1、 Threat landscape for industrial automation systems Q4 2025Q4 2025 02.04.2026 Version 1.0 THREAT LANDSCAPE FOR INDUSTRIAL AUTOMATION SYSTEMS Q4 2025 2 2026 AO KASPERSKY LAB Q4 in numbers.3 Changes over the quarter.4 Feature of the quarter:worms in email.7 Statistics across all threats.8 Selected ind

2、ustries.11 Diversity of detected malicious objects.13 Threat categories.15 Malicious objects used for initial infection.16 Denylisted internet resources.16 Malicious documents(MSOffice+PDF).19 Malicious scripts and phishing pages(JS and HTML).22 Next-stage malware.25 Spyware.25 Ransomware.29 Miners

3、in the form of executable files for Windows.32 Web miners.36 Self-propagating malware.Worms and viruses.39 Worms.40 Viruses.43 AutoCAD malware.46 Main threat sources.50 Internet.50 Email clients.54 Removable media.58 Network folders.61 Methodology used to prepare statistics.65 THREAT LANDSCAPE FOR I

4、NDUSTRIAL AUTOMATION SYSTEMS Q4 2025 3 2026 AO KASPERSKY LAB Q4 in numbers Parameter Q3 2025 Q4 2025 Quarterly changes Global percentage of attacked ICS computers 20.1%19.7%0.4 pp Percentage of ICS computers on which malicious objects from different categories were blocked Malicious scripts and phis

5、hing pages(JS and HTML)6.79%6.58%0.21 pp Spy Trojans,backdoors and keyloggers 4.04%3.80%0.24 pp Denylisted internet resources 4.01%3.26%0.75 pp Malicious documents(MSOffice+PDF)1.98%1.76%0.22 pp Worms 1.26%1.60%0.34 pp Viruses 1.40%1.33%0.07 pp Miners in the form of executable files for Windows 0.57

6、%0.60%0.03 pp Malware for AutoCAD 0.30%0.29%0.01 pp Web miners running in browsers 0.25%0.24%0.01 pp Ransomware 0.17%0.16%0.01 pp Main threat sources Internet 7.99%7.67%0.32 pp Email clients 3.01%2.76%0.25 pp Removable media 0.33%0.31%0.02 pp Network folders 0.04%0.04%0.00 pp THREAT LANDSCAPE FOR IN