Operational Technology Threat Report October 2025

This document is an Operational Technology Threat Report for October 2025, detailing the threats faced by operational technology (OT) and industrial control systems (ICS) from April 1 to September 30, 2025. It outlines the detection of over 272,000 OT/ICS-related threats across various sectors, with a significant number of ransomware attacks targeting critical infrastructure. The report identifies key threat actors, including state-sponsored groups and ransomware organizations, and highlights the manufacturing, transportation, and utilities sectors as primary targets. The analysis reveals that geopolitical tensions have intensified the threat landscape, with actors from Russia, Iran, and North Korea expanding their activities. The document discusses specific groups such as Sandworm Team and TEMP.Veles, detailing their tactics and impacts on industrial systems. It emphasizes the need for enhanced security measures and resilience strategies to protect against these evolving threats, particularly in the context of increasing cyber-physical disruptions.