Cybercriminals Intensify Attacks on North America's Critical Infrastructure

Executive Summary

In the first quarter of 2026, cybercriminal groups have significantly intensified their attacks on North America's critical infrastructure. These operations have targeted essential sectors, including power grids, water systems, industrial control systems (ICS), healthcare, and the financial sector, leading to substantial operational disruptions and posing heightened national security risks.

Key Developments

• Surge in Ransomware Attacks: Between January and September 2025, global ransomware incidents targeting critical industries increased by 34% compared to the previous year. Notably, the United States accounted for approximately 21% of these attacks, underscoring the nation's prominence as a primary target. (prnewswire.com)

• Targeted Sectors: The financial sector emerged as a primary target, with 45% of cyberattacks on critical infrastructure in the third quarter of 2024 directed at this industry. (blackberry.com) Additionally, the manufacturing sector experienced a 61% year-over-year increase in attacks, highlighting the expanding scope of cybercriminal activities. (prnewswire.com)

• Hacktivist Activities: Hacktivist groups have evolved beyond traditional cyberattacks, increasingly targeting ICS and OT environments. Between December 2024 and December 2025, several hacktivist groups, including Z-Pentest, Dark Engine, and Sector 16, focused on ICS and OT attacks, employing ransomware, breaches, and data leaks. (scworld.com)

Notable Incidents

• St. Paul Cyberattack: In July 2025, Saint Paul, Minnesota, experienced a significant cyberattack that led to the activation of the Minnesota National Guard and a declaration of a state of emergency. The attack disrupted core city systems, including internal networks and public services. (en.wikipedia.org)

• Collins Aerospace Attack: In April 2025, a cyberattack on Collins Aerospace's airport check-in system disrupted travel across Europe, illustrating the potential for cyberattacks to cause widespread operational disruptions. (itpro.com)

Threat Actor Profiles

• Qilin: Identified as a leading threat actor, Qilin was responsible for 13% of global ransomware attacks in 2025, indicating a high level of sophistication and operational capacity. (nccgroup.com)

• Hacktivist Groups: Groups such as Z-Pentest, Dark Engine, and Sector 16 have increasingly targeted ICS and OT environments, employing advanced tactics and aligning with nation-state interests. (scworld.com)

Recommendations

• Enhanced Cybersecurity Measures: Organizations should implement robust cybersecurity protocols, including regular system updates, employee training, and incident response planning.

• Collaboration and Information Sharing: Strengthening collaboration between public and private sectors is essential for effective threat intelligence sharing and coordinated response efforts.

• Investment in Resilience: Investing in resilient infrastructure and backup systems can mitigate the impact of potential cyberattacks on critical services.

Conclusion

The escalation of cybercriminal activities targeting critical infrastructure in North America presents a significant challenge to national security and public safety. Proactive measures, including enhanced cybersecurity practices, inter-sector collaboration, and infrastructure resilience, are imperative to safeguard essential services against evolving cyber threats.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18
• Canadian government claims hacktivists are attacking water and energy facilities, Published on Friday, October 31
• U.S. braces for cyberspace retaliation from Iran, Published on Tuesday, March 03