Manufacturing networks absorbed 46.2 million internet-of-things attack attempts in the first half of 2026, according to new threat data from SonicWall. The same period saw a dramatic 56.2% drop in intrusion prevention system alerts—a decline that security researchers say masks a more dangerous evolution: attackers are abandoning noisy, untargeted scans for surgical strikes that exploit the growing web of connected devices linking office IT to production floors.

The report, released July 24, paints a sector under siege but with a shifting adversary. While the raw number of blocked intrusion events fell to 474 million, the remaining activity signals persistent reconnaissance, ransomware probing, and exploitation of vulnerabilities that many factories assumed were under control. For plant operators and Windows administrators, the message is clear: yesterday’s perimeter defenses are no match for an attacker who reaches a domain controller through an unpatched IP camera.

Fewer Alerts Don’t Mean Fewer Threats

A 56.2% year-on-year reduction in manufacturing intrusion prevention events sounds like progress. It is the steepest decline across all industries tracked by SonicWall. But security telemetry counts blocked or detected attempts—not successful breaches. The drop could just as easily mean attackers are getting quieter, switching to stolen credentials, or targeting already-identified vulnerabilities rather than scanning broadly.

Nearly half a billion blocked events still represents a staggering volume of malicious activity. That volume includes ransomware, botnet traffic, and exploit kits probing for weak points. And while the total may be down, the attacks that slip through are increasingly aimed at the systems that matter most.

IoT Attacks Explode, Led by Old Camera Flaw

The most alarming number in the report is the 46.2 million IoT attack hits. More than half of the monitored manufacturing networks saw attempts to weaponize connected devices. Topping the list: CVE-2021-36260, a command-injection vulnerability in certain Hikvision cameras first disclosed years ago, which accounted for 43 million hits by itself.

The persistence of that four-year-old flaw reveals a painful truth about factory security: devices that facilities teams treat as tools—IP cameras, environmental sensors, badge readers, vendor-installed diagnostic boxes—are invisible to IT asset inventories and rarely patched. An exposed camera isn’t just a privacy risk; it can become a stepping stone to the engineering workstation or the domain controller sitting on the same flat network.

SCADA and Ransomware: Two Sides of the Same Risk

Manufacturing also recorded the highest rate of SCADA-targeted attacks among the sectors SonicWall monitors. Activity aimed at supervisory control and data acquisition systems—the supervisors, historians, and operator interfaces that drive physical processes—was a strategic red flag. Even if most attacks get blocked at the perimeter, the sheer volume shows that threat actors are increasingly interested in industrial control environments.

Ransomware remains a constant companion. Ten distinct families were active against manufacturing networks in the first half, with the Zhen ransomware variant alone generating 22.2 million detection hits. Those hits were concentrated on just two devices, underscoring how a single compromised machine can become the launchpad for a production-halting incident.

The Log4j Ghost That Won’t Leave

Thirteen-point-eight million Log4j2 detection events. That number, from SonicWall’s telemetry, confirms that the vulnerability disclosed in December 2021 is far from retired. In factories, Log4j lingers inside Java-based management applications, remote-access appliances, industrial software, and vendor-provided servers—often embedded so deeply that the patch team doesn’t know it’s there.

The real danger isn’t the detection itself; it’s the organization that believes it patched Log4j two years ago but never checked the third-party gateway that handles maintenance connections. That one oversight can give an attacker a direct path to internal networks.

For Windows Admins, the Factory Is Now Your Problem

If you manage Windows systems in a manufacturing environment, the threat model has flipped. Active Directory, file servers, SQL Server instances, and remote desktop services are no longer just office assets—they are the bridge between the corporate network and the plant floor. A compromised domain admin account can unlock engineering workstations, recipe databases, and jump hosts that lead directly to operational technology.

The attack chain often starts with a stolen password (phishing, password reuse, or token theft), then a sign-in through a remote access service or VPN. From there, the attacker scans for accessible Windows shares, identifies domain controllers, and moves laterally toward high-value systems. The incident begins as a routine IT intrusion and ends with a production outage.

The Architecture Problem No Firewall Can Fix

SonicWall’s data points to a deeper issue: manufacturing networks were never architected to handle the connectivity they now have. A plant may run a tightly controlled OT segment, then add a Windows reporting server for supervisors, an IoT camera system, a vendor VPN for remote maintenance, and a link to the cloud-based ERP. Each decision made sense in isolation. Together, they create a web of implicit trust that attackers can traverse.

Legacy VPNs compound the problem. Once an authenticated session is established, many VPNs grant broad network access. That turns a single stolen credential into a skeleton key. The alternative—application-level access, just-in-time approvals, and session recording—requires a mindset shift from “trust the network” to “verify every connection.”

What Manufacturing Security Requires Right Now

These aren’t theoretical risks; they’re patterns drawn from real attack data. The path to resilience doesn’t demand ripping out every legacy system. It demands deliberate, practical steps:

  • Inventory everything connected. List all devices—IP cameras, sensors, gateways, appliances—along with their firmware versions, network locations, and business owners. If you don’t know it’s there, you can’t protect it.
  • Segment aggressively. Put corporate IT, operational technology, IoT devices, and guest networks into separate zones with firewalls that enforce allowlists. A camera network should never initiate a session to a domain controller.
  • Lock down identity. Mandate phishing-resistant multifactor authentication for all remote and privileged access. Eliminate shared accounts. Implement tiered administration in Active Directory and use dedicated admin workstations.
  • Replace permanent vendor access with just-in-time privileges. Third-party maintenance accounts should be approved for specific tasks, constrained to target systems, and automatically revoked.
  • Create a vulnerability process that respects production. Patch what you can, but when you can’t, isolate vulnerable systems, disable unnecessary services, and monitor for exploit attempts.
  • Test recovery beyond file backups. Can you restore Active Directory, virtual hosts, and industrial application servers in a safe sequence? Are backups isolated from the domain credentials that an attacker might compromise?

What Comes Next

Connected factories aren’t going away. Remote monitoring, predictive maintenance, and supplier integration are competitive imperatives. But as the SonicWall data shows, the cyber risk isn’t coming from more sophisticated malware—it’s coming from architecture that inadvertently hands attackers a map.

The manufacturers that thrive will be those that treat every camera, every vendor login, and every network segment as a security decision. In an environment where digital convenience meets physical production, the gap between a blocked attack and a plant shutdown is thinner than most organizations realize.