Manufacturing Hit by 22% of Ransomware Attacks in H1 2026 — Detection and Hardening Guide for Industrial Defenders

New data from Black Kite confirms what those of us running incident response engagements have been seeing on the ground for the past eighteen months: manufacturing remains the single most-targeted sector for encryption-based attacks, accounting for 22% of all ransomware victims, and the volume of incidents in the first half of 2026 jumped sharply compared to prior periods.

This is not a statistical curiosity. Manufacturing is targeted deliberately and systematically because the economics favor the attacker. Production downtime is measured in hundreds of thousands of dollars per hour, OT environments often cannot tolerate aggressive security tooling, and the pressure to restore operations drives payment rates that other sectors don't match. Ransomware operators — particularly the established RaaS crews and their affiliates — know this. They have industrialized their targeting of the sector accordingly.

If you defend a manufacturing organization, this report is your mandate to act. If you advise one, this is the data to put in front of the board. Below is my breakdown of why the sector is under siege, what the attack chains actually look like in 2026, and the specific detections and hardening steps your team should implement this week.

Why Manufacturing: The Attacker's Calculus

In the IR engagements I've led over the past two years, the same structural weaknesses appear again and again in manufacturing victims:

1. Asymmetric downtime cost. A hospital can divert patients. A law firm can work from paper. A production line either runs or it doesn't. Attackers price their ransom demands against your downtime cost, and manufacturing downtime costs are among the highest of any vertical.

2. Flat networks bridging IT and OT. The corporate network and the plant floor are frequently separated by little more than a VLAN and good intentions. Once an operator lands on a domain-joined system, lateral movement toward historians, HMI terminals, and engineering workstations is often trivial.

3. Legacy and unpatchable assets. Engineering workstations running decade-old operating systems, vendor-managed equipment under warranty restrictions, and 24/7 uptime requirements create a patch cadence measured in quarters or years — if ever.

4. Third-party exposure. Black Kite's specialty is supply-chain visibility, and their findings here matter: manufacturers sit at the center of dense supplier ecosystems. A compromised managed service provider, a vulnerable file-transfer appliance, or a phished logistics partner has become the most common entry point into otherwise defensible environments.

5. Under-resourced security teams. Manufacturing CISOs consistently report smaller security budgets relative to revenue than financial services or healthcare peers. Many mid-market manufacturers have no 24/7 monitoring at all.

What the 2026 Attack Chain Looks Like

While specific intrusion sets vary by operator, the encryption-based incidents we respond to in manufacturing environments follow a remarkably consistent kill chain:

1. Initial access — Phishing with malicious attachments or links targeting plant and administrative staff; exploitation of internet-facing remote access (VPN concentrators, RDP gateways, remote monitoring and management tooling); or access purchased from initial access brokers.
2. Persistence and credential theft — Dropped webshells, abuse of legitimate RMM tools (which blend into environments that legitimately use them), and credential dumping from memory on high-value hosts.
3. Lateral movement — RDP and SMB propagation, frequently using valid domain admin credentials harvested earlier. This is the stage where poor IT/OT segmentation converts a business-network incident into a production-stopping event.
4. Defense evasion and impact preparation — Disabling EDR where possible, deleting Volume Shadow Copies to destroy local recovery options, and clearing event logs.
5. Exfiltration and encryption — Staged data theft (for double-extortion leverage) followed by mass encryption, typically executed after hours or over weekends when detection coverage is thinnest.

The entire chain — from initial access to detonation — now routinely completes in under 72 hours for mature operators. Dwell time measured in weeks is increasingly the exception, not the rule.

Detection & Response

The detections below target the highest-fidelity, lowest-noise behaviors in the pre-encryption and impact phases — the window where a SOC can still change the outcome. These are tuned for manufacturing environments where legitimate administrative activity must be respected.

