Ransomware attacks jump 23% as industrial firms hit

Ransomware attacks rose 23% in the third quarter from the previous quarter, according to NCC Group. The cybersecurity company said industrial businesses faced the highest volume of attacks during the period.

Qilin was the most active threat group in the quarter, accounting for 13% of incidents, or 365 attacks. The Gentlemen followed with 359 attacks, representing 12.5% of incidents and a 51% increase from the second quarter.

Industrials recorded more than 838 attacks over the quarter, making it the most targeted sector. Consumer discretionary ranked second with 526 attacks. In September alone, industrial businesses faced 230 attacks and consumer discretionary 161.

NCC Group said the pattern pointed to growing pressure on critical infrastructure, including transport, communications, financial services and health. The report cited a cyber attack on a small UK power generation facility in August that forced operations to stop for about four days.

The UK government has not formally confirmed attribution for that incident, the report said. It added that the details were consistent with Iranian-affiliated campaigns targeting critical infrastructure, including attacks on internet-exposed programmable logic controllers and efforts to establish remote access to operational technology.

Regional picture

September brought a month-on-month decline even as the quarterly total rose. Ransomware incidents fell 26% from August to 821 in September. North America was the most targeted region, with 390 attacks, followed by Europe with 211.

The findings suggest quarterly growth in ransomware activity was not linear through the end of the period. Even so, the data points to sustained pressure on large organisations and operators of essential systems.

NCC Group also highlighted what it described as a modern trend of threat groups weaponising generative AI. In the third quarter, researchers identified BraZetsu, described in the report as an AI-enhanced Windows malicious framework that evolved into a specialised initial-access toolkit for corporate exploitation.

According to the report, the operators behind BraZetsu used its models to automate victim profiling, handle data triage and rank targets by perceived commercial value. It added that agentic AI risks also drew attention during the quarter, with legitimate AI agents becoming attack vectors through misalignment, prompt injection and excessive permissions.

The report cited affected organisations including US government systems and Australian health institutions. NCC Group said those cases underlined the need to monitor how AI agents interact with systems and data, particularly in critical infrastructure and public services.

Operational divide

The growing connection between information technology and operational technology has created new security challenges, the report said. It linked that trend partly to routine operational requirements, including third-party maintenance and centralised management.

Matt Hull, vice president of cyber intelligence and response at NCC Group, said: "Not only was this attack a reminder that smaller critical infrastructure operators can't discount themselves as targets, it's a direct example of threat actors crossing the boundaries between the digital and physical worlds. We've already seen the direct impact of this capability continue into Q4 in the retail sector. There are clear actions around the separation of IT and OT for all critical infrastructure organisations to take - maintaining visibility over privileged accounts, using network segmentation to control access and securely configure remote access."

Hull also pointed to a broader pattern in the way AI tools are being misused by attackers or creating openings through poor deployment and oversight.

He said: "We're witnessing in real time an unintended use case of AI agents, as a pattern emerges of repeated failures rather than isolated incidents. While AI-enabled attacks could be considered a natural consequence of the sophistication of its capabilities, the threat landscape has also been expanded by organisations being compromised by accidental or manipulated agentic actions."