If you're a CISO in manufacturing right now, two names should be living rent-free in your incident response plan: Qilin and Akira.

Together, these two ransomware-as-a-service operations account for a significant share of attacks targeting factories, suppliers, and critical infrastructure, and the numbers keep climbing. In Q2 2026 alone, threat intelligence reports tracked. 1,140 ransomware incidents affecting industrial organizations, a 12% jump from Q1, with manufacturing absorbing 747 of them - 65% of the total. Qilin and Akira ranked as the top two groups in that period, with 140 and 129 claims respectively. 
The situation has escalated further. NCC Group reported that global ransomware activity hit a 2026 high in August with 1,073 recorded attacks, with the industrial sector bearing 31% of them and Qilin alone responsible for 164 confirmed incidents - roughly 15% of all attacks globally that month. 

This isn't a spike. It's a structural shift in where ransomware groups hunt. Let's break down how these two operations actually work - because understanding their playbooks is the difference between containing an incident in hours and watching a production line go dark for weeks.

Why Manufacturing Became the Bullseye 

Manufacturing has quietly become the most targeted sector in ransomware, and it isn't close. Sophos X-Ops tracked leak-site activity through 2025 and identified Akira, Qilin, and Play as the most active groups against manufacturing and production organizations, with Qilin alone claiming 1,034 attacks globally that year. 

The reasons are brutally simple: 

1. Downtime is existential. A retailer can lose a day of e-commerce sales. A manufacturer loses a day of perishable inventory, broken supply chain commitments, and contractual penalties. Every hour offline has a price tag, and ransomware groups know it. 

2. Legacy systems and long patch cycles. OT environments run equipment with 15–20-year lifespans. You can't just reboot a PLC line controller on Patch Tuesday. 

3. Flat, interconnected networks. IT and OT convergence means a compromised VPN credential in the office can become a stopped production line on the floor. 

4. IP as leverage. Design files, supplier contracts, proprietary process documentation - these carry extortion value that financial records alone never will. 

A September 2025 attack on Asahi Group Holdings illustrates the multiplier effect. Qilin encrypted production and logistics systems across six breweries and multiple soft drink plants, threatened to leak exfiltrated corporate and employee data, and forced a reversion to manual order handling. The result: an estimated 40% drop in soft drink sales, with full system restoration projected to stretch into early 2026. 

Group Profile: Qilin - The Volume King 

Origins and Rise 

Qilin first surfaced in 2022 under the name "Agenda" and spent its early years as a mid-tier player - 45 attacks in 2023, 179 in 2024. Then April 2025 happened. RansomHub, then one of the most active groups in the world, abruptly went offline. Its affiliates - skilled operators with established access pipelines - migrated en masse to Qilin's RaaS platform. Victim counts jumped 56% almost immediately. 

By October 2025, Qilin accounted for 29% of all global ransomware attacks. In the first two weeks of January 2026 alone, the group posted more than 55 new victims - ahead of its record 2025 pace. 

How Qilin Operates 

Qilin runs a Rust-based RaaS platform with double extortion as the standard model. The affiliate network is the product - operators bring their own initial access, which makes Qilin's attack chains vary significantly by intrusion. Common threads from 2025–2026 incident response reporting: 

• Initial access via internet-facing infrastructure. GlobalProtect appliances (exploiting CVE-2026-0257 in a wave of June 2026 intrusions), Check Point Remote Access VPN authentication-bypass vulnerabilities, and stolen credentials. 

• Credential harvesting at scale. LSASS memory dumping (staged to an unusual .odt extension to evade file-type monitoring), NTDS.dit extraction via ntdsutil, and browser credential theft pushed through Group Policy scripts. 

• Hypervisor-aware encryption. Qilin affiliates have been observed encrypting ESXi hosts, taking down dozens of VMs from a single foothold. 

• Cloud-based exfiltration. Rclone to MEGA storage, ProtonDrive, and FileZilla are recurring tools in investigated intrusions. 

