Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf

The Dragos 2026 OT/ICS Year in Review documents a significant escalation in adversary behavior during 2025: multiple named threat groups progressed from access-building to active control-loop mapping and destructive operations, ransomware campaigns heavily impacted industrial sectors, public proof-of-concept exploits and perimeter device flaws were rapidly weaponized, and new offensive tools (including PLC-focused utilities and destructive wipers) emerged; the report details technical tradecraft, observed campaigns and regions targeted, vulnerability trends, and prioritized mitigations for OT defenders.