Threat Advisory • Attack Report • Admiralty Code A1

Factory Reset: How Attackers Are Halting U.S. Production Floors

A landscape assessment of the ransomware ecosystem targeting the U.S. Manufacturing sector, covering 45 distinct campaigns, dominant ransomware brands, exploited edge-appliance CVEs, and the espionage layer operating beneath the extortion economy.

Summary

U.S. Manufacturing Under Sustained Ransomware Pressure

The U.S. Manufacturing sector sat at the sharp end of the ransomware curve across the reporting window, with 45 distinct campaigns converging on a single reality: the network perimeter is the front door, and it is unlocked. Akira dominated the leaderboard while emerging brands scaled fastest beneath it, and a synchronised late-2025 pileup pointed to a shared upstream trigger the sector should expect to see repeat. Weaponised CVEs clustered on VPNs, firewalls and remote-support tooling, with backup infrastructure specifically targeted for destruction before encryption. Behind the ransomware volume sat a quieter nation-state espionage layer aimed at long-dwell access, a reminder that for manufacturers with defense, aerospace or semiconductor exposure, the intellectual-property threat is as serious as the extortion one.

Targeted platforms span Windows, Linux, VMware ESXi, and network appliances. Dominant ransomware brands active against U.S. manufacturing include Akira, Qilin, Play, Clop, Dragon Force, and INC. A total of 37 unique CVEs sit in scope for this landscape, 14 of which (37.8%) were exploited as zero-days, and 36 of which (97.3%) are listed on the CISA Known Exploited Vulnerabilities (KEV) catalogue.

By the Numbers

Most Recurring Threats

The CVE, ransomware, and malware seen most often against the U.S. manufacturing sector, based on leak-site activity and campaign tracking across the reporting window.

• 01Most Active Ransomware:Akira — 361 leak-site victim posts
• 02Most Recurring in Campaigns:Qilin — tracked in multiple campaigns
• 03Most Recurring Malware:StealC — tied across multiple stealer campaigns
• 04Most Recurring CVE:CVE-2024-55591 — Fortinet FortiOS auth-bypass

Akira dominates manufacturing leak-site postings, roughly double the next brand (Qilin). Together, the top five ransomware brands — Akira, Qilin, Play, Clop, and DragonForce — account for the bulk of publicly claimed victims. Leak-site victim-post counts reflect publicly claimed victims on each group's data-leak site.

Malware Analysis

58 tracked malware families were grouped by type for this landscape. Ransomware leads at 47% (27 of 58 families), confirming extortion as the primary end goal targeting U.S. manufacturing. Information stealers and backdoors follow at 16% each — stealers harvest the credentials that open the door, while backdoors give the persistent, quiet access espionage crews and ransomware affiliates rely on. Loaders/downloaders (9%) and RATs (7%) round out the delivery-and-control toolkit. Read together, the mix describes a full intrusion lifecycle: steal access, establish persistence, then encrypt or exfiltrate for extortion.

Affected Products

37 exploited CVEs were grouped by the type of product targeted. Edge, VPN, and remote-access appliances dominate, accounting for 18 of the 37 CVEs. Fortinet, Ivanti, Citrix, SonicWall, SimpleHelp, and ConnectWise devices are the principal doorway into manufacturing networks: internet-facing, often under-patched, and sitting directly on the perimeter. Web/application/middleware products (7 CVEs) — SAP NetWeaver, Oracle, Log4j, Confluence, and ColdFusion — and virtualization/hypervisor plus email/collaboration servers (4 CVEs each) round out the attack surface.

The pattern is clear: exposure is concentrated at the network edge and in shared enterprise software beneath production systems. Half of all exploited CVEs target the perimeter itself — the appliances that face the internet before any production system is reached. Segmenting OT/production networks behind these devices, and patching the edge first, delivers the largest reduction in blast radius.

Affected Vendors

Exploited CVEs by vendor area are proportional to the number of weaponised vulnerabilities. Microsoft, Fortinet, and VMware carry the largest weaponised footprint, followed closely by SimpleHelp, SonicWall, and Ivanti. Two themes emerge. First, security and remote-access vendors — Fortinet, SonicWall, Ivanti, Citrix, SimpleHelp, ConnectWise, and F5 — the very products bought to protect the network, are the most-exploited class of appliance. Second, core enterprise platforms — Microsoft, VMware, Oracle, SAP, Adobe, Atlassian, and Apache — underpin production and back-office systems, so a single vendor flaw cascades widely. Concentrating patch and monitoring effort on this short vendor list covers the majority of the sector's exploited exposure.

Vulnerability Posture

How dangerous and how actionable the exploited CVEs are, aggregated across the 37 CVEs tracked in this advisory.

97% of weaponised CVEs are already in CISA's Known Exploited Vulnerabilities catalogue, and 97% have a patch available, meaning the vast majority of manufacturing's exposure is remediable today and is being exploited because patch lag, not novel zero-days, is the gap. The 14 zero-days that do appear cluster in edge appliances (Fortinet, Citrix, Ivanti, Oracle), underscoring why perimeter devices demand the fastest possible patch SLAs.

Exploited CVEs — Full Table

All 37 CVEs aggregated for this landscape, with CISA KEV status and vendor-patch availability. Per-CVE zero-day flags were not separately resolvable from the source table layout; the aggregate 14/37 zero-day figure is presented above in Vulnerability Posture.

Note: the source report hyperlinks CVE patch references to tick marks in the original table; direct patch links are consolidated under References & Patch Links below.

Attack Details

How the Manufacturing Sector Was Compromised

Recommendations

Reducing Manufacturing's Ransomware Exposure

Indicators of Compromise

IOCs (Indicators of Compromise)

Indicators associated with the ransomware, backdoor, stealer, and loader families observed across U.S. manufacturing campaigns in this reporting window, spanning file hashes (SHA256/SHA1/MD5), network indicators (IPv4, domains, URLs), Tor/onion addresses, and threat-actor contact channels (email, Tox ID). Indicator counts are summarized by family and type below; the full indicator-by-indicator list is available on the Uni5Xposure platform.

A comprehensive list of IOCs associated with the executed attacks referenced in this advisory is available on the Uni5Xposure platform.

MITRE ATT&CK TTPs

Potential MITRE ATT&CK TTPs

References & Patch Links

References

• https://www.cisa.gov/news-events/cybersecurity-advisories
• https://research.checkpoint.com
• https://www.rapid7.com/blog
• https://any.run/cybersecurity-blog
• https://www.ransomware.live
• https://attack.mitre.org/