Industrial threat report for Q1 2026 | Securelist Solutions for: Home Products Small Business 1-50 employees Medium Business 51-999 employees Enterprise 1000+ employees by Kaspersky CompanyAccount Get In Touch Dark mode off English Russian Spanish Brazil Solutions Internet of Things & Embedded Security Learn More Industrial Cybersecurity Learn More Fraud Prevention Learn More KasperskyOS-based solutions Learn More Other solutions Kaspersky for Security Operations Center Kaspersky IoT Infrastructure Security Kaspersky Secure Remote Workspace Industries National Cybersecurity Learn More Industrial Cybersecurity Learn More Finance Services Cybersecurity Learn More Healthcare Cybersecurity Learn More Transportation Cybersecurity Learn More Retail Cybersecurity Learn More Other Industries Telecom Cybersecurity View all Products Kaspersky Next NEW! Learn More Kaspersky XDR Learn More Kaspersky Endpoint Security for Business Learn More Kaspersky EDR Expert Learn More Kaspersky EDR Optimum Learn More Kaspersky Anti Targeted Attack Platform Learn More Kaspersky Hybrid Cloud Security Learn More Kaspersky SD-WAN Learn More Kaspersky Industrial CyberSecurity Learn More Kaspersky Container Security Learn More Other Products Kaspersky Security for Internet Gateway Kaspersky Embedded Systems Security Kaspersky IoT Infrastructure Security Kaspersky Secure Remote Workspace Kaspersky Security for Mail Server View All Services Kaspersky Cybersecurity Services Learn More Kaspersky Security Awareness Learn More Kaspersky Premium Support Learn More Kaspersky Threat Intelligence Learn More Kaspersky Managed Detection and Response Learn More Kaspersky Compromise Assessment Learn More Kaspersky SOC Consulting Learn More Other Services Kaspersky Professional Services Kaspersky Incident Response Kaspersky Cybersecurity Training View All Resource Center Case Studies White Papers Datasheets Technologies MITRE ATT&CK About Us Transparency Corporate News Press Center Careers Sponsorship Policy Blog Contacts GDPR Subscribe --> Dark mode off Login --> Securelist menu English Russian Spanish Brazil Existing Customers Personal My Kaspersky Renew your product Update your product Customer support Business KSOS portal Kaspersky Business Hub Technical Support Knowledge Base Renew License Home Products Trials&Update Resource Center Business Kaspersky Next Small Business (1-50 employees) Medium Business (51-999 employees) Enterprise (1000+ employees) Securelist Threats Financial threats Mobile threats Web threats Secure environment (IoT) Vulnerabilities and exploits Spam and Phishing Industrial threats Categories APT reports Incidents Research Malware reports Spam and phishing reports Publications Kaspersky Security Bulletin Archive All Tags APT Logbook Webinars Statistics Encyclopedia Threats descriptions KSB 2021 About Us Company Transparency Corporate News Press Center Careers Sponsorships Policy Blog Contacts Partners Find a Partner Partner Program Content menu Close Subscribe Threat Response by Kaspersky Dark mode off Threats Threats APT (Targeted attacks) Secure environment (IoT) Mobile threats Financial threats Spam and phishing Industrial threats Web threats Vulnerabilities and exploits All threats Categories Categories APT reports Malware descriptions Security Bulletin Malware reports Spam and phishing reports Security technologies Research Publications All categories Other sections Threat Response All tags Webinars APT Logbook Statistics Encyclopedia Threats descriptions KSB 2025 Kaspersky ICS CERT Industrial threats Threat landscape for industrial automation systems. Q1 2026 Industrial threats 07 Jul 2026 minute read Kaspersky ICS CERT Table of Contents All threats Selected industries Threat categories Malicious scripts and phishing pages (JS and HTML) Spyware Denylisted internet resources Malicious documents (Microsoft Office + PDF) Ransomware Miners in the form of executable files for Windows Web miners Worms Viruses Malware for AutoCAD Main threat sources Internet Email clients Removable media Network folders Authors Kaspersky ICS CERT All threats The percentage of ICS computers on which malicious objects were blocked continued to decrease, reaching 19.6% in Q1 2026. This is the lowest value in three years, and it is 1.4 times lower than in Q2 2023. Percentage of ICS computers on which malicious objects were blocked, Q2 2023–Q1 2026 Regionally, the percentages ranged from 9.1% in Northern Europe to 27.4% in Africa. Regions ranked