# Who is targeting manufacturing and industrial organisations?

> Public reporting links 12 threat groups to attacks on manufacturing and industrial organisations, including APT-C-36, Gelsemium and APT41. 4 of them are thought to have state backing. This page lists them and where they are thought to operate from, so you can see who might come after a business like yours.

Canonical page: https://www.precursorintelligence.com/industries/manufacturing-industrial
Breadcrumb: [Home](https://www.precursorintelligence.com/) > [Industries](https://www.precursorintelligence.com/industries) > Manufacturing and industrial

## At a glance

| Fact | Value |
|---|---|
| Threat groups linked | 12 |
| Sectors with their own page | 10 |
| Suspected state backing | 4 of 12 |
| Countries of origin | 3 |

## Which groups target manufacturing and industrial organisations?

| Group | Thought to operate from | Suspected state backing | Profile |
|---|---|---|---|
| APT-C-36 | Not known | No | https://www.precursorintelligence.com/threat-actors/apt-c-36 |
| Gelsemium | Not known | No | https://www.precursorintelligence.com/threat-actors/gelsemium |
| APT41 | China | People's Republic of China | https://www.precursorintelligence.com/threat-actors/apt41 |
| Predatory Sparrow | Not known | No | https://www.precursorintelligence.com/threat-actors/predatory-sparrow |
| POLONIUM | Lebanon | Lebanon | https://www.precursorintelligence.com/threat-actors/polonium |
| BRONZE VAPOR | China | No | https://www.precursorintelligence.com/threat-actors/bronze-vapor |
| Earth Berberoka | China | No | https://www.precursorintelligence.com/threat-actors/earth-berberoka |
| APT9 | China | No | https://www.precursorintelligence.com/threat-actors/apt9 |
| BRONZE SPRING | China | No | https://www.precursorintelligence.com/threat-actors/bronze-spring |
| APT42 | Iran | Iran (Islamic Republic of) | https://www.precursorintelligence.com/threat-actors/apt42 |
| Chamelgang | Not known | No | https://www.precursorintelligence.com/threat-actors/chamelgang |
| RedGolf | China | China | https://www.precursorintelligence.com/threat-actors/redgolf |

## Where are they thought to operate from?

- China: 6
- Lebanon: 1
- Iran: 1
- Not known: 4

## What counts as manufacturing and industrial?

- [Critical manufacturing](https://www.precursorintelligence.com/sub-industries/critical-manufacturing): 4 groups (also called manufacturing)
- [Industrial](https://www.precursorintelligence.com/sub-industries/industrial): 3 groups
- [Automotive](https://www.precursorintelligence.com/sub-industries/automotive): 2 groups
- [Aviation](https://www.precursorintelligence.com/sub-industries/aviation): 2 groups
- [Electronics manufacturers](https://www.precursorintelligence.com/sub-industries/electronics-manufacturers): 2 groups
- [Oil and gas manufacturing](https://www.precursorintelligence.com/sub-industries/oil-gas-manufacturing): 2 groups
- [Aerospace](https://www.precursorintelligence.com/sub-industries/aerospace): 1 group
- [Engineering](https://www.precursorintelligence.com/sub-industries/engineering): 1 group
- [Petroleum](https://www.precursorintelligence.com/sub-industries/petroleum): 1 group
- [Semiconductor](https://www.precursorintelligence.com/sub-industries/semiconductor): 1 group

## Frequently asked questions

### Which threat groups target manufacturing and industrial organisations?

Public reporting links 12 threat groups to attacks on manufacturing and industrial organisations, including APT-C-36, Gelsemium, APT41, Predatory Sparrow and POLONIUM.

### Where are these groups thought to operate from?

Most are thought to operate from China (6), Lebanon (1) and Iran (1). 4 of the 12 are thought to have backing from a government.

### What counts as manufacturing and industrial?

Public reporting describes manufacturing and industrial victims in several ways. The narrower sectors with groups of their own are critical manufacturing (4), industrial (3), automotive (2), aviation (2), electronics manufacturers (2), oil and gas manufacturing (2), aerospace (1), engineering (1), petroleum (1) and semiconductor (1).

### How can I check my own organisation's exposure?

Create an account and tell us the software you run. We match it against known flaws, rank each one from 0 to 100 using evidence it is being exploited, let you know as soon as something changes that affects you, and show which groups and ransomware gangs are hitting your sector.

## Check whether it matters to your business

A free Precursor Intelligence account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.precursorintelligence.com/register
- Book a demo: https://www.precursorintelligence.com/contact