Arctic Wolf's investigation of the June 2026 CVE-2026-0257 intrusions is instructive: the entry point was consistent, but post-exploitation varied wildly - from rapid encryption-only strikes with minimal dwell time to full double-extortion campaigns with extensive reconnaissance and data theft. That's the RaaS model in action: one exploit, many operators, unpredictable outcomes. 

Perhaps most concerning for defense planners: Qilin has now been deployed by state-linked actors. In 2025, Microsoft observed North Korea's Moonstone Sleet deploying Qilin ransomware - the first reported instance of a state actor using a third-party RaaS strain instead of custom tooling. 

Notable 2026 Activity 

• WireCo (USA, August 2026): Qilin claimed a significant data breach against the U.S. manufacturing firm, threatening full publication of stolen data. 

• ATF breach (August 2026): The group targeted the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives - a signal that government operations are in scope. 

• MSP targeting: A single South Korean MSP breach in 2025 gave Qilin access to 28 downstream organizations simultaneously, with over 2 TB of stolen data. 

Group Profile: Akira - The Highest Earner 

Origins and Economics 

Akira emerged in March 2023, widely assessed as inheriting personnel and tooling from the dissolved Conti group. It runs a more closed RaaS model, with affiliates vetted through Russian-language cybercrime forums. 

The money tells the story. According to the FBI, CISA, DC3, and HHS joint advisory updated in November 2025, Akira has collected over $244 million in ransoms since March 2023, favoring manufacturing, education, IT, healthcare, financial services, and food/agriculture targets. 

TRM Labs' blockchain analysis found Akira took in over $150 million in 2025 alone - nearly twice the proceeds of the second-most-active strain - and that the group has rotated its money-laundering infrastructure at least four times to stay ahead of enforcement. 

How Akira Operates 

Akira's calling card is speed and virtualization focus. Halcyon research published in 2026 found the group can move from initial access to full network encryption in under four hours - and in some late-2025 campaigns, dwell time dropped as low as 55 minutes. 

The kill chain: 

1. Initial access: Exploiting VPN concentrators without MFA - Cisco ASA (CVE-2020-3259, CVE-2023-20269), SonicWall SSL VPNs (a surge that began in July 2025), and exposed RDP. Stolen credentials and spearphishing fill the gaps. 

2. Discovery: AdFind, SharpHound/BloodHound, and Advanced IP Scanner to map Active Directory, locate domain controllers, and - critically - find backup repositories and hypervisors. 

3. Defense evasion: BYOVD (Bring Your Own Vulnerable Driver) attacks to terminate EDR processes at kernel level, plus backup wiping - Finland's NCSC-FI has specifically warned that Akira deletes backups to cripple recovery. 

4. Lateral movement: Mimikatz credential dumping, exploitation of CVE-2023-27532 in Veeam Backup & Replication to steal stored credentials, and persistence via AnyDesk, RustDesk, and LogMeIn. 

5. Encryption with a twist: A hybrid ChaCha20 + RSA scheme, with file extensions including .akira, .powerranges, .akiranew, and .aki. 

The Hypervisor Play 

Akira was among the first major groups to ship a Linux/ESXi variant within weeks of its debut, encrypting dozens of VMs from a single compromised host with vmonly and stopvm switches. In June 2025, it became one of the first to specifically target Nutanix AHV virtual machine disk files - a confirmed capability in the November 2025 CISA advisory update. 
For manufacturers running hyper-converged infrastructure, this is the nightmare scenario: one ESXi or AHV host compromise can take out MES systems, historians, engineering workstations, and the virtualization layer backing your entire OT-adjacent stack in a single pass. 

Notable Victims 

• Tietoevry (Sweden, January 2024): One datacenter breach cascaded to 120+ government agencies and universities, the Primula payroll system, and retail chains forced to close physical stores. The definitive MSP blast-radius case study. 

