The report’s data-set shows that ransomware is responsible for 80% of attacks in 2023 where the attack type could be attributed, impacting physical operations all over the world. A minority (15%) of attacks were due to hacktivists – “amateur” attackers with a political agenda. All of the year’s hacktivist attacks with physical consequences were associated with two on-going physical conflicts: The Iran-Israel proxy conflict and the Russo-Ukrainian War. These attacks brought about not just physical shutdowns but also large financial losses. High-profile incidents and trends in 2023 include:

• Over half (54%) of incidents impacted discrete or process manufacturers, in sub-industries such as electronics, automotive, marine, cosmetics, and metals.
• Numerous hacktivist attacks targeted Israeli-manufactured Unitronics Vision controllers deployed at water utilities worldwide.
• Cyberattacks caused logistical outages and delays at five sea ports in Australia and Japan.
• There were eleven (11) incidents where the victim organizations made financial disclosures or reports to the US SEC, London Stock Exchange (LSE), and other authorities,
• Two (2) novel supply chain attacks had malicious firmware code inserted into the victim’s devices that subsequently impaired operations.
• One of these attacks was cited as causing bankruptcy and mass-layoffs, adding to two similar incidents in 2022.

New insights this year stem from a detailed analysis of how attacks impair physical operations. Every incident going back to 2010 was rated by attack type, examined as to how the attack either directly or indirectly impacted the OT network or asset. 25% of attacks impacted OT networks and systems directly, and the remainder impacted operations only indirectly, but still had physical impacts.

Ransomware tactics and motivations evolved in 2023. Some ransomware groups appear to be shifting tactics to “data exfiltration only,” by stealing information without encrypting it. This is likely a factor behind a slightly slower growth in consequential OT incidents this year than in last year’s 2023 Threat Report. Also, Microsoft and SentinelLABS report that both nation-state and ransomware threat actors are now synergistically leveraging each other’s malware code and tools. I.e. not only are ransomware groups employing nation-state-grade tools and techniques, but nation-states are taking ransomware tools and re-purposing them for their own attacks.