# Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q2 2026

> Kaspersky ICS CERT reports malicious objects were blocked on 19.15% of ICS computers in Q2 2026, the lowest rate since 2022. Internet-sourced threats fell to 7.61% while email-sourced threats rose to 2.84%; Africa had the highest share of attacked ICS computers (27.9%) and Northern Europe the lowest (8.1%).

- **Published:** 2026-10-21T05:14:01Z
- **Last reviewed:** 2026-10-21T05:14:01Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4012
- **ID:** TL-2026-4012
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a statistical trend report, not a single incident. Kaspersky ICS CERT publishes quarterly telemetry from the Kaspersky Security Network (KSN) covering Windows computers that serve SCADA, HMI, historian and engineering-workstation roles in manufacturing, energy, construction, building automation, oil and gas, and ICS integration. An 'attack' is defined as one or more threats blocked on a computer during the period. The report identifies 10,904 distinct malware families blocked in Q2 2026.

Globally, malicious objects were blocked on 19.15% of ICS computers, the lowest level since 2022 (down 0.4 pp from Q1 2026). Regional values ranged from 8.1% (Northern Europe) to 27.9% (Africa, up 0.5 pp). East Asia rose by about 2.0 pp, mainly on malicious scripts and phishing pages (4.86%, +0.93 pp) and internet threats (6.3%, +0.8 pp); mainland China recorded the highest regional virus share (5.07%). The biometrics sector was the most attacked industry at 26.44% and led the malicious-script/phishing, malicious-document, spyware, ransomware, worm and email-threat categories; Kaspersky attributes this to extensive internet connectivity, heavy email use for approvals and minimal cybersecurity controls. Biometrics is unusual in that email threats exceed internet threats. Southern Europe's biometrics sector showed 11.48% malicious documents and 19.14% email threats.

By category: malicious scripts and phishing pages 5.42% (first place, decreasing); denylisted internet resources 4.31% (up from third to second place); spyware (trojans, backdoors, keyloggers) 3.30% (lowest since 2022); malicious documents 1.77% (increasing after several declining quarters); worms 1.43%; viruses 1.29%; ransomware 0.16% (increasing); Windows miners 0.48% and web miners 0.14% (both lowest since 2021); malware for AutoCAD 0.31% (increasing). By source: Internet 7.61% (lowest since 2021), email clients 2.84% (the only source to increase), removable media 0.24%, network folders 0.023% (lowest on record).

Ransomware rose in nearly all regions. Africa had the highest ransomware share (0.29%, highest since Q2 2025, with Sudan at 2.29% by a wide margin); Kaspersky's press release cites Q1-to-Q2 increases of 67% in Australia/New Zealand, 50% in Southeast Asia, 38% in South America, 31% in Africa and Central Asia, and 11% in the Middle East, with no increase in Western Europe, Southern Europe and Canada. Russia's biometrics sector showed 1.22% ransomware, the highest across all industries and regions in the report. Oil and gas had the highest miner shares (0.66% Windows, 0.34% web). Russia had the highest denylisted-resource share (5.17%, +1.33 pp), with electric power (6.61%) and engineering/ICS integration (5.62%) most affected. Other notable regional readings: Southeast Asia spyware 5.32% (manufacturing 7.32%, biometrics 8.93%); East Asia electric power spyware 11.75%; Australia/New Zealand electric power viruses rose from 0.29% to 1.24%; East Asia construction AutoCAD malware 6.38%; Middle East building-automation worms 2.90%; Southern Europe building-automation email threats 12.49%; South Asia engineering/ICS integration internet threats 12.16%.

Tradecraft described in the report: modular cryptocurrency miners combining legitimate mining software (XMRig, NBMiner, OneZeroMiner) with customized configurations, delivered in archives containing Windows LNK shortcuts that launch malicious PowerShell commands instead of legitimate applications; fileless execution via PowerShell command-line arguments that run malware entirely in memory; and spyware delivered in phishing emails as password-protected archives or multi-layered scripts inside Office documents. Kaspersky's ICS CERT head quoted in the press release noted ransomware operations are shifting toward evasion-prone tactics that exploit legitimate administrative tools. The report names no CVEs, threat actors, or network/file IOCs, so no BeaconBeagle correlation was applicable; IOC entries below are tool, behavior and prevalence indicators only.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1091 Replication Through Removable Media
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1056.001 Keylogging
- T1496.001 Compute Hijacking

## Sources

- [Threat landscape for industrial automation systems. Q2 2026 (Securelist)](https://securelist.com/industrial-threat-report-q2-2026/121159/)
- [Kaspersky ICS CERT: Threat landscape for industrial automation systems, Q2 2026](https://ics-cert.kaspersky.com/publications/reports/2026/08/25/threat-landscape-for-industrial-automation-systems-q2-2026/)
- [Kaspersky ICS CERT Q2 2026 report (PDF)](https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-Threat-landscape-for-industrial-automation-systems-Q2-2026-en.pdf?download=1)
- [Kaspersky ICS CERT Q2 2026 saw a rise in ransomware targeting industrial control systems (press release)](https://www.kaspersky.com/about/press-releases/kaspersky-ics-cert-q2-2026-saw-a-rise-in-ransomware-targeting-industrial-control-systems)
- [Kaspersky ICS CERT publication page (25 August 2026)](https://ics-cert.kaspersky.com/?p=17372)
- [A brief overview of the main incidents in industrial cybersecurity, Q1 2026 (Kaspersky ICS CERT)](https://ics-cert.kaspersky.com/publications/reports/2026/06/18/a-brief-overview-of-the-main-incidents-in-industrial-cybersecurity-q1-2026/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4012