Ransomware remains a pre-eminent threat to the cyber landscape, including within industrial control system (ICS) environments – impacting production and operations as we have seen in the first half of 2021. This talk will leverage unique Dragos research to analyse which ICS verticals are most frequently targeted by which ransomware families, as well as the evolution of both ransomware families and their targeting priorities. We’ll conclude with a discussion of how to read between the lines of cyber incident reports to discern the degree of operational technology impact, as well as how to utilize network telemetry to identify other victims that may not have been reported on data leak sites or in the media.