by percentage of attacked ICS computers The percentage of ICS computers on which malicious objects were blocked increased in five regions over the quarter, most notably in Southern Europe, Northern Europe, and Russia. In Q1 2026, Southern Europe led the way in growth for internet and email threats. The region also saw the fastest growth in spyware, as well as malicious scripts and phishing pages. In Russia, the percentage of ICS computers on which malicious objects were blocked exceeded the figures for the previous two quarters. Russia saw an increase in the percentage for threats from the internet, and a slight increase in the figure for threats from email clients (Russia is one of three regions where this figure did not decrease). Among the threat categories, the greatest increases were observed in the percentages for denylisted internet resources, as well as spyware (distributed in the region via the internet and email clients). Selected industries Biometric systems (26.4%) traditionally rank top among the industries and OT infrastructure types covered in this report in terms of the percentage of ICS computers on which malicious objects were blocked. These systems are characterized by internet access, extensive email use for data exchange and approvals (such as access granting), and, in many cases, minimal cybersecurity controls within the organizations that use these systems. Industries ranked by the percentage of ICS computers on which malicious objects were blocked Biometric systems rank first among industries in terms of email threats. At the same time, unlike other industries, the percentage for email threats in biometric systems exceeds that for internet threats. In all selected industries, the global average follows a downward trend. In Q1 2026, the percentage of ICS computers on which malicious objects were blocked increased only in the manufacturing sector — by 1.0 pp. The percentages for this industry increased across 10 regions, with the most notable increases in Western Europe, Northern Europe, and Russia. Threat categories In Q1 2026, Kaspersky security solutions blocked malware from 10,052 different malware families of various categories on industrial automation systems. Over the quarter, the percentage of ICS computers on which denylisted internet resources were blocked increased (after decreasing over the previous two quarters), and there was a slight increase in the percentage for AutoCAD malware. Percentage of ICS computers on which the activity of malicious objects from various categories was prevented Malicious scripts and phishing pages (JS and HTML) Malicious scripts and phishing pages retained their to spot among threat categories by the percentage of ICS computers on which these threats were blocked. The global average in Q1 2026 was 6.56%. Over the quarter, the percentages increased in four regions. The most significant change was observed in Southern Europe (9.85%, +0.94 pp). The figures for malicious scripts in the region increased over three consecutive quarters. Among the selected industries, across all regions, the highest percentages for the malicious scripts and phishing pages category were recorded for biometric systems (19.59%) and building automation (15.43%) in Southern Europe. These same industries lead in similar rankings for malicious documents and spyware. Spyware The percentage of ICS computers on which spyware was blocked decreased over two consecutive quarters, dropping to 3.73%. Despite the decline, spyware has ranked second among threat categories by the percentage of attacked computers for three consecutive quarters. The percentages increased in five regions over the quarter, most notably in Southern Europe (5.46%, +0.35 pp) and Russia (2.84%, +0.24 pp). In Southern Europe, the percentage of ICS computers on which spyware was blocked increased in all the selected industries except manufacturing. The greatest increase was observed in biometric systems. Among the selected industries, the highest percentage of spyware in Russia was recorded in biometric systems. That said, the percentage of ICS computers on which spyware was blocked increased in all industries in the region except construction. The percentage figure has been increasing for two consecutive quarters in the oil and gas industry (by a factor of 1.63 over six months), and for three consecutive quarters in engineering and ICS integration, as well as electric power. In the remaining sectors, the