Threat landscape for industrial automation systems in Q2 2025

According to Kaspersky ICS CERT, the threat landscape for industrial automation systems in Q2 2025 saw the percentage of ICS computers blocked for malicious objects fall to 20.5%, a decline of 1.4 percentage points from the previous quarter. The rate was also 3.0 percentage points lower than in Q2 2024, with regional ranges spanning from 11.2% in Northern Europe to 27.8% in Africa.

The report notes that Kaspersky security solutions blocked malware from 10,408 different malware families on industrial automation systems, with only the shares of denylisted internet resources and malicious documents increasing in the quarter. It adds that the initial infection phase involved denylisted internet resources rising to 5.91%, while malicious documents rose to 1.97%, and malicious scripts and phishing pages fell to 6.49%.

In terms of next‑stage malware, spyware was blocked on 3.84% of ICS computers, ransomware 0.14%, miners (Windows executables) 0.63%, and web miners 0.30%; AutoCAD malware was blocked on 0.29%. Authors: Kaspersky ICS CERT.