Loading story…
In Q2 2026, malicious objects were blocked on 19.15% of industrial control system (ICS) computers, the lowest proportion recorded since 2022. The global decline masked quarterly increases in five regions, with East Asia and Africa experiencing notable growth across several threat categories; the biometrics sector had the highest exposure rate, with 26.44% of ICS computers affected.
Malicious scripts and phishing pages remained the most prevalent threats against ICS environments, followed by denylisted internet resources and spyware. Ransomware, worms, malicious documents, and AutoCAD-targeting malware increased globally, while email was the only infection source to rise worldwide, reaching 2.84% of ICS computers; miners, viruses, and threats delivered through the internet, removable media, and network folders generally declined.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
During Q2 2026, Kaspersky security solutions blocked malicious objects on 19.15% of industrial control system computers globally, the lowest proportion reported since 2022. The quarter saw increases in several categories including denylisted resources, malicious documents, worms, ransomware, and AutoCAD-targeting malware, while email was the only delivery source to increase globally.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malicious activity blocked on industrial control system (ICS) computers fell to **19.6% globally in Q1 2026**, the lowest level reported in three years, according to Securelist. Exposure varied sharply by region, ranging from **9.1% in Northern Europe** to **27.4% in Africa**, while **Southern Europe** and **Russia** recorded quarter-over-quarter increases in several threat categories. **Biometric systems** remained the most exposed segment at **26.4%**, and **manufacturing** was the only selected industry to post a global increase during the quarter. **Malicious scripts and phishing pages** remained the leading threat category on ICS computers, while **spyware** ranked second despite an overall decline. The report also noted increases in **denylisted internet resources** and **AutoCAD malware**, underscoring continued targeting of industrial environments through engineering and web-based workflows. Among infection vectors, **internet-delivered threats** were the only major source to rise globally, while threats arriving through **email**, **removable media**, and **network folders** declined to multi-year or period lows.
Jul 7, 2026Kaspersky ICS CERT observed a decrease in the percentage of industrial control system (ICS) computers with blocked malicious objects, dropping to 20.5% in Q2 2025. While most threat sources declined, email-borne threats and access to denylisted internet resources increased, with the biometrics sector most affected. The report underscores the evolving nature of initial infection vectors and the need for vigilance against multi-stage attacks in industrial environments.
Jun 29, 2026
Malware activity in 2025 demonstrated significant evolution, with non-ransomware malware playing a critical role in cyber intrusions across enterprise and industrial environments. Notable malware families such as QakBot, IcedID, Emotet, TrickBot, AsyncRAT, RedLine Stealer, and Lumma Stealer were widely used for initial access, credential theft, persistence, and post-compromise control, often operating undetected for extended periods. These malware strains enabled attackers to harvest sensitive data and maintain long-term footholds, supporting broader attack campaigns and facilitating the distribution of secondary payloads. Industrial automation systems also faced persistent threats, with Kaspersky reporting that 20.1% of ICS computers encountered blocked malicious objects in Q3 2025, involving over 11,000 different malware families. The biometrics, engineering, and manufacturing sectors were particularly affected, with notable increases in malware activity in East Asia due to the spread of malicious scripts within OT infrastructures. The diversity and sophistication of malware targeting both enterprise IT and industrial OT environments underscore the ongoing challenge of defending against evolving cyber threats.
Jun 29, 2026