Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Q1 2026

Key facts for Kaspersky ICS Q1 2026 threats

Detection coverage for Kaspersky ICS Q1 2026 threats

As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4930 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ICS Host: LNK-Style Script Execution from Explorer with Hidden or Encoded Arguments (TL-2026-4930)

Detects explorer.exe spawning PowerShell, cmd, mshta or Windows Script Host with hidden-window, encoded-command or download arguments, the execution pattern of an LNK extracted from an archive mimicking legitimate software that runs a malicious command (T1204.002, T1059.001). Kaspersky ICS CERT Q1 2026 describes this as a Windows cryptominer delivery chain on ICS computers (XMRig, NBMiner, OneZeroMiner); the same pattern fits XWorm-style phishing payloads. Equivalent KQL and Sigma variants are included.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.002, T1059.001, T1059, T1566.001
• Data sources: sysmon, microsoft_defender_for_endpoint, windows_process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\cscript.exe")
```TL-2026-4930 T1204.002 T1059.001: explorer.exe launching a script interpreter with hidden, encoded or download arguments, the pattern of an LNK double-clicked from an archive that mimics legitimate software```
| eval cl=lower(CommandLine)
| where match(cl, "(-w(indowstyle)?[[:space:]]+hidden|-nop(rofile)?|-e(nc|ncodedcommand)?[[:space:]]+[a-z0-9+/=]{20,}|\\biex\\b|invoke-expression|downloadstring|downloadfile|invoke-webrequest|\\biwr\\b|bitsadmin|urlcache|mshta[[:space:]]+https?://|curl[[:space:]]+(-[a-z]+[[:space:]]+)*https?://|\\.lnk)")
| stats count min(_time) as firstTime max(_time) as lastTime values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host User Image ParentImage
| convert ctime(firstTime) ctime(lastTime)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "mshta.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine matches regex @"(?i)(-w(indowstyle)?\s+hidden|-nop(rofile)?|-e(nc|ncodedcommand)?\s+[A-Za-z0-9+/=]{20,}|\biex\b|invoke-expression|downloadstring|downloadfile|invoke-webrequest|\biwr\b|bitsadmin|urlcache|mshta\s+https?://|curl\s+(-\w+\s+)*https?://|\.lnk)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Script Interpreter Launched from Explorer with Hidden, Encoded or Download Arguments
id: 5c0e1a10-4930-4b1e-8a01-000000000001
status: experimental
description: Detects explorer.exe starting a script interpreter or LOLBin with hidden-window, encoded-command or download arguments, the execution pattern of a shortcut (LNK) extracted from an archive that mimics legitimate software, as reported for Windows miner delivery on ICS hosts in TL-2026-4930.
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-31
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/06/09/threat-landscape-for-industrial-automation-systems-q1-2026/
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059
    - attack.t1059.001
    - attack.initial-access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    selection_cli:
        CommandLine|contains:
            - ' -w hidden'
            - ' -windowstyle hidden'
            - ' -nop'
            - ' -enc '
            - ' -encodedcommand '
            - 'DownloadString'
            - 'DownloadFile'
            - 'Invoke-WebRequest'
            - 'Invoke-Expression'
            - 'bitsadmin'
            - 'urlcache'
            - 'mshta http'
            - '.lnk'
    condition: all of selection_*
falsepositives:
    - Administrators double-clicking legitimate PowerShell or batch launchers in OT engineering shares
    - Software installers that start hidden PowerShell helpers
level: high

Known false positives:

• Administrators launching legitimate PowerShell or batch shortcuts from engineering file shares
• Vendor installers that spawn hidden PowerShell helpers through explorer.exe

Tuning notes: Scope to OT and engineering host groups first. Exclude known vendor installer and logon-script command lines with a lookup, and raise the regex to require a download or encoded argument if hidden-window alone is noisy. Enable Sysmon EventCode 1 with CommandLine and ParentImage on SCADA, HMI and historian hosts.

