Cybercriminals Target North America's Critical Infrastructure Amid Rising Threats

Executive Summary

As of April 2026, cybercriminal activities targeting North America's critical infrastructure have escalated, with notable attacks on power grids, water systems, industrial control systems (ICS), healthcare facilities, and the financial sector. These attacks have led to operational disruptions, data breaches, and financial losses, highlighting the urgent need for enhanced cybersecurity measures.

Recent Incidents

• Power Grids: In Q4 2025, the Agenda ransomware group, also known as Qilin, deployed a Linux-based ransomware binary on Windows hosts by abusing legitimate remote management and file transfer tools. This attack affected more than 700 victims in 62 countries, primarily targeting organizations in developed markets and high-value industries, including the USA, France, Canada, and the UK. (ics-cert.kaspersky.com)

• Water Systems: Between July and September 2024, BlackBerry detected 600,000 attacks against critical infrastructure, with 45% targeting the financial sector. (blackberry.com) While the report does not specify the water sector, the high volume of attacks indicates a significant threat to water systems.

• Industrial Control Systems (ICS): Hacktivist groups such as Z-Pentest, Dark Engine, and Sector 16 have increasingly targeted ICS and operational technology (OT) environments, including Supervisory Control and Data Acquisition (SCADA) interfaces and Virtual Network Computing (VNC) environments. (scworld.com)

• Healthcare: In Q4 2025, the Agenda ransomware group targeted healthcare organizations, deploying ransomware that led to data breaches and operational disruptions. (ics-cert.kaspersky.com)

• Financial Sector: BlackBerry's report indicates that 45% of the 600,000 attacks detected between July and September 2024 targeted the financial sector, leading to data breaches and financial losses. (blackberry.com)

Threat Actor Profiles

• Agenda (Qilin) Ransomware Group: This cybercriminal group has been active since January 2025, deploying sophisticated ransomware attacks targeting high-value industries, including healthcare and financial services. (ics-cert.kaspersky.com)

• Hacktivist Groups: Groups like Z-Pentest, Dark Engine, and Sector 16 have evolved from traditional cyberattacks to targeting critical infrastructure, including ICS and OT environments, often aligning with geopolitical interests. (scworld.com)

Impact Assessment

The escalation of cybercriminal activities poses significant risks to North America's critical infrastructure:

• Operational Disruptions: Attacks on power grids and water systems can lead to widespread service outages, affecting daily life and economic activities.

• Data Breaches: Healthcare and financial sector attacks result in unauthorized access to sensitive personal and financial information, leading to privacy violations and potential financial fraud.

• Financial Losses: Ransomware attacks demand substantial payments, and recovery costs can be significant, impacting organizational budgets and resources.

Recommendations

To mitigate these threats, organizations should consider the following measures:

• Enhanced Monitoring: Implement continuous monitoring of critical infrastructure components to detect and respond to anomalies promptly.

• Employee Training: Conduct regular cybersecurity training to raise awareness about phishing and social engineering tactics.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift recovery from cyber incidents.

• Collaboration: Engage in information sharing with industry peers and government agencies to stay informed about emerging threats and best practices.

Conclusion

The increasing sophistication and frequency of cybercriminal attacks on critical infrastructure in North America underscore the need for robust cybersecurity strategies. Proactive measures, continuous vigilance, and collaboration are essential to safeguard these vital systems from evolving cyber threats.

Highlights:

• Why cyber attacks on critical national infrastructure are such a huge threat, Published on Wednesday, March 18
• Taiwanese infrastructure suffered over 2.5 million Chinese cyberattacks per day in 2025, report reveals, Published on Monday, January 05
• U.S. braces for cyberspace retaliation from Iran, Published on Tuesday, March 03