Qilin ransomware surges to 101 incidents targeting industrial sectors
Q2 2025 saw 657 ransomware incidents against industrial entities globally, with Qilin emerging as dominant threat after RansomHub collapse and law enforcement disruptions.
Dragos documented 657 ransomware incidents impacting industrial organizations in Q2 2025, down from 708 in Q1. North America remained most targeted with 355 incidents (54%), while Europe saw significant increases to 173 incidents. Manufacturing continued as the primary victim sector at 65% of incidents, with construction subsector accounting for 110 attacks. The ransomware landscape underwent dramatic shifts following law enforcement actions including Operation Endgame 2.0 and affiliate arrests, causing RansomHub activity to collapse from dominant positioning to just 5 incidents. Qilin surged to become the most active group with 101 incidents, professionalizing operations with legal advisory services and media teams while systematically exploiting Fortinet vulnerabilities. Notably, North Korea's Moonstone Sleet adopted Qilin ransomware in March 2025, signaling geopolitical escalation beyond financial motives.
Emerging threats included Devman targeting high-revenue critical infrastructure, SafePay accelerating from 13 to 49 incidents using double-extortion tactics, and groups deploying ESXi-specific variants and ransomware with built-in wiper capabilities. Attackers increasingly exploited critical vulnerabilities in SAP NetWeaver (CVE-2025-31324), SimpleHelp RMM software, and FortiGate firewalls, while sophisticated social engineering techniques including IT helpdesk impersonation via phone and Teams calls led to ransomware deployment. High-impact incidents disrupted Nova Scotia Power's billing systems, halted Nucor steel production, reduced Masimo medical device manufacturing capacity, and caused extended order processing delays at food distributor UNFI.
The threat landscape shows continued fragmentation with emerging and rebranded groups employing double/triple-extortion combining encryption, data theft, and destructive wiping. Geopolitical tensions, particularly Israel-Iran conflict, introduced hacktivist personas using ransomware for disruption and Iranian groups offering higher affiliate payouts for attacks on US and Israeli targets. Organizations face escalating risks from AI-driven attack sophistication, targeted IT-OT environment exploitation, supply chain vulnerabilities, and increasingly selective attacks blending financial extortion with operational disruption aligned to geopolitical objectives.
Mentioned in this report
Detection guidance
Ransomware Pre-Encryption Service and Process Termination
Detects mass termination of security, backup, and database services via net.exe, sc.exe, or taskkill, a common Qilin/ransomware precursor to encryption to prevent recovery and evade detection. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Ransomware Pre-Encryption Service and Process Termination
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \net.exe
- \net1.exe
- \sc.exe
- \taskkill.exe
selection_action:
CommandLine|contains:
- ' stop '
- /stop
- -stop
- /f /im
- delete
selection_target:
CommandLine|contains:
- vss
- sql
- backup
- veeam
- sophos
- mcafee
- defender
- sentinel
- cortex
- msexchange
- memtas
- antivirus
filter_admin:
CommandLine|contains:
- spooler
- wuauserv
condition: selection_img and selection_action and selection_target and not filter_admin
falsepositives:
- Legitimate IT administration scripts that stop and restart backup agents or AV during
maintenance windows
- Software deployment tools performing scheduled service management
level: high
tags:
- attack.t1489
- attack.impact
id: 2302e883-05bb-5ed6-8727-d67a5db47058
status: experimental
author: Vorant
Shadow Copy and Recovery Deletion Consistent with Ransomware Data Destruction
Detects use of vssadmin, wbadmin, or bcdedit to delete shadow copies, backup catalogs, or disable recovery options, a widely used anti-recovery step preceding ransomware encryption/wiping such as Qilin. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shadow Copy and Recovery Deletion Consistent with Ransomware Data Destruction
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains:
- delete shadows
- resize shadowstorage
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains:
- delete catalog
- delete backup
selection_bcdedit:
Image|endswith: \bcdedit.exe
CommandLine|contains:
- recoveryenabled no
- bootstatuspolicy ignoreallfailures
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains: shadowcopy delete
condition: 1 of selection_*
falsepositives:
- Backup software or system administrators legitimately clearing old shadow copies
to free disk space
- IT staff reconfiguring boot recovery settings during OS troubleshooting
level: high
tags:
- attack.t1485
- attack.impact
id: 35ba5661-f2ed-51e3-a01a-a84d6ac93ae1
status: experimental
author: Vorant
Multiple Failed RDP Logon Attempts Followed by Success (Possible Brute Force)
Detects a pattern of repeated failed RDP/network logon attempts against a single account or host followed by a successful logon, consistent with brute-force or credential-stuffing activity used by Qilin affiliates to gain External Remote Services access. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Multiple Failed RDP Logon Attempts Followed by Success
logsource:
product: windows
service: security
detection:
selection_failed:
EventID: 4625
LogonType: 10
selection_success:
EventID: 4624
LogonType: 10
condition: selection_failed and selection_success
fields:
- TargetUserName
- IpAddress
- LogonType
falsepositives:
- Users repeatedly mistyping credentials before a correct RDP login
- Automated monitoring or health-check accounts with misconfigured credentials
level: medium
tags:
- attack.t1110
- attack.t1078
- attack.t1021.001
- attack.credential_access
id: 26cc0243-caad-5dae-bc52-c402b2039cb1
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.dragos.com/blog/dragos-industrial-ransomware-analysis-q2-2025
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free