• 🔒 ICS Host: Office Application Spawning Script Interpreter (Phishing Document Execution, TL-2026-4930) · unlock with TL Creds
• 🔒 ICS Host: Cryptominer Tool Execution XMRig NBMiner OneZeroMiner (TL-2026-4930) · unlock with TL Creds
• 🔒 ICS Host: Connection to Community-Observed XWorm-Related Infrastructure (TL-2026-4930) · unlock with TL Creds
• 🔒 ICS Host: Script Interpreter Pulling Payload from Abused CDN, Messenger or Cloud Storage (TL-2026-4930) · unlock with TL Creds
• 🔒 ICS Host: Executable or Script Dropped to Root of Non-System or Removable Drive (TL-2026-4930) · unlock with TL Creds
• 🔒 Cloud Identity: OAuth Application Consent or Permission Grant, Access-Token Theft Precursor (TL-2026-4930) · unlock with TL Creds
• 🔒 ICS Host: Fileless In-Memory PowerShell with Encoded Payload or Embedded Miner Arguments (TL-2026-4930) · unlock with TL Creds
• 🔒 ICS Host: Password Brute Force or Spray Burst Against Windows Network Logon (TL-2026-4930) · unlock with TL Creds

Indicators of compromise for Kaspersky ICS Q1 2026 threats

As of 2026-10-31, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-4930.

How Kaspersky ICS Q1 2026 threats works

This is an aggregate telemetry report, not a single campaign or vulnerability. Kaspersky ICS CERT derives it from Kaspersky Security Network (KSN) data on Windows computers in enterprise OT environments (SCADA servers, historians, OPC gateways, engineering/operator workstations, HMIs, building automation servers). An 'attacked computer' is one on which at least one threat was blocked during the period. The report covers January-March 2026 and was published on 2026-06-09 (Securelist copy dated 2026-07-07). Globally, 19.6% of ICS computers were attacked (19.7% in Q4 2025), 1.4x lower than Q2 2023, and 10,052 malware families were blocked.

The report groups threats into three classes. Initial-infection objects are denylisted internet resources (3.54%, up 0.28 pp), malicious scripts and phishing pages (6.56%, first place for three consecutive quarters) and malicious documents (1.56%, lowest of the observation period). Next-stage malware is spyware/backdoors/keyloggers (3.73%), ransomware (0.14%), Windows miners (0.59%) and web miners (0.22%). Self-propagating malware is worms (1.33%) and viruses (1.31%). AutoCAD malware (0.30%) is not classed by spread method. By source, the internet accounts for 7.88% (up 0.21 pp), email clients 2.59% (three-year low), removable media 0.26% and network folders 0.029%.

Named malware is limited. Backdoor.MSIL.XWorm, a backdoor worm distributed in a phishing wave, caused the Q4 2025 spike in worm detections across all regions, and worm detections fell back in Q1 2026. Miners are delivered in three ways: archives mimicking legitimate software that contain LNK files pointing at malicious commands, fileless in-memory PowerShell, and legitimate mining tools (XMRig, NBMiner, OneZeroMiner) with customized configurations, which are classified as RiskTools. Spyware arrives mostly by phishing email, as password-protected archives or multi-layered scripts embedded in Office documents. Worms and miners spread by password brute force, theft and use of authentication data including access tokens, and network attacks on vulnerable software. Attackers also abuse legitimate services (CDN platforms, messengers, repositories, cloud storage) to host and deliver payloads.

