Cybercriminals Intensify Attacks on North America's Critical Infrastructure

Executive Summary

In early 2026, cybercriminal groups have escalated their attacks on North America's critical infrastructure, encompassing power grids, water systems, industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, healthcare, and the financial sector. These attacks leverage sophisticated malware, phishing campaigns, and exploitation of system vulnerabilities, leading to operational disruptions and substantial financial losses.

Key Threat Actors and Tactics

• Agenda Ransomware Group (Qilin): Since January 2025, the Agenda group has targeted over 700 organizations across 62 countries, with a significant number in the USA, Canada, and Europe. They employ sophisticated social engineering tactics, including fake CAPTCHA pages, to gain initial access. Once inside, they exploit backup systems, particularly Veeam infrastructure, to harvest credentials and deploy ransomware. (ics-cert.kaspersky.com)

• Werewolves Ransomware Group: Active since 2023, Werewolves has conducted phishing campaigns targeting various sectors, including banking, industrial enterprises, and retail. They utilize tools such as Anydesk, Netscan, CobaltStrike, Meterpreter, and Lockbit, employing double extortion techniques to maximize pressure on victims. (ics-cert.kaspersky.com)

• Sylvanite Group: Identified in 2025, Sylvanite acts as a "rapid exploitation broker," facilitating access for other groups like Voltzite to critical infrastructure. Voltzite has been known to gain long-term access to targets, including the U.S. electric grid. (securityweek.com)

Recent Incidents

• Water Systems: In June 2025, U.S. officials warned of Iranian cyber actors infiltrating ICS and SCADA systems managing water treatment and distribution. Disruptions in water systems can have cascading effects on healthcare, energy, and emergency services, highlighting the interconnectedness of critical infrastructure. (scpress.org)

• Healthcare Sector: Cybercriminals have increasingly targeted healthcare organizations, exploiting vulnerabilities to deploy ransomware and steal sensitive patient data. These attacks disrupt medical services and compromise patient confidentiality, underscoring the need for robust cybersecurity measures in healthcare.

Impact on Critical Infrastructure

The escalation of cyberattacks on critical infrastructure poses significant risks:

• Operational Disruptions: Attacks can lead to service outages, affecting essential services such as electricity, water supply, and healthcare.

• Financial Losses: Ransom payments, recovery costs, and potential regulatory fines can result in substantial financial burdens for organizations.

• Reputational Damage: Publicized breaches can erode trust among customers, partners, and stakeholders.

Recommendations

To mitigate these threats, organizations should consider the following measures:

• Regular Vulnerability Assessments: Conduct thorough evaluations of systems to identify and address potential weaknesses.

• Employee Training: Implement comprehensive training programs to recognize phishing attempts and other social engineering tactics.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and effective reactions to cyber incidents.

• Collaboration with Authorities: Maintain open communication channels with cybersecurity agencies and law enforcement to stay informed about emerging threats and share intelligence.

Conclusion

The increasing sophistication and frequency of cybercriminal attacks on critical infrastructure in North America necessitate a proactive and coordinated response. By implementing robust cybersecurity practices and fostering collaboration, organizations can enhance their resilience against these evolving threats.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18