Skip to main content

Report

Threat Landscape Industrial Sector and ICS attacks

Publication date: November 12, 2025

Read report

THREAT LANDSCAPE: INDUSTRIAL SECTOR

The Industry's New Frontline
Over 70% of OT networks show structural weaknesses: cybercrime, hacktivism, and APT groups are threatening the operational continuity of strategic sectors.
The digital transformation of the industrial sector has unlocked new efficiencies and new vulnerabilities. With growing hyperconectivity, OT/ICS environments have become prime targets for cybercrime, hacktivism, and advanced persistent threat (APT) groups. This report, developed by the intelligence experts at LAB52, the intelligence division of S2GRUPO, provides a clear, up-to-date, and actionable overview of the main risks threatening operational continuity.

The Threat Landscape Industrial Sector and ICS Attacks report explores:
-The most active threat actors targeting OT environments, including LockBit, Akira, Sandown and GhostSec.
-Global attack trends affecting critical infrastructure and industrial operations.
-The most exploited structural weaknesses: legacy technologies, flat networks, and weak credentials.
-Key figures on OT threats, including regional impact, most targeted sectors and common attack techniques. Inside the report you will find: 01.Global overview of OT/ICS threats: key threat actors, attack trends, active campaigns, and impacted sectors.
02.Regional analysis: evolution of attacks in Spain, the European Union, and Latin America.
03.Industrial Cybercrime Landscape: ransomware, extorsion, sabotage and cyber espionage.
04.Technical profiles of APTs and hacktivists groups: tactics, tools, and targeted strategic sectors.