values have been fluctuating. Percentage of ICS computers on which spyware was blocked in various industries in Russia, Q3 2025–Q1 2026 Denylisted internet resources The percentage of ICS computers on which denylisted internet resources were blocked increased to 3.54%. The most notable increase over the quarter occurred in Southeast Asia (4.58%, +0.65 pp). Among the industries in the region, the highest percentage figures for this threat category were recorded in electric power and construction. Over the quarter, the largest increases in percentages figures were observed in the electric power and manufacturing industries. In North America (Canada), denylisted internet resources (2.14%) showed the greatest increase among all categories — by a factor of 1.22. Among the selected industries across all regions, the highest percentage figures for the denylisted internet resources category were in the electric power (7.11%) and construction (6.25%) industries in Southeast Asia. Malicious documents (Microsoft Office + PDF) The percentage figure for this category decreased over two consecutive quarters, reaching its lowest value (1.56%) for the entire period of observations in Q1 2026. It increased just in two regions: Australia and New Zealand (1.12%, +0.04 pp), and Russia (0.62%, +0.01 pp). Among the selected industries across all regions, the highest percentages for malicious documents were recorded for biometric systems (9.02%) and building automation (6.97%) in Southern Europe. These same industries also lead in similar rankings for malicious scripts and spyware. Ransomware The percentage of ICS computers on which ransomware was blocked has decreased for two consecutive quarters, dropping to 0.14%. This is the lowest value among all categories. The percentage increased in two regions: North America (Canada) (0.11%, +0.04 pp) and slightly in Northern Europe (0.06%, +0.01 pp). Among the selected industries across all regions, the highest percentages for ransomware were recorded in the oil and gas and manufacturing industries (0.92% and 0.65%, respectively) in Central Asia and the South Caucasus, and in biometric systems (0.89%) in Russia. Miners in the form of executable files for Windows The percentage of ICS computers on which miners in the form of executable files for Windows were blocked decreased to 0.59%. The percentage increased in seven regions. The largest increase was observed in Africa (0.63%, +0.16 pp). Among the selected industries, the largest increases in the region were in the manufacturing and oil and gas industries. Among the selected industries across all regions, the highest percentages for miners in the form of executable files were recorded in construction (1.99%), biometric systems (1.98%), and the oil and gas industry (1.97%) in Central Asia and the South Caucasus. Web miners The percentage of ICS computers on which web miners were blocked has been declining for a year, and in Q1 2026, it reached the lowest value for the entire period under review (0.22%). At the same time, the percentage increased in seven regions. The largest increases were observed in South Asia (0.28%, +0.11 pp), the Middle East (0.31%, +0.09 pp), and Africa (0.34%, +0.08 pp). Despite the increases, the percentages in these regions for Q1 2026 did not exceed those observed in 2023–2024 and in Q1 2025. Among the selected industries across all regions, the highest percentages for web miners were recorded for biometric systems (0.97%) in Russia. Biometric systems in South Asia (0.79%) ranked second, and the electric power sector in Southeast Asia (0.76%) ranked third. Worms The percentage of ICS computers on which worms were blocked decreased to 1.33%. The percentage decreased across all regions following an increase in the previous quarter (due to a wave of phishing attacks that distributed the Backdoor.MSIL.XWorm backdoor worm across all regions of the world). Among the selected industries across all regions, the highest percentage figure for worms was recorded for biometric systems (4.80%) in Central Asia and the South Caucasus. Two industries in Africa – biometric systems (4.04%) and electric power (3.53%) – took the second and third spots, respectively. Viruses The percentage of ICS computers on which viruses were blocked decreased to 1.31%. The top 3 regions by this figure remained the same: Southeast Asia (6.11%, first by a wide margin), Africa (4.15%), and East Asia (2.97%). These same regions are also