• Nissan Oceania (December 2023): 100GB stolen, including customer loan data and tax file numbers for ~100,000 people. 

• Hitachi Vantara (April 2025): Ransomware detection forced servers offline, disrupting manufacturing and remote support operations. 

• Peikko Group (Finland, December 2024): 30GB of internal documents claimed, disrupting 12 factories. 

• Alkegen (2026): Akira claimed an attack on the advanced materials manufacturer. 

• The insurance precedent: After the City of Hamilton attack, the insurer denied a $5 million claim because the city hadn't fully implemented MFA - a warning that Akira's favorite entry vector now correlates directly with financial ruin even when insurance exists. 

The Trend That Should Worry OT Leaders Most: Data Theft-Only Extortion 

The extortion model is shifting away from encryption toward data theft-only operations, no payload deployed, no systems encrypted, just quiet data exfiltration followed by a leak threat.

Why does this matter for OT? Because your traditional ransomware defenses - immutable backups, fast restore, EDR on endpoints - address the encryption problem. They do nothing when the attacker's leverage is a folder of PLC configurations, SCADA network diagrams, and supplier pricing agreements walking out the door via Rclone to a MEGA bucket at 2 a.m. Sophos noted Akira experimenting with exfiltration without encryption as early as 2023. 

In these attacks, the "incident" isn't loud. There's no ransom note, no locked screens. The first sign is often a leak-site posting - which means egress monitoring and data classification are now production-safety controls, not just compliance items. 

Qilin vs. Akira at a glance 

What CISOs Should Actually Do: A Defense Checklist 

Neither Qilin nor Akira relies on exotic zero-days for most intrusions. They exploit perimeter hygiene, MFA gaps, and flat networks. That means most of their success is preventable. Priorities, in order: 

1. Kill the VPN-without-MFA problem. Akira's single most reliable entry vector is a VPN account without MFA. This should be a zero-exceptions policy - including service accounts, which attackers deliberately target because they often escape MFA enforcement. 

2. Patch and segment the edge. The June 2026 Qilin wave ran entirely through CVE-2026-0257 on unpatched firewalls. Treat perimeter appliances as crown-jewel attack surface: patch SLAs in days, not months, and monitor vendor threat-bulletin feeds actively. 

3. Protect the hypervisor layer separately. Dedicated admin accounts for ESXi/AHV hosts, MFA on management interfaces, and monitoring for mass VM shutdown commands (esxcli vm process kill should page someone). If your backup workflows share the same control plane as production VMs, Akira's ESXi focus turns that architecture into a single point of failure. 

4. Watch egress, not just payloads. Deploy detection for Rclone, CyberDuck, MEGA/ProtonDrive transfers, and anomalous outbound volumes. Data staging in C:\PerfLogs\ before encryption is a recurring Qilin hallmark. 

5. Harden Active Directory and backup infrastructure. LSASS dumping, NTDS extraction, and Veeam credential theft are consistent pre-encryption behaviors for both groups. Tiered admin models, gMSAs for service accounts, and isolated backup credentials are cheap insurance. 

6. Build OT-specific response into the IR plan. Q2 2026 incident reports included West Pharmaceutical Services’ May 2026 double-extortion incident, where a precautionary, enterprise-wide shutdown of on-premises infrastructure was the right containment decision. The response halted manufacturing across international sites, despite no reported compromise of control systems.

Decide before an incident: which production lines can run degraded, what safe-state procedures look like, and who has authority to pull the plug. 

7. Assume the dwell time is measured in minutes-to-hours, not days. When Akira can encrypt a network in under four hours, detection during initial access and early credential access is the entire game. Managed detection with OT-aware analytics - not just signature AV - is what closes that gap.