Regionally, Africa is highest at 27.4% and Northern Europe lowest at 9.1% (3.0x gap). Southern Europe exceeded the global average for the first time, with email threats at 6.54%, malicious scripts at 9.85% and spyware at 5.46%. Southeast Asia leads on viruses (6.11%), AutoCAD malware (1.87%) and denylisted resources (4.58%). In Africa, AutoCAD malware rose 0.47 pp (nearly doubled, with Ethiopia, Algeria and Morocco near 2% each), viruses reached 4.15% and removable-media threats 1.23%. Russia saw spyware at 2.84% and manufacturing ransomware increases of 2.3-2.5x. In Canada, ransomware rose to 0.11%. Biometric systems are the most attacked industry at 26.4% (35.15% in Southern Europe). Manufacturing was the only industry to rise in Q1 (+1.0 pp), with Southeast Asia highest at 23.21%, Africa 21.36% and South Asia 20.13% (per the Kaspersky press release). The report cites weak information-security policy enforcement, weak phishing protection, unprotected OT hosts without endpoint protection, weak network segmentation and inadequate removable-media control as contributing factors. The source states no CVEs, IOCs (hashes, IPs, domains) or threat-actor attribution. Severity is analyst-assigned.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1204.002 Malicious File

Lateral Movement

T1091 Replication Through Removable Media; T1550.001 Application Access Token

Credential Access

T1110 Brute Force; T1528 Steal Application Access Token

Impact

T1496.001 Compute Hijacking

Initial Access

T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link

Remediation for Kaspersky ICS Q1 2026 threats

Patches

• Apply vendor security patches promptly to OT software and Windows hosts

Immediate actions

• Deploy and keep updated endpoint protection on OT/ICS Windows hosts, including engineering and operator workstations and HMIs
• Restrict internet and email access from OT hosts, especially in sectors such as biometric systems and building automation where email threats are high
• Block known-malicious URLs/IPs and abuse-prone file-sharing, CDN and messenger resources at the OT perimeter
• Control removable media use on OT hosts

Workarounds

• Where patching is not possible, isolate exposed OT hosts and block password-protected archives and Office macro/script content from untrusted email

Longer-term hardening

• Strengthen network segmentation between IT and OT and between OT zones
• Run regular security assessments of OT systems and continuous vulnerability management
• Improve phishing protection and security awareness for OT personnel
• Deploy EDR and strengthen incident response capability for OT incidents
• Monitor ICS threat-intelligence sources for evolving threats

Affected and fixed versions

• Various — Windows-based OT/ICS computers (SCADA servers, historians, OPC gateways, engineering/operator workstations, HMIs, building automation servers)

Timeline of Kaspersky ICS Q1 2026 threats

• 2025-12-31 Q4 2025: a phishing wave distributing the locked-ioc-3 backdoor worm across all regions caused a spike in worm detections on ICS computers (exact dates not given; quarter-end shown).
• 2026-01-01 Start of the Q1 2026 observation period (January-March 2026) for Kaspersky Security Network telemetry on ICS computers.
• 2026-02-28 February 2026: the monthly share of ICS computers hit by malicious scripts and phishing pages exceeded every one of the previous five months.
• 2026-03-31 End of Q1 2026: 19.6% of ICS computers attacked globally (down 0.1 pp from Q4 2025; lowest in three years); 10,052 malware families blocked; Africa 27.4%, Northern Europe 9.1%.
• 2026-06-09 locked-ioc-4 publishes 'Threat landscape for industrial automation systems. Q1 2026' and a press release noting rising manufacturing attacks in 10 regions (Southeast Asia 23.21%).
• 2026-07-07 Securelist publishes the 'Industrial threats Q1 2026' version of the report.

Sources cited for Kaspersky ICS Q1 2026 threats

• Threat landscape for industrial automation systems. Q1 2026 (Kaspersky ICS CERT) Kaspersky · Research · 2026-06-09
• Kaspersky ICS CERT: The beginning of 2026 showed an increase in cyberattacks on the manufacturing sector (press release) Kaspersky · Vendor report · 2026-06-09
• Kaspersky ICS CERT publication page: Q1 2026 threat landscape Kaspersky · Research · 2026-06-09
• Threat landscape for industrial automation systems. Q1 2025 (Kaspersky ICS CERT) Kaspersky · Research · 2025-05-15
• Industrial threats Q1 2026 (Securelist) Kaspersky Securelist · Blog · 2026-07-07
• Kaspersky Reports Rise in Cyberattacks on Manufacturing Sector (Security MEA) securitymea.com · News · 2026-06-09

More in threat intel

• Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys
• OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
• Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198
• Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)
• AI-Enabled Cyberattack Campaigns Against Japan: Three Cases Beyond ARTEX (CyberStrikeAI, LLM-Assisted Intrusions, AI-Written Tooling)

Further reading

• OpenClaw AI Agent Threat Landscape: 8 Attacks
• OpenCode AI Coding Agent: 8 Attack Vectors