among the leaders by the percentage of systems affected by AutoCAD malware. The largest increase in this figure was observed in Africa (+0.41 pp). Among the selected industries across all regions, the highest percentages for viruses were recorded in the construction industry (6.35%) and building automation (5.50%) in Southeast Asia. Malware for AutoCAD The percentage of ICS computers on which malware for AutoCAD was blocked increased to 0.30%. The most notable increase over the quarter was observed in Africa, with the region’s percentage figure rising by 0.47 pp, a very significant increase for this category, and almost doubling (to 0.91%). Among the selected industries across all regions, the highest percentages for AutoCAD malware were recorded in the construction industry in East Asia (5.58%) and Southeast Asia (3.87%). Main threat sources In Q1 2026, the average percentages across all threat sources, except threats from the internet, decreased globally. Percentage of ICS computers on which malicious objects from various sources were blocked Internet The percentage of ICS computers on which threats from the internet were blocked increased to 7.88%. However, over the past three years, the percentage figure for internet threats has followed a downward trend. The largest increases in the percentages were recorded in Southern Europe (8.59%, +0.59 pp), Southeast Asia (10.16%, +0.55 pp), and Northern Europe (4.47%, +0.51 pp). Among the selected industries across all regions, the highest percentages for threats from the internet were recorded in electric power (13.16%) and construction (12.55%) in Southeast Asia, and in the engineering and ICS integration sector (12.33%) in South Asia. Email clients The percentage of ICS computers on which threats delivered via email clients were blocked decreased to 2.59%. This is a three-year low. The percentage of this threat source increased in three regions: Southern Europe (6.54%, +0.2 pp), East Asia (1.5%, +0.09 pp), and slightly in Russia (0.7%, +0.04 pp). Among the selected industries across all regions, the highest percentages for email threats were recorded for biometric systems (19.78%) and building automation (12.34%) in Southern Europe. In these two industries, the percentage of ICS computers on which email threats are blocked is higher than the percentage for threats from the internet. A similar situation was observed in two other instances, both in biometric systems (in South America and Southeast Asia). Removable media The percentage of ICS computers on which threats were detected when connecting removable media continued to decrease, reaching its lowest value for the period under review (0.26%). Among the selected industries across all regions, the highest percentages for removable media threats blocked on ICS computers were observed in the electric power sector in Central Asia and the South Caucasus (1.45%), East Asia (1.34%), and Africa (1.16%). Network folders The percentage of ICS computers on which threats are blocked in network folders is steadily decreasing. In Q1 2026, it was the lowest for the period under review (0.029%). East Asia has traditionally led by a wide margin. The percentage for East Asia (0.135%) is 27 times higher than the lowest regional value (recorded in Northern Europe). The largest increases in the percentages for threats from network folders were observed in Africa (0.037%, +0.006 pp) and South America (0.013%, +0.006 pp). Among the selected industries across all regions, the construction industry in East Asia, at 0.36%, holds the top positions in the ranking by the percentage of ICS computers on which threats are blocked in network folders. For more information on industrial threats see the full version of the report. Malware Statistics Industrial control systems Keyloggers Ransomware Spyware Malware Worm Trojan Backdoor Miner Industrial threats Virus Threat landscape for industrial automation systems. Q1 2026 Your email address will not be published. Required fields are marked * Name * Email * Captcha validation failed. Please confirm you are not a robot and try again. Cancel Δ This site uses Akismet to reduce spam. Learn how your comment data is processed. Table of Contents All threats Selected industries Threat categories Malicious scripts and phishing pages (JS and HTML) Spyware Denylisted internet resources Malicious documents (Microsoft Office + PDF) Ransomware Miners in the form of executable files for Windows Web miners