevent lateral movement.
• Monitor for unauthorized access to jump servers and vendor VPN appliances used to bridge network segments.
• Audit credentials used for remote maintenance to ensure they are not shared or overly privileged.
• Review access logs for human-machine interfaces and programmable logic controllers for unexpected changes.

Step-by-step guide: Ransomware Incident Response: A Step-by-Step Operational Playbook

General security guidance from the Sandbox Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why are manufacturing attacks increasing in 2025?

Huntress data shows manufacturing accounted for 17 percent of attacks in 2025, up from 9 percent in 2024, as attackers target operational technology.

How do attackers reach industrial control systems?

Attackers often start with phishing emails to corporate departments, then use jump servers or VPNs to bridge into OT networks.

What can attackers do once inside the OT network?

They can control human-machine interfaces and programmable logic controllers to stop belts, change recipes, or disable safety sensors.