Threat reportThreat IntelligenceTL-2026-4012
Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q2 2026
Kaspersky ICS CERT (TL-2026-4012), also tracked as Threat landscape for industrial automation systems Q2 2026, is a low-severity tracked intrusion set, first published 2026-10-21. It has no confirmed attribution, affects Various Windows computers in industrial automation environments, maps to 8 MITRE ATT&CK techniques (T1027, T1056.001, T1059), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4012
- Threat ID
- TL-2026-4012
- Also known as
- Threat landscape for industrial automation systems Q2 2026, Industrial Threat Report Q2 2026
- Severity
- LOW
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- biometrics, electric power, manufacturing, construction, building automation, oil and gas, engineering and ics integration
- Target regions
- Africa, East Asia, Southeast Asia, 039 - Southern Europe, 005 - South America, Middle East, 143 - Central Asia, South Asia, South Caucasus, russia, 053 - Australia and New Zealand
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Kaspersky ICS CERT
Malware and tooling: File viruses (1.29%), Malware for AutoCAD (0.31%), Network worms (1.43%), Ransomware (0.16% of ICS computers), Spyware, trojans, backdoors and keyloggers (3.30%), Windows cryptocurrency miners (0.48%) and web miners (0.14%), xmrig, NBMiner, OneZeroMiner, PowerShell, XMRig
How Kaspersky ICS CERT works
Kaspersky ICS CERT reports malicious objects were blocked on 19.15% of ICS computers in Q2 2026, the lowest rate since 2022. Internet-sourced threats fell to 7.61% while email-sourced threats rose to 2.84%; Africa had the highest share of attacked ICS computers (27.9%) and Northern Europe the lowest (8.1%).
This is a statistical trend report, not a single incident. Kaspersky ICS CERT publishes quarterly telemetry from the Kaspersky Security Network (KSN) covering Windows computers that serve SCADA, HMI, historian and engineering-workstation roles in manufacturing, energy, construction, building automation, oil and gas, and ICS integration. An 'attack' is defined as one or more threats blocked on a computer during the period. The report identifies 10,904 distinct malware families blocked in Q2 2026.
Globally, malicious objects were blocked on 19.15% of ICS computers, the lowest level since 2022 (down 0.4 pp from Q1 2026). Regional values ranged from 8.1% (Northern Europe) to 27.9% (Africa, up 0.5 pp). East Asia rose by about 2.0 pp, mainly on malicious scripts and phishing pages (4.86%, +0.93 pp) and internet threats (6.3%, +0.8 pp); mainland China recorded the highest regional virus share (5.07%). The biometrics sector was the most attacked industry at 26.44% and led the malicious-script/phishing, malicious-document, spyware, ransomware, worm and email-threat categories; Kaspersky attributes this to extensive internet connectivity, heavy email use for approvals and minimal cybersecurity controls. Biometrics is unusual in that email threats exceed internet threats. Southern Europe's biometrics sector showed 11.48% malicious documents and 19.14% email threats.
By category: malicious scripts and phishing pages 5.42% (first place, decreasing); denylisted internet resources 4.31% (up from third to second place); spyware (trojans, backdoors, keyloggers) 3.30% (lowest since 2022); malicious documents 1.77% (increasing after several declining quarters); worms 1.43%; viruses 1.29%; ransomware 0.16% (increasing); Windows miners 0.48% and web miners 0.14% (both lowest since 2021); malware for AutoCAD 0.31% (increasing). By source: Internet 7.61% (lowest since 2021), email clients 2.84% (the only source to increase), removable media 0.24%, network folders 0.023% (lowest on record).
Ransomware rose in nearly all regions. Africa had the highest ransomware share (0.29%, highest since Q2 2025, with Sudan at 2.29% by a wide margin); Kaspersky's press release cites Q1-to-Q2 increases of 67% in Australia/New Zealand, 50% in Southeast Asia, 38% in South America, 31% in Africa and Central Asia, and 11% in the Middle East, with no increase in Western Europe, Southern Europe and Canada. Russia's biometrics sector showed 1.22% ransomware, the highest across all industries and regions in the report. Oil and gas had the highest miner shares (0.66% Windows, 0.34% web). Russia had the highest denylisted-resource share (5.17%, +1.33 pp), with electric power (6.61%) and engineering/ICS integration (5.62%) most affected. Other notable regional readings: Southeast Asia spyware 5.32% (manufacturing 7.32%, biometrics 8.93%); East Asia electric power spyware 11.75%; Australia/New Zealand electric power viruses rose from 0.29% to 1.24%; East Asia construction AutoCAD malware 6.38%; Middle East building-automation worms 2.90%; Southern Europe building-automation email threats 12.49%; South Asia engineering/ICS integration internet threats 12.16%.
