Threat landscape for industrial automation systems in Q3 2025

The Threat landscape for industrial automation systems in Q3 2025 notes that the percentage of ICS computers on which malicious objects were blocked fell to 20.1%, the lowest level observed in the period. Regional data show figures ranging from 9.2% in Northern Europe to 27.4% in Africa, with East Asia seeing a notable rise driven by the spread of malicious scripts in OT infrastructures of engineering organisations and ICS integrators.

In the quarter, Kaspersky protection solutions blocked malware from 11,356 different malware families on industrial systems. Denylisted internet resources were blocked at 4.01% for the quarter, the lowest since early 2022, while malicious documents blocked rose to 1,98%. For next-stage malware, spyware was blocked at 4.04% (up 0.20 pp) and ransomware at 0.17% (up 0.03 pp), whereas miners declined, with 0.57% for Windows executables and 0.25% for web miners. AutoCAD malware also edged up slightly to 0.30% in Q3 2025.