November 19, 2025
Trellix recently unveiled its Operational Technology Threat Report, which showed an increase in OT/ICS targeting by state-sponsored actors and ransomware groups across the manufacturing, transportation and shipping, utilities, and energy/oil and gas sectors. Additionally:
- Manufacturing emerged as the primary target, representing 41.5 percent of all detections.
- 61.8 percent of ransomware incidents targeted manufacturing, indicating systematic disruption of production capabilities.
- There has been a notable increase in coordinated attacks, with state-sponsored actors and ransomware groups, such as the Sandworm Team and Qilin, targeting the OT sector.
- The most significant trend defining the current OT threat landscape is the strategic focus on the IT/OT boundary, exploiting insufficient network segmentation. IT-to-OT pivoting can occur through compromised engineering workstations, shared credentials, and exploitation of remote-access solutions.
- Threat actors are not only exploiting technical vulnerabilities, but also employing social engineering tactics to manipulate human behavior.
The report stresses a proactive security strategy, which should include the following.
- Architecture hardening.
- To address IT-to-OT pivoting, organizations should implement robust network segmentation in accordance with ISA/IEC-62443 standards with dedicated security zones for OT networks and controlled access points between IT and OT environments.
- Deploy network detection and response to prevent lateral movement.
- Harden endpoints with anti-malware and integrity control software to prevent unauthorized software or changes.
- Leverage the NIST Cybersecurity Framework, incorporating OT-specific controls, with a focus on asset inventory, risk-based vulnerability management, and incident response procedures.
- Implement and operationalize monitoring systems such as SIEM for visibility into both IT and OT environments.
- OT supply chain security.
- Enrich vulnerability management data with CVE intelligence and attack path analysis, ensuring that the most important patches are applied first.
- Zero-trust vendor access. Treat all external connections—including those from long-term integrators or OEMs—as untrusted. Enforce granular, time-bound credentials, device control and session monitoring for all remote maintenance.
- Software assurance and SBOM visibility. Require vendors to provide software bills of materials (SBOMs), validate digital signatures, and monitor for tampered or outdated components in updates.
- Vendor accountability. Embed cybersecurity clauses into supplier contracts, mandating secure update practices, vulnerability disclosure, and immediate reporting of incidents that could affect OT environments.
- Network segmentation and continuous monitoring. Ensure supplier-facing gateways are isolated from production networks, and maintain visibility over outbound traffic that could signal unauthorized data exchange or command activity.
- Enhanced training and readiness. Regular training sessions that coach employees about emerging threats, phishing attempts, and safe handling of sensitive information can significantly reduce risks.
- Collaboration and intelligence sharing. Public-private information sharing, industry forums, and security alliances can serve as valuable resources for exchanging insights on emerging threats and best practices for fortifying defenses.
The report states that by addressing these multifaceted strategies, organizations can better safeguard their operational technologies and critical infrastructure against emerging threats. As the digitalization of industrial environments continues, those proactive in enhancing their operational resilience will be better positioned to navigate the complexities of OT security.
