Threat video1:00
Kaspersky ICS CERT Q1 2026 ICS Threats: Detection & IOCs
Blocked malicious objects fell to 19.6% of ICS computers in Q1 2026, a three-year low. It comes with 9 detection rules, 8 IOCs and a free Splunk SPL rule.
Read the full threat intel for Kaspersky ICS CERT Q1 2026 ICS Threats: Detection & IOCs →
Chapters
- 0:00The hook19.6% of industrial computers attacked.
- 0:04The storyA phishing wave peaked in Q4.
- 0:11Attack pathPhishing and scripts deliver fileless PowerShell.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromiseNo malicious indicators were published.
- 0:36MITRE ATT&CK techniques11 ATT&CK techniques, from initial access to impact.
- 0:41Remediation4 steps now: Deploy and keep updated endpoint protection on OT/ICS Windows hosts.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0019.6% of industrial computers attacked.
0:05A phishing wave peaked in Q4.
0:07February scripts then hit peak attacks.
0:11Phishing and scripts deliver fileless PowerShell.
0:14Hosts then mine cryptocurrency for attackers.
0:17Attackers brute-force passwords and steal tokens for lateral movement.
0:26No threat actor is attributed. Confidence: low.
0:31No malicious indicators were published.
0:3711 ATT&CK techniques, from initial access to impact.
0:424 steps now: Deploy and keep updated endpoint protection on OT/ICS Windows hosts.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.