Ransomware Groups Intensify Attacks on North American Critical Infrastructure

Executive Summary

In early 2026, ransomware groups have significantly escalated cyberattacks targeting North America's critical infrastructure, including power grids, water systems, and healthcare sectors. Notably, the Qilin ransomware group has emerged as a dominant threat actor, accounting for 13% of global ransomware incidents in 2025. (nccgroup.com)

Threat Landscape Overview

The year 2025 witnessed a 50% increase in global ransomware attacks compared to 2024, with North America bearing the brunt of this surge. The United States experienced approximately 21% of all global ransomware activity, followed by Canada. (prnewswire.com)

Targeted Sectors

• Power Grids: Ransomware groups have targeted power grids, aiming to disrupt energy distribution and demand ransoms for restoration.

• Water Systems: Cyberattacks on water systems have led to concerns over water quality and availability, with incidents involving tampering with water pressure valves and automated tank gauges. (techradar.com)

• Healthcare: The healthcare sector has been a prime target, with ransomware groups exploiting vulnerabilities to access sensitive patient data and disrupt medical services.

Notable Threat Actors

• Qilin: A ransomware-as-a-service (RaaS) operator, Qilin has been identified as the top threat actor, responsible for 13% of global ransomware attacks in 2025. (nccgroup.com)

• Akira: This group has been active since at least June 2025, targeting small- and medium-sized businesses, as well as larger organizations across various sectors, including healthcare and public health. (ics-cert.kaspersky.com)

Attack Vectors and Techniques

Ransomware groups employ various tactics to gain initial access, including drive-by downloads, fake updates, and phishing campaigns. Once inside, they deploy malware such as PowerShell-based remote access tools (RATs), keyloggers, and remote access tools like AnyDesk and PuTTY. These tools facilitate lateral movement within networks, data exfiltration, and the deployment of ransomware payloads. (techradar.com)

Impact and Implications

The escalation in ransomware attacks poses significant risks to national security and public safety. Disruptions in critical infrastructure can lead to widespread societal impacts, including energy shortages, compromised water safety, and hindered healthcare services. The financial sector is also at risk, with potential for data breaches and financial losses.

Recommendations

• Enhanced Cyber Hygiene: Organizations should implement robust cybersecurity measures, including regular system patching, multi-factor authentication, and network segmentation.

• Incident Response Planning: Develop and regularly update incident response plans to ensure swift and coordinated responses to cyber incidents.

• Collaboration and Information Sharing: Engage in information sharing with industry peers and government agencies to stay informed about emerging threats and best practices.

Conclusion

The threat landscape for North America's critical infrastructure has evolved, with ransomware groups increasingly targeting essential services. Proactive measures, continuous monitoring, and inter-sector collaboration are vital to mitigate these threats and ensure the resilience of critical infrastructure.

Highlights:

• FBI urges users to beware worrying Interlock ransomware attacks, Published on Wednesday, July 23
• Canadian government claims hacktivists are attacking water and energy facilities, Published on Friday, October 31
• 'An all-time high': Number of ransomware groups exploded in 2025 as victim growth rate doubled - with Qilin dominating the landscape, Published on Wednesday, February 18