Where OT enters the picture 

Neither group is known for writing malware that talks to PLCs. What they do is hit the IT systems a plant cannot run without: ERP, MES connectors, file shares, historians that sit on Windows servers, and the virtualization hosts underneath all of it. TXOne's analysis of Qilin incidents that touched OT environments describes network-device exploitation as the way in, followed by broad deployment across the network. Where IT and OT are converged, production systems get caught in the blast radius. 

The Asahi case shows how that plays out. The factories did not need to be hacked directly. Order processing and shipping went down, and production followed. 

Our read, based on how these intrusions unfold: the exposure usually comes from three places. A remote-access path that lands too close to the plant network. Shared credentials between corporate and OT domains. And virtualized OT workloads (historians, SCADA servers, engineering servers) living on the same hypervisor cluster that Qilin and Akira are built to encrypt.

What to prioritize this quarter 

The entry points are well known, so the fixes are too. In rough order of payoff: 

1. Inventory and harden every edge device. List all VPN gateways, firewalls and remote-access appliances, including ones a vendor or integrator installed years ago. Patch, and disable legacy settings such as IKEv1 where you can. If you ever ran vulnerable SonicWall firmware, reset the credentials on the device and on any connected directory accounts. 

   
   

2. Watch VPN logins, not only vulnerabilities. Alert on logins from hosting providers, odd hours, impossible travel and accounts unused for months. Akira's access often looks like a legitimate user. 

   
   

3. Put phishing-resistant MFA on remote access. One-time codes were not enough in documented Akira cases. Where possible, require device certificates or hardware keys. 

   
   

4. Separate OT identity from corporate identity. No shared admin accounts, and no domain trusts that let a stolen corporate credential open an OT server. 

   
   

5. Control how remote access reaches the plant. Use a jump host or broker in a DMZ, with session recording and time-boxed vendor access. Never let a VPN terminate directly into a production zone. 

   
   

6. Segment the hypervisors. Keep OT virtual infrastructure on its own management network with its own credentials, and monitor for mass snapshot deletion and unexpected admin logins. 

   
   

7. Protect the backups you would actually need. Keep an offline or immutable copy, shield backup servers from domain-joined admin accounts, and test a restore of control-system configurations and engineering project files, not just file servers. 

   
   

8. Plan for the leak even if you can restore. Both groups steal first. Decide now who speaks to customers, regulators and the board when 100 GB of drawings and employee records show up on a leak site. 

   
   

9. Run a plant-level tabletop. Walk through what happens if ERP, shipping and your largest file server go dark for two weeks. Asahi's experience shows the scenario is realistic. 

Frequently asked questions 

Is Qilin the most active ransomware group in 2026? By most trackers, yes, though The Gentlemen are very close. NCC Group named Qilin the most active group for the sixth straight quarter in Q3 2026, while GuidePoint's GRIT report had The Gentlemen narrowly ahead. Both lead the manufacturing counts. 

Does the Qilin arrest mean the group is finished? No. The suspect was extradited from Japan to Germany on October 2, but Qilin kept posting new victims after he was detained in May. Its affiliate structure makes it resilient to the loss of any single person. 

Is Akira still active? Yes. Tracking data shows Akira posting victims into October 2026, including several manufacturers. 

Do Qilin and Akira attack industrial control systems directly? The documented pattern is IT-first. They take over corporate networks, virtualization and backup infrastructure, and operations stop as a result. Direct manipulation of controllers is not what these groups are known for, but converged networks make OT impact easy to cause by accident. 

What is the single most effective control against both groups? Securing remote access: patched edge devices, strong MFA, and a design in which a compromised VPN account cannot reach production systems. 

How Shieldworkz can help 

Shieldworkz is an end-to-end industrial OT cybersecurity company, with products, services and solutions for critical infrastructure and manufacturers. For teams working through the list above, the usual starting points are an OT asset and exposure assessment, a review of remote-access and IT/OT segmentation, and an OT-specific incident-readiness exercise. To talk through what that would look like for your plants, contact the Shieldworkz team.