Thank You

Manufacturing organizations remain a high-priority target because attackers can create business impact without immediately touching production systems. Credential exposure, spoofed infrastructure, social impersonation, and third-party abuse can all support fraud, access brokering, vendor compromise, or disruption that eventually affects plant operations, logistics, customer trust, or supplier continuity.

Doppel telemetry from January through May 2026 shows that industrial and manufacturing threat activity is heavily shaped by credential exposure and external infrastructure abuse. After reaching its lowest point in March, threat activity surged sharply in April and remains elevated in May.

The broader manufacturing threat landscape supports this pattern. IBM X-Force reported that manufacturing remained the most targeted sector for the fifth consecutive year in its 2026 Threat Intelligence Index, reinforcing that attackers continue to view manufacturers as high-leverage targets because of operational downtime sensitivity, supply chain dependency, and complex hybrid IT/OT environments.

Across Doppel telemetry, the most important signal is the dominance of credential leak activity. Credential leak sources accounted for more than 90% of top-source activity in February and April, and more than 85% in May. Leaked credentials may provide attackers with lower-friction paths into supplier portals, VPNs, cloud services, email accounts, and remote access tools.

At the same time, attackers continue to use trusted and rapidly deployable platforms, including Gitbook, Webflow, Blogspot, Netlify, and Cloudflare Pages. These services can be used to host convincing impersonation pages, phishing flows, fake documentation, and campaign infrastructure with low setup cost and fast replacement after takedown.

Taken together, Doppel’s view of manufacturing risk is identity-led, platform-enabled, and supply chain exposed. The threat activity observed is primarily external-facing, but it carries downstream risk because manufacturing environments depend on connected business systems, distributed plants, contractors, suppliers, and third-party support relationships.