SIGMA Detections

---
title: Shadow Copy Deletion via vssadmin or wmic
description: Detects deletion of Volume Shadow Copies, a near-universal precursor to ransomware detonation. Legitimate use is rare outside of backup administration windows.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
status: experimental
id: 3f7a2c91-8e4d-4b6a-9c1f-2d5e7a8b9c01
date: 2026/07/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators performing shadow storage maintenance during approved windows
  - Some backup agents resizing shadowstorage during configuration
level: high
---
title: Suspicious bcdedit Boot Configuration Tampering
description: Detects modification of boot configuration to disable recovery options, commonly executed by ransomware prior to encryption to prevent rollback into recovery environments.
references:
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
status: experimental
id: 8b3d4e52-1f6a-4c7b-a2d9-3e6f8a0b1c24
date: 2026/07/15
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  condition: selection
falsepositives:
  - Rare system administration; virtually never legitimate on servers or engineering workstations
level: high
---
title: Windows Event Log Clearing on Server or Workstation
description: Detects clearing of the Security, System, or Application event logs — a common defense-evasion step immediately preceding ransomware execution and lateral movement.
references:
  - https://attack.mitre.org/techniques/T1070.001/
author: Security Arsenal
status: experimental
id: 5c9e1f38-7a2b-4d8e-b3c6-4f7a9b0d2e15
date: 2026/07/15
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - 'clear-log'
  condition: selection_wevtutil
falsepositives:
  - Scripted log rotation in some legacy environments — baseline and suppress known-good scripts by path
level: medium

KQL — Microsoft Sentinel / Defender for Endpoint Hunt

This query hunts for the classic pre-encryption sequence: shadow copy deletion, boot tampering, and log clearing occurring on the same host within a short window. A single host exhibiting two or more of these behaviors within one hour is a high-priority IR trigger, not an alert to queue.

let PreEncryptionCommands = dynamic(["delete shadows", "resize shadowstorage", "shadowcopy delete", "recoveryenabled no", "bootstatuspolicy ignoreallfailures", "wevtutil cl", "clear-log"]);
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wevtutil.exe", "powershell.exe", "cmd.exe")
| where ProcessCommandLine has_any (PreEncryptionCommands)
| summarize
    BehaviorCount = dcount(ProcessCommandLine),
    Behaviors = make_set(ProcessCommandLine, 10),
    FirstSeen = min(TimeGenerated),
    LastSeen = max(TimeGenerated),
    Accounts = make_set(AccountName, 5)
    by DeviceName, bin(TimeGenerated, 1h)
| where BehaviorCount >= 2
| order by LastSeen desc

For environments ingesting syslog from Linux infrastructure and network gear into Sentinel, also watch for mass file-write anomalies and unexpected SMB traversal from a single source host touching many destinations in short succession — that pattern is your lateral-movement tripwire between IT and OT segments.

Velociraptor VQL — Endpoint Hunt for Impact-Phase Artifacts

-- Hunt for shadow copy deletion, boot tampering, and log clearing across the fleet
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowstorage|shadowcopy delete|recoveryenabled no|ignoreallfailures|wevtutil.{0,10}cl|clear-log)'

Deploy this as a fleet-wide hunt. Any hit on a server, historian, or engineering workstation warrants immediate triage — these commands have almost no legitimate standing in a production manufacturing environment outside of controlled maintenance windows.

Hardening Script — Windows (PowerShell)

# ============================================================
# Ransomware pre-impact hardening and verification — run as Administrator
# 1. Verify Shadow Copies are enabled and scheduled on critical volumes
# 2. Enable Controlled Folder Access (ransomware protection) via Defender
# 3. Enable Attack Surface Reduction rules targeting ransomware precursors
# 4. Audit who can clear event logs and delete shadow copies
# ============================================================

# --- 1. Shadow copy status ---
Write-Host "[*] Checking Volume Shadow Copy status..." -ForegroundColor Cyan
Get-WmiObject Win32_ShadowCopy | Select-Object DeviceObject, InstallDate | Format-Table -AutoSize
vssadmin list shadows

