Scattered Spider never touched a single production line controller. They exploited two SAP NetWeaver zero-days, CVE-2025-31324 and CVE-2025-42999, to breach Jaguar Land Rover's ERP environment. Assembly lines across four countries went dark. Five weeks. $250M in direct losses. A measurable dip in UK GDP. The attack did not start on the factory floor. It started in the enterprise IT layer. That gap, between where security programs focus and where attacks actually begin, is what is being exploited across European manufacturing right now. Group-IB recorded 228 ransomware DLS publications targeting European manufacturers in 2025. The UK, Germany, and Italy absorbed 57% of them. Qilin led by case volume (18%), followed by Akira (12%). ERP and SAP exploitation is now replacing phishing as the primary entry point. If your plant's IT and OT environments share a domain, that is the attack path. The full 2025 European manufacturing threat landscape, covering ransomware actors, IAB activity, OT access claims, and country profiles, is in the report. Full findings at Group-IB: https://link.group-ib.com/42ylj1w #Manufacturing #Ransomware #CyberSecurity
Post summary
Report confirms the active exploitation of SAP NetWeaver zero‑days (CVE‑2025‑31324 & CVE‑2025‑42999) by Scattered Spider, resulting in significant operational disruption and financial loss for Jaguar Land Rover.