Ransomware Threats to North American Critical Infrastructure: A 2026 Assessment

Executive Summary

As of April 2026, ransomware attacks on North American critical infrastructure have intensified, with threat actors employing sophisticated tactics to disrupt essential services. Notably, groups such as Qilin and Akira have been identified as primary perpetrators, targeting sectors including energy, water systems, and healthcare.

Current Threat Landscape

In 2025, global ransomware incidents surged by 50% year-on-year, reaching 7,874 attacks worldwide. North America was particularly affected, accounting for 56% of these incidents. The industrial sector emerged as a primary target, with 28% of attacks directed at critical industries. (nccgroup.com)

Key Threat Actors

• Qilin: Dominated the ransomware landscape in 2025, responsible for 13% of global attacks. (nccgroup.com)

• Akira: Gained prominence by exploiting vulnerabilities in virtualization platforms, including Nutanix AHV, and employing stolen or brute-forced VPN and SSH credentials for network access. (ics-cert.kaspersky.com)

Targeted Sectors

• Energy Sector: Attacks have targeted power grids and renewable energy plants, aiming to disrupt energy distribution and cause widespread outages.

• Water Systems: Incidents have involved tampering with water pressure valves and other critical components, posing risks to public health and safety. (techradar.com)

• Healthcare: Hospitals and healthcare providers have been targeted, leading to data breaches and operational disruptions that compromise patient care.

Tactics and Techniques

Ransomware groups are increasingly adopting double-extortion tactics, where data is both encrypted and exfiltrated, with threats of public release to pressure victims into paying ransoms. Additionally, the use of ransomware-as-a-service (RaaS) models has lowered the entry barrier for cybercriminals, leading to a proliferation of attacks. (techradar.com)

Mitigation Strategies

To address the escalating threat, organizations should consider the following measures:

• Regular System Updates: Ensure all systems, including industrial control systems (ICS) and operational technology (OT), are up-to-date with the latest security patches.

• Network Segmentation: Implement network segmentation to limit the lateral movement of attackers within critical infrastructure.

• Employee Training: Conduct regular cybersecurity awareness training to recognize phishing attempts and other social engineering tactics.

• Incident Response Planning: Develop and regularly update incident response plans to ensure a swift and coordinated response to cyber incidents.

Conclusion

The threat of ransomware attacks on North American critical infrastructure remains significant, with evolving tactics and increasingly sophisticated threat actors. Proactive measures, including system hardening, employee education, and robust incident response planning, are essential to mitigate these risks and ensure the resilience of critical services.

Highlights:

• FBI urges users to beware worrying Interlock ransomware attacks, Published on Wednesday, July 23
• Canadian government claims hacktivists are attacking water and energy facilities, Published on Friday, October 31
• 'An all-time high': Number of ransomware groups exploded in 2025 as victim growth rate doubled - with Qilin dominating the landscape, Published on Wednesday, February 18