cyber.hendryadrian.com
Security Report · securelist.com

Kaspersky: ICS Threat Activity Declined in Q2 2026, While Ransomware and Email Threats Rose

· Original article ↗

Summary

Kaspersky’s Q2 2026 report says malicious objects were blocked on 19.15% of ICS computers, the lowest share since 2022. Ransomware and email threats rose, while internet and removable-media threats declined.

Key points

  • Malicious objects were blocked on 19.15% of ICS computers, down to the lowest level since 2022; Kaspersky recorded 10,904 malware families.
  • Malicious scripts and phishing pages remained the top threat category, affecting 5.42% of ICS computers globally.
  • Ransomware rose to 0.16% globally after declining for three quarters; Africa led regions at 0.29%.
  • Email threats increased to 2.84%, while internet threats fell to 7.61%, their lowest level since 2021.
  • Threats from removable media and network folders continued to decline, reaching 0.24% and 0.023%, respectively.
  • Biometrics had the highest share of affected ICS computers among surveyed industries, at 26.44%, and led several threat-category rankings.

Article Details

Publisher
Kaspersky
Report Period
Q2 2026
Scope
Threat landscape for industrial automation systems, including ICS computers, threat categories, sources, regions, and selected industries.
Key Statistics
  • Malicious objects were blocked on 19.15% of ICS computers globally in Q2 2026, the lowest level since 2022.
  • Kaspersky security solutions blocked malware from 10,904 different malware families on industrial automation systems during Q2 2026.
  • The global percentage of ICS computers on which malicious scripts and phishing pages were blocked was 5.42%.
  • The global percentage of ICS computers on which threats from the internet were blocked was 7.61%, the lowest level since 2021.
  • The global percentage of ICS computers on which email threats were blocked increased to 2.84%.

Vendors

KasperskyIn Q2 2026, Kaspersky security solutions blocked malware from 10,904 different malware families of various categories on industrial automation systems.

Products

AutoCADincreased: denylisted internet resources, malicious documents, worms, ransomware, and malware for AutoCAD.

Countries

ChinaAmong the countries and territories in the region, the highest percentage of ICS computers on which spyware was blocked was in mainland China (6.61%).RussiaThe figures increased in all regions over the quarter, most notably in Russia (by 1.33 pp).

Industries

BiometricsThe biometrics sector (26.44%) has traditionally led the rankings of industries and OT infrastructures surveyed in this report in terms of the percentage of ICS computers on which malicious objects were blocked.Building automationThe highest figures were recorded for biometrics (9.01%) and building automation (6.49%).ConstructionIn East Asia, the percentage of ICS computers affected by malicious scripts and phishing pages increased in all the industries surveyed, except construction.Electric powerAmong the selected industries in Russia, the highest figures for the denylisted internet resources were in the electric power (6.61%) and engineering and ICS integration (5.62%) industries.Engineering and ICS integrationAmong the selected industries in Russia, the highest figures for the denylisted internet resources were in the electric power (6.61%) and engineering and ICS integration (5.62%) industries.ManufacturingAmong the selected industries in East Asia, the highest figures for spyware were in the electric power (11.75%) and manufacturing (5.87%) industries.Oil and gasOn average, the oil and gas industry led the rankings among the selected industries both in terms of miners in the form of executable files for the Windows OS (0.66%) and in terms of web miners (0.34%).