Loading story…
Malicious activity blocked on industrial control system (ICS) computers fell to 19.6% globally in Q1 2026, the lowest level reported in three years, according to Securelist. Exposure varied sharply by region, ranging from 9.1% in Northern Europe to 27.4% in Africa, while Southern Europe and Russia recorded quarter-over-quarter increases in several threat categories. Biometric systems remained the most exposed segment at 26.4%, and manufacturing was the only selected industry to post a global increase during the quarter.
Malicious scripts and phishing pages remained the leading threat category on ICS computers, while spyware ranked second despite an overall decline. The report also noted increases in denylisted internet resources and AutoCAD malware, underscoring continued targeting of industrial environments through engineering and web-based workflows. Among infection vectors, internet-delivered threats were the only major source to rise globally, while threats arriving through email, removable media, and network folders declined to multi-year or period lows.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Kaspersky's analysis of Q1 2026 found that 19.6% of industrial control system computers had malicious objects blocked, the lowest global level observed in three years. The report also noted regional variation, increases in some categories in Southern Europe and Russia, and a rise in internet-delivered threats during the quarter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
In Q2 2026, malicious objects were blocked on **19.15%** of industrial control system (ICS) computers, the lowest proportion recorded since 2022. The global decline masked quarterly increases in five regions, with East Asia and Africa experiencing notable growth across several threat categories; the biometrics sector had the highest exposure rate, with **26.44%** of ICS computers affected. Malicious scripts and phishing pages remained the most prevalent threats against ICS environments, followed by denylisted internet resources and spyware. Ransomware, worms, malicious documents, and AutoCAD-targeting malware increased globally, while email was the only infection source to rise worldwide, reaching **2.84%** of ICS computers; miners, viruses, and threats delivered through the internet, removable media, and network folders generally declined.
Aug 27, 2026Kaspersky ICS CERT observed a decrease in the percentage of industrial control system (ICS) computers with blocked malicious objects, dropping to 20.5% in Q2 2025. While most threat sources declined, email-borne threats and access to denylisted internet resources increased, with the biometrics sector most affected. The report underscores the evolving nature of initial infection vectors and the need for vigilance against multi-stage attacks in industrial environments.
Jun 29, 2026
Researchers have observed a significant rise in the number of industrial control system (ICS) devices exposed to the internet, with the count increasing from approximately 160,000 at the start of 2024 to over 180,000 by the end of the year, and projections suggesting this figure could surpass 200,000 by the end of 2025. This trend has been highlighted by security firm Bitsight, which noted not only the growing number of exposed devices but also an uptick in operational technology (OT)-specific vulnerabilities. These vulnerabilities include remote code execution flaws, logic errors, and broken web authentication, some of which carry the highest possible severity ratings and offer attackers trivial exploit paths. The increase in exposed ICS/OT assets is attributed to the deployment of new devices with internet access, often configured with outdated or insecure protocols, minimal authentication, and insufficient network segmentation. This mismanagement of ICS/OT assets points to a broader issue in how organizations are securing critical infrastructure. The vulnerabilities present in these systems could allow attackers to disrupt essential services, manipulate industrial processes, or gain unauthorized access to sensitive environments. Security experts have warned that the lack of proper segmentation and the use of insecure protocols make these devices attractive targets for both cybercriminals and nation-state actors. The exposure of ICS devices is particularly concerning given their role in critical infrastructure sectors such as energy, water, and transportation. The U.S. government and cybersecurity agencies have issued advisories and called for improved security practices, including regular vulnerability assessments, implementation of strong authentication mechanisms, and network segmentation to reduce the attack surface. The growing attack surface created by these exposed devices increases the risk of large-scale cyberattacks that could have significant operational and safety impacts. Organizations are urged to prioritize the security of their ICS/OT environments by adopting best practices and leveraging available guidance from agencies such as CISA. The trend underscores the urgent need for a coordinated approach to securing critical infrastructure against evolving cyber threats. Failure to address these issues could result in severe disruptions to essential services and pose risks to public safety. The situation is further complicated by the rapid adoption of new technologies in industrial environments, which often outpaces the implementation of adequate security controls. As the number of internet-exposed ICS devices continues to rise, the potential for exploitation by malicious actors grows, making it imperative for organizations to act swiftly to mitigate these risks. The findings serve as a wake-up call for both private and public sector entities responsible for the security of critical infrastructure. Proactive measures, including continuous monitoring and timely patching of vulnerabilities, are essential to defend against the increasing threat landscape targeting ICS/OT systems.
Jun 29, 2026