OTPulse Weekly - April 7, 2026

Dragos tracked 119 ransomware groups hitting 3,300+ industrial organizations in 2025, nearly double 2024's count. Three new threat groups were identified targeting critical infrastructure globally. The number that should follow you into your next budget conversation: fewer than 10% of OT networks have any active visibility or monitoring in place.

A global survey of 200 C-level OT security decision-makers found 96% of OT incidents originate from IT-level compromises, 60% of organizations experienced an incident in 2025, and 88% increased OT security spending by more than 10% this year. If you are building a business case for budget, this survey data translates directly into executive-level language.

Ransomware frequency against OT appears to be slowing - but the Waterfall analysis argues this masks a more concerning shift: nation-state actors are moving from pre-positioning to active, direct attacks on critical infrastructure OT. The accompanying webinar is worth registering for if you brief leadership on threat trends.

Attackers attributed to Iran wiped approximately 80,000 Stryker operational devices in a destructive attack. The scale here is notable - this is not ransomware with a negotiation phase, this is wiper-style destruction at industrial scale.

A water facility was among this week's ransomware victims, per SecurityWeek's weekly roundup. No facility name or attribution has been disclosed publicly. For those of you in water and wastewater, this is a reminder that your sector remains actively targeted.

CERT-EU confirmed the European Commission was among the victims of the ongoing TeamPCP supply chain attack. Mandiant has now quantified the total scope at 1,000+ SaaS environments. SANS ISC is tracking updates actively.

The Australian government is opening industry consultation on legislative reforms that would expand government authority to intervene directly during critical infrastructure attacks. If you operate in Australia or advise organizations that do, the consultation window is open now.

ISA's fourth annual OT Cybersecurity Summit has its full program released. Early-bird registration closes April 17. The conference is organized around the ISA/IEC 62443 standards community, which makes it more practitioner-focused than most.

Claroty, Dragos, Forescout, Nozomi, Schneider Electric, Tenable, and Waterfall Security announced ETHOS, a vendor-neutral initiative for early-warning threat intelligence sharing across critical infrastructure. This is the first effort of its kind in the OT space. Worth watching if collective defense is part of how you think about sector-level risk.

A practitioner-facing checklist for evaluating OT remote access vendors - useful if you are currently assessing or renewing a remote access contract. Pair it with their companion webinar on 13 ways attackers break "secure" OT remote access systems.