About ten days before ransomware hit a Japanese beer and beverage maker in September 2025, attackers got into its network through equipment at one of its sites. A weak password gave them administrator rights. They poked around the servers, mostly after business hours. On September 29 they encrypted the systems.
Production stopped. Beer was back within days, but orders and shipments took months to return to normal. The Qilin group claimed the attack.
That story is one data point in a bigger count. Black Kite recorded 1,183 disclosed ransomware incidents at manufacturers through July 29, 2026, up nearly 40% on the same stretch of 2025. Qilin alone was tied to 178 of the incidents in the first seven months of 2026, the most of any group in Black Kite’s data.
How Qilin works
Qilin sells ransomware as a service. Its operators supply the malware, and affiliates run the attacks in exchange for a cut of any ransom. The affiliates steal files and lock up systems, and victims are told to pay twice over: once to get access back, once to keep the stolen files from being published.
On October 8, 2026, Japan’s National Police Agency said Japanese police had detained a Russian national suspected of leading Qilin and handed him over to Germany.
Two other cases show the range. In November 2023 a cyberattack on an automotive parts supplier stopped some assembly lines at a carmaker it supplied; Qilin claimed it, though the supplier had not confirmed that when the report appeared. In September 2026 an electronics manufacturer had files on its servers locked and cut off its internal network. The attack was linked to Qilin, but the company has not named the group.
Why factories are easy to move through
Trevor Dearing, director of critical infrastructure solutions at Illumio, says the problem is rarely the age of a machine. “It’s what has access to it, and what attackers can reach,” he said. Industrial Cyber described plants where old and new systems share flat networks, with few internal barriers, shared passwords and open supplier access. Cisco Talos saw Qilin attackers steal credentials, move between systems and encrypt files across network shares.
An engineering workstation is a bigger prize than a single controller. “An engineering workstation can be connected to far more of the factory than an individual controller,” Dearing said. Historians, domain controllers, manufacturing execution systems and OPC servers can also open broad access.
His advice starts with a map. Know what each system connects to and what it needs to connect to, and check whether remote desktop is running somewhere it shouldn’t. If a device can’t be patched today, restrict what can reach it. Supplier access should run through a gateway the plant controls, with the user authenticated and the session monitored, and not become blanket access to the manufacturing environment.
Joint guidance on secure operational technology connectivity, released in January 2026 by the UK’s National Cyber Security Centre, CISA, the FBI and other international partners, recommends controlled remote access and testing isolation plans. “You need to decide in advance what you’ll isolate if something goes wrong,” Dearing said.
