ICS Electrical Services
Attack Intelligence
ICS Electrical Services was compromised in a ransomware attack attributed to dragonforce in March 2026. The organization, operating in the Construction sector in United Kingdom, was added to the group's data leak site as part of an extortion campaign.
dragonforce operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.
ICS Electrical Services is a Cincinnati based electrical contracting company that has been specializing in complex industrial installations since 1997. We provide a unique approach to the many facets of the industrial market that set us apart from the rest. Our services include full service electrical installations, outage and startup support, PLC system upgrades, instrumentation installation & Calibration, electrical design-build, UL Listed control panel assembly, automation & programming, and maintenance & repairs.
Intelligence correlations link this incident to 1 vulnerability(ies) including CVE-2025-5777, which may have been leveraged as initial access vectors or for lateral movement.