Tradecraft described in the report: modular cryptocurrency miners combining legitimate mining software (XMRig, NBMiner, OneZeroMiner) with customized configurations, delivered in archives containing Windows LNK shortcuts that launch malicious PowerShell commands instead of legitimate applications; fileless execution via PowerShell command-line arguments that run malware entirely in memory; and spyware delivered in phishing emails as password-protected archives or multi-layered scripts inside Office documents. Kaspersky's ICS CERT head quoted in the press release noted ransomware operations are shifting toward evasion-prone tactics that exploit legitimate administrative tools. The report names no CVEs, threat actors, or network/file IOCs, so no BeaconBeagle correlation was applicable; IOC entries below are tool, behavior and prevalence indicators only.
MITRE ATT&CK techniques used in TL-2026-4012
Defense Evasion
T1027 Obfuscated Files or Information
Collection
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1204.002 Malicious File
Initial Access
T1091 Replication Through Removable Media; T1566.001 Spearphishing Attachment
Impact
Affected products and versions in Kaspersky ICS CERT
- Various — Windows computers in industrial automation environments (SCADA, HMI, historian servers, engineering workstations)
Remediation for Kaspersky ICS CERT
Immediate actions
- Filter email attachments and block password-protected archives, LNK-bearing archives and macro-enabled Office documents on mail gateways serving OT-adjacent users
- Block denylisted and malicious internet resources at the proxy/DNS layer for ICS engineering workstations
- Alert on LNK shortcuts or Office child processes launching PowerShell with long command-line arguments on ICS computers
Workarounds
- Disable or control removable media on ICS computers
- Enable PowerShell script block logging and constrained language mode where PowerShell is required
- Monitor for unauthorized cryptocurrency miner binaries (XMRig, NBMiner) and mining-pool traffic from OT hosts
Longer-term hardening
- Deploy endpoint protection and EDR on SCADA, HMI, historian and engineering workstations
- Restrict internet and email access from OT networks and segment them from IT
- Maintain offline, tested backups of ICS project files and configurations to limit ransomware impact
- Conduct regular OT security assessments and continuous vulnerability assessment; build incident response capability
- Monitor threat intelligence for ICS-focused developments
Timeline of Kaspersky ICS CERT
- Start of the Q2 2026 reporting period covered by Kaspersky ICS CERT KSN telemetry
- Kaspersky ICS CERT publishes its brief overview of main industrial cybersecurity incidents for Q1 2026, the preceding-quarter context for the Q2 comparison
- End of the Q2 2026 reporting period; malicious objects had been blocked on 19.15% of ICS computers, the lowest rate since 2022
- Head of Kaspersky ICS CERT states ransomware is shifting toward evasion-prone tactics that exploit legitimate administrative tools, and recommends OT assessments, patching, EDR and incident response capability
- Kaspersky press release highlights rising ransomware against ICS in nearly all regions, with Australia/New Zealand up 67% and Southeast Asia up 50% quarter over quarter
- Kaspersky ICS CERT publishes the Q2 2026 threat landscape report for industrial automation systems (10,904 malware families blocked)
- Securelist publishes the Q2 2026 industrial threat report article
Sources cited for Kaspersky ICS CERT
- Threat landscape for industrial automation systems. Q2 2026 (Securelist)
- Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q2 2026
- Kaspersky ICS CERT Q2 2026 report (PDF)
- Kaspersky ICS CERT Q2 2026 saw a rise in ransomware targeting industrial control systems (press release)
- Kaspersky ICS CERT publication page (25 August 2026)
- A brief overview of the main incidents in industrial cybersecurity, Q1 2026 (Kaspersky ICS CERT)
Detection coverage for TL-2026-4012
As of 2026-10-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4012 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.