The first quarter of 2026 saw a continued decline in the overall percentage of industrial control systems (ICS) computers affected by malicious objects, hitting a low of 19.6%. This marks the lowest figure in three years, a significant decrease from previous periods. Regionally, Northern Europe reported the lowest infection rate at 9.1%, while Africa experienced the highest at 27.4%. Despite the overall downward trend, five regions, including Southern Europe, Northern Europe, and Russia, observed an increase in blocked malicious objects. Southern Europe, in particular, saw notable growth in internet and email threats, as well as spyware and phishing pages.
Biometric systems consistently ranked highest among industries for ICS computer infections, with 26.4% of systems affected. This vulnerability is attributed to their internet connectivity, extensive email usage for data exchange, and often minimal cybersecurity controls. Biometric systems also led in email threats, surpassing internet threats, a unique characteristic compared to other industries. While most industries followed the global downward trend, the manufacturing sector experienced a slight increase of 1.0 percentage point in infections, with notable rises in Western Europe, Northern Europe, and Russia.
Kaspersky security solutions blocked malware from over 10,000 families on ICS in Q1 2026. Denylisted internet resources saw an increase after a prior decline, alongside a slight rise in AutoCAD malware. Malicious scripts and phishing pages remained a significant threat category, with a global average of 6.56% of ICS computers affected. Southern Europe showed the most substantial increase in these threats. Biometric and building automation systems, particularly in Southern Europe, recorded the highest percentages for malicious scripts and phishing pages.
Spyware, despite a recent decline to 3.73%, maintained its position as the second-highest threat category. Increases in spyware infections were observed in Southern Europe and Russia, affecting most industries except manufacturing in Southern Europe and construction in Russia. The oil and gas industry, along with engineering and ICS integration sectors, have seen consistent increases in spyware over the past six months and three quarters, respectively.
Denylisted internet resources saw an increase to 3.54%, with Southeast Asia experiencing the most significant rise. Electric power and construction industries in Southeast Asia reported the highest percentages for this threat. North America also noted a substantial increase in denylisted internet resources. Malicious documents, including Microsoft Office and PDF threats, reached a record low of 1.56%, with only Australia/New Zealand and Russia showing slight increases. Ransomware infections also dropped to a low of 0.14%, with minimal increases reported in North America and Northern Europe.
Miners in the form of executable files for Windows decreased to 0.59%, though several regions, including Africa, saw increases. Construction, biometric systems, and the oil and gas industry in Central Asia and the South Caucasus reported the highest percentages for these miners. Web miners continued their year-long decline, reaching 0.22%, but saw increases in South Asia, the Middle East, and Africa. Worm infections decreased to 1.33% across all regions, following a previous increase attributed to a widespread backdoor worm. Biometric systems in Central Asia and the South Caucasus reported the highest percentage for worms.