Worms Viruses Malware for AutoCAD Main threat sources Internet Email clients Removable media Network folders GReAT webinars 13 May 2021, 1:00pm GReAT Ideas. Balalaika Edition Boris Larin Denis Legezo 26 Feb 2021, 12:00pm GReAT Ideas. Green Tea Edition John Hultquist Brian Bartholomew Suguru Ishimaru Vitaly Kamluk Seongsu Park Yusuke Niwa Motohiko Sato 17 Jun 2020, 1:00pm GReAT Ideas. Powered by SAS: malware attribution and next-gen IoT honeypots Marco Preuss Denis Legezo Costin Raiu Kurt Baumgartner Dan Demeter Yaroslav Shmelev 26 Aug 2020, 2:00pm GReAT Ideas. Powered by SAS: threat actors advance on new fronts Ivan Kwiatkowski Maher Yamout Noushin Shabab Pierre Delcher Félix Aime Giampaolo Dedola Santiago Pontiroli 22 Jul 2020, 2:00pm GReAT Ideas. Powered by SAS: threat hunting and new techniques Dmitry Bestuzhev Costin Raiu Pierre Delcher Brian Bartholomew Boris Larin Ariel Jungheit Fabio Assolini From the same authors Threat landscape for industrial automation systems in Q4 2025 Threat landscape for industrial automation systems in Q3 2025 Threat landscape for industrial automation systems in Q2 2025 Modern vehicle cybersecurity trends Threat landscape for industrial automation systems in Q1 2025 In the same category Threat landscape for industrial automation systems in Q4 2025 Threat landscape for industrial automation systems in Q3 2025 Turn me on, turn me off: Zigbee assessment in industrial environments Threat landscape for industrial automation systems in Q2 2025 Threat landscape for industrial automation systems in Q1 2025 Latest Posts SOC, TI and IR posts Missed incidents, persistent threats, and response gaps: Insights from compromise assessment projects Victor Sergeev Amged Wageh The SOC Files: ScreenConnect masked as freeware. An inside look at a large-scale campaign Denis Kulik Publications OpenClaw: risks for the users and how to mitigate them Kaspersky APT reports ToddyCat: your hidden email assistant. Part 2 Andrey Gunkin Latest Webinars Cyberthreat talks 11 Jun 2026, 5:00pm 43 min The dark side of mobile: Threats targeting Android & iOS Fabio Assolini Tatyana Shishkova Dmitry Kalinin Cyberthreat talks 25 Jun 2026, 5:00pm 29 min Securing the pipeline: 2026 supply chain threats Victoria Vlasova Yaroslav Kikel Technologies and services 02 Jul 2026, 5:00pm 68 min Missed incidents: Compromise Assessment insights Victor Sergeev Amged Wageh Technologies and services 02 Jun 2026, 5:00pm 60 min AI meets cybersecurity: Powering the next digital move Vladislav Tushkanov Oleg Gorobets Anton Rusakov-Rudenko Reports ToddyCat: your hidden email assistant. Part 2 An in-depth analysis of Umbrij, a new tool used by the ToddyCat APT group to compromise corporate email communications in Gmail. The attack targeted OAuth authorization tokens, allowing threat actors to gain access to Google services. Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload Cloud Atlas attacks the public sector and diplomatic structures of Russia and Belarus, using ReverseSocks, SSH, and Tor for persistence in infected systems and its new tool, PowerCloud. Kimsuky targets organizations with PebbleDash-based tools Kaspersky researchers analyze a range of new PebbleDash-based tools used in recent Kimsuky campaigns and reveal their connection to the AppleSeed malware cluster. OceanLotus suspected of using PyPI to deliver ZiChatBot malware Kaspersky researchers uncovered malicious wheel packages in PyPI that targeted both Windows and Linux and contained a dropper delivering malware dubbed ZiChatBot. We attribute this activity to OceanLotus APT. Subscribe to our weekly e-mails The hottest research right in your inbox Email (Required) Captcha (Required) I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. Subscribe Δ Threats Threats APT (Targeted attacks) Secure environment (IoT) Mobile threats Financial threats Spam and phishing Industrial threats Web threats Vulnerabilities and exploits All threats Categories Categories APT reports Malware descriptions Security Bulletin Malware reports Spam and phishing reports Security technologies Research Publications All categories Other sections Threat Response All tags Webinars APT Logbook Statistics Encyclopedia Threats descriptions KSB 2025 Kaspersky ICS CERT © 2026 AO Kaspersky Lab. All Rights Reserved. Registered trademarks and service marks are the property of their respective owners. Privacy Policy Terms of use License Agreement Cookies

📌 来源: Kaspersky Securelist | 📅 2026-07-07