# --- 2. Enable Controlled Folder Access ---
Write-Host "[*] Enabling Controlled Folder Access..." -ForegroundColor Cyan
Set-MpPreference -EnableControlledFolderAccess Enabled
# Protect custom directories (adjust paths for your environment, e.g., historian export shares)
# Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\PlantData","E:\HistorianExports"

# --- 3. Attack Surface Reduction rules ---
# Block Office child processes, credential theft from lsass, and abuse of vulnerable signed drivers
$asrRules = @{
    "d4f940ab-401b-4efc-aadc-ad5f3c50688a" = 1  # Block Office apps from creating child processes
    "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2" = 1  # Block credential stealing from lsass.exe
    "56a863a9-875e-4185-98a7-b882c64b5ce5" = 1  # Block abuse of exploited vulnerable signed drivers
    "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c" = 1  # Block Adobe Reader child processes
    "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4" = 1  # Block untrusted/unsigned processes from USB
}
foreach ($rule in $asrRules.GetEnumerator()) {
    Add-MpPreference -AttackSurfaceReductionRules_Ids $rule.Key -AttackSurfaceReductionRules_Actions $rule.Value
    Write-Host "[+] ASR rule $($rule.Key) set to Block"
}

# --- 4. Verify tamper protection and cloud protection ---
Set-MpPreference -DisableRealtimeMonitoring $false
Write-Host "[*] Current Defender status:" -ForegroundColor Cyan
Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, IsTamperProtected, AntivirusSignatureLastUpdated | Format-List

# --- 5. Restrict wmic/vssadmin abuse via AppLocker note ---
Write-Host "[!] RECOMMEND: Deploy AppLocker or WDAC policy restricting vssadmin.exe, bcdedit.exe, wmic.exe, and wevtutil.exe to authorized admin accounts on servers and engineering workstations." -ForegroundColor Yellow

Test ASR rules in Audit mode first in any environment with legacy line-of-business or OT-adjacent software — some older applications legitimately trigger Office child-process and driver rules. Roll to block mode progressively, starting with servers and standard user workstations.

Remediation and Strategic Actions

There is no patch for being the most-attacked sector. The response here is architectural and operational:

1. Segment IT from OT — for real this time. Enforce a demilitarized zone between business and production networks. Engineering workstations should not be able to reach domain controllers, and business users should never reach HMI or historian networks. If a ransomware operator on a receptionist's laptop can reach your production floor, your segmentation exists only on a Visio diagram.

2. Make backups ransomware-proof. Offline or immutable (object-lock) backups, tested restores, and backup infrastructure on separate credentials from your production domain. Deleting shadow copies is step one of every encryption playbook because it works — ensure your recovery does not depend on anything an attacker with domain admin can touch.

3. Harden remote access. The top initial-access vectors we see in manufacturing IR cases are internet-facing remote access and third-party/RMM tooling. Enforce MFA on everything externally reachable, inventory every RMM tool in the environment, and block unauthorized ones at the application-control layer.

4. Manage your third-party exposure. Black Kite's data is a supply-chain warning as much as a sector warning. Your exposure includes every MSP, logistics partner, and software vendor with access to your environment or data. Tier your vendors by access level and monitor their security posture continuously — point-in-time questionnaires did not prevent the incidents driving this 22% figure.

5. Get 24/7 detection coverage. The majority of encryption detonations occur outside business hours precisely because attackers know when manufacturing SOCs go dark. If you cannot staff around the clock internally, that is the specific gap a managed detection and response provider exists to close.

6. Exercise the scenario. Run a tabletop where the scenario is: "Encryption detonates at 2 a.m. Saturday on the domain controller and two historians simultaneously." If the room goes quiet on the question of who has authority to shut down production, you have found your most important gap — and it isn't technical.

The Black Kite numbers will not improve on their own. Manufacturing's attractiveness to ransomware operators is structural, and until downtime economics change, the targeting won't either. What can change — starting this week — is how much of that 22% your organization